But its corresponding bootstrap RBAC policy was shadowed by TokenRequest feature gate. This patch fix it.