Custom resource definitions are created using kubectl apply of the CRD yaml file or via the REST API. We do not see the service account field being part of the CRD spec. Does one require cluster role privileges to register the CRD into the k8s api server ? If not via service account, how is the user allowed/denied to add the CRD into the api server ?