This patch allows the `external-snapshotter-runner` ClusterRole, which is bound to the `csi-snapshotter` Service Account, to create and manage VolumeSnapshot objects. This is needed during the synchronization of VolumeGroupSnapshots.
rbac-external-provisioner.yaml was copied from https://github.com/kubernetes-csi/external-provisioner/blob/master/deploy/kubernetes/rbac.yaml and must be refreshed when updating the external-provisioner image in setup-csi-snapshotter.yaml