diff --git a/deploy/pve-cloud-controller-manager.yaml b/deploy/pve-cloud-controller-manager.yaml
index 077132e..b818106 100644
--- a/deploy/pve-cloud-controller-manager.yaml
+++ b/deploy/pve-cloud-controller-manager.yaml
@@ -4,14 +4,32 @@ metadata:
   name: cloud-controller-manager
   namespace: kube-system
 ---
-apiVersion: rbac.authorization.k8s.io/v1beta1
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: system:cloud-controller-manager
+rules:
+- apiGroups: [""]
+  resources: ["events"]
+  verbs:
+  - create
+  - patch
+  - update
+- apiGroups: [""]
+  resources: ["nodes"]
+  verbs: ["*"]
+- apiGroups: [""]
+  resources: ["nodes/status"]
+  verbs: ["patch"]
+---
 kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: system:cloud-controller-manager
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: cluster-admin
+  name: system:cloud-controller-manager
 subjects:
 - kind: ServiceAccount
   name: cloud-controller-manager
@@ -20,10 +38,10 @@ subjects:
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  labels:
-    app: pve-cloud-controller-manager
   name: pve-cloud-controller-manager
   namespace: kube-system
+  labels:
+    app: pve-cloud-controller-manager
 spec:
   replicas: 1
   selector:
@@ -31,11 +49,10 @@ spec:
       app: pve-cloud-controller-manager
   template:
     metadata:
-      annotations:
-        scheduler.alpha.kubernetes.io/critical-pod: ""
       labels:
         app: pve-cloud-controller-manager
     spec:
+      priorityClassName: system-node-critical
       containers:
       - args:
         - --cloud-provider=pve
@@ -56,10 +73,6 @@ spec:
             secretKeyRef:
               key: password
               name: pvecloud
-        - name: NODE_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.nodeName
         image: reg.k8s.giftfish.de/library/pve-cloud-controller-manager-amd64:dev
         imagePullPolicy: Always
         livenessProbe:
diff --git a/deploy/pve-csr-approver-manager.yaml b/deploy/pve-csr-approver-manager.yaml
index 20ea1a7..6409e71 100644
--- a/deploy/pve-csr-approver-manager.yaml
+++ b/deploy/pve-csr-approver-manager.yaml
@@ -9,28 +9,20 @@ kind: ClusterRole
 metadata:
   name: pve-csr-approver
 rules:
-- apiGroups:
-  - certificates.k8s.io
-  resources:
-  - signers
-  # legacy-unknown: support before kubernetes-1.18.0
+- apiGroups: ["certificates.k8s.io"]
+  resources: ["signers"]
   resourceNames:
   - "kubernetes.io/legacy-unknown"
   - "kubernetes.io/kubelet-serving"
-  verbs:
-  - approve
-- apiGroups:
-  - certificates.k8s.io
-  resources:
-  - certificatesigningrequests
+  verbs: ["approve"]
+- apiGroups: ["certificates.k8s.io"]
+  resources: ["certificatesigningrequests"]
   verbs:
   - get
   - list
   - watch
-- apiGroups:
-  - certificates.k8s.io
-  resources:
-  - certificatesigningrequests/approval
+- apiGroups: ["certificates.k8s.io"]
+  resources: ["certificatesigningrequests/approval"]
   verbs:
   - create
   - update
@@ -39,22 +31,22 @@ kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: pve-csr-approver
-subjects:
-- kind: ServiceAccount
-  namespace: kube-system
-  name: pve-csr-approver
 roleRef:
   kind: ClusterRole
   name: pve-csr-approver
   apiGroup: rbac.authorization.k8s.io
+subjects:
+- kind: ServiceAccount
+  namespace: kube-system
+  name: pve-csr-approver
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  labels:
-    app: pve-csr-approver-manager
   name: pve-csr-approver-manager
   namespace: kube-system
+  labels:
+    app: pve-csr-approver-manager
 spec:
   replicas: 1
   selector:
@@ -62,11 +54,10 @@ spec:
       app: pve-csr-approver-manager
   template:
     metadata:
-      annotations:
-        scheduler.alpha.kubernetes.io/critical-pod: ""
       labels:
         app: pve-csr-approver-manager
     spec:
+      priorityClassName: system-node-critical
       containers:
       - name: manager
         env: