diff --git a/ci-operator/config/openshift/kubecsr/OWNERS b/ci-operator/config/openshift/kubecsr/OWNERS
new file mode 100644
index 0000000000000..fdd627ecb9c3a
--- /dev/null
+++ b/ci-operator/config/openshift/kubecsr/OWNERS
@@ -0,0 +1,12 @@
+# DO NOT EDIT; this file is auto-generated using tools/populate-owners.
+# from https://github.com/openshift/etcd/blob/ea0cf681c7f0278eff72846a6bfcd017cdfc83bf/OWNERS
+# See the OWNERS docs: https://git.k8s.io/community/contributors/guide/owners.md
+
+approvers:
+- abhinavdahiya
+- crawford
+- csrwng
+- ericavonb
+- hexfusion
+- smarterclayton
+- wking
diff --git a/ci-operator/config/openshift/kubecsr/openshift-kubecsr-openshift-4.0.yaml b/ci-operator/config/openshift/kubecsr/openshift-kubecsr-openshift-4.0.yaml
new file mode 100644
index 0000000000000..fdea7141a57dd
--- /dev/null
+++ b/ci-operator/config/openshift/kubecsr/openshift-kubecsr-openshift-4.0.yaml
@@ -0,0 +1,41 @@
+tag_specification:
+  name: '4.0'
+  namespace: ocp
+promotion:
+  name: '4.0'
+  namespace: ocp
+base_images:
+  base:
+    name: '4.0'
+    namespace: ocp
+    tag: base
+canonical_go_repository: github.com/coreos/kubecsr
+images:
+- dockerfile_path: Dockerfile.kube-client-agent.openshift
+  from: base
+  to: kube-client-agent
+- dockerfile_path: Dockerfile.kube-etcd-signer-server.openshift
+  from: base
+  to: kube-etcd-signer-server
+resources:
+  '*':
+    limits:
+      memory: 4Gi
+    requests:
+      cpu: 100m
+      memory: 200Mi
+build_root:
+  image_stream_tag:
+    cluster: https://api.ci.openshift.org
+    name: release
+    namespace: openshift
+    tag: golang-1.10
+tests:
+- as: unit
+  commands: make check
+  container:
+    from: src
+- as: e2e-aws
+  commands: TEST_SUITE=openshift/conformance/parallel run-tests
+  openshift_installer:
+    cluster_profile: aws
diff --git a/ci-operator/jobs/openshift/kubecsr/OWNERS b/ci-operator/jobs/openshift/kubecsr/OWNERS
new file mode 100644
index 0000000000000..fdd627ecb9c3a
--- /dev/null
+++ b/ci-operator/jobs/openshift/kubecsr/OWNERS
@@ -0,0 +1,12 @@
+# DO NOT EDIT; this file is auto-generated using tools/populate-owners.
+# from https://github.com/openshift/etcd/blob/ea0cf681c7f0278eff72846a6bfcd017cdfc83bf/OWNERS
+# See the OWNERS docs: https://git.k8s.io/community/contributors/guide/owners.md
+
+approvers:
+- abhinavdahiya
+- crawford
+- csrwng
+- ericavonb
+- hexfusion
+- smarterclayton
+- wking
diff --git a/ci-operator/jobs/openshift/kubecsr/openshift-kubecsr-openshift-4.0-postsubmits.yaml b/ci-operator/jobs/openshift/kubecsr/openshift-kubecsr-openshift-4.0-postsubmits.yaml
new file mode 100644
index 0000000000000..fd39d8f6aef35
--- /dev/null
+++ b/ci-operator/jobs/openshift/kubecsr/openshift-kubecsr-openshift-4.0-postsubmits.yaml
@@ -0,0 +1,32 @@
+postsubmits:
+  openshift/kubecsr:
+  - agent: kubernetes
+    branches:
+    - ^openshift-4\.0$
+    context: ""
+    decorate: true
+    decoration_config:
+      skip_cloning: true
+    name: branch-ci-openshift-kubecsr-openshift-4.0-images
+    spec:
+      containers:
+      - args:
+        - --artifact-dir=$(ARTIFACTS)
+        - --give-pr-author-access-to-namespace=true
+        - --promote
+        - --target=[images]
+        command:
+        - ci-operator
+        env:
+        - name: CONFIG_SPEC
+          valueFrom:
+            configMapKeyRef:
+              key: openshift-kubecsr-openshift-4.0.yaml
+              name: ci-operator-4.0-configs
+        image: ci-operator:latest
+        imagePullPolicy: Always
+        name: ""
+        resources:
+          requests:
+            cpu: 10m
+      serviceAccountName: ci-operator
diff --git a/ci-operator/jobs/openshift/kubecsr/openshift-kubecsr-openshift-4.0-presubmits.yaml b/ci-operator/jobs/openshift/kubecsr/openshift-kubecsr-openshift-4.0-presubmits.yaml
new file mode 100644
index 0000000000000..d52797d3d3a39
--- /dev/null
+++ b/ci-operator/jobs/openshift/kubecsr/openshift-kubecsr-openshift-4.0-presubmits.yaml
@@ -0,0 +1,122 @@
+presubmits:
+  openshift/kubecsr:
+  - agent: kubernetes
+    always_run: true
+    branches:
+    - openshift-4.0
+    context: ci/prow/e2e-aws
+    decorate: true
+    decoration_config:
+      skip_cloning: true
+    name: pull-ci-openshift-kubecsr-openshift-4.0-e2e-aws
+    rerun_command: /test e2e-aws
+    spec:
+      containers:
+      - args:
+        - --artifact-dir=$(ARTIFACTS)
+        - --give-pr-author-access-to-namespace=true
+        - --secret-dir=/usr/local/e2e-aws-cluster-profile
+        - --target=e2e-aws
+        - --template=/usr/local/e2e-aws
+        command:
+        - ci-operator
+        env:
+        - name: CLUSTER_TYPE
+          value: aws
+        - name: CONFIG_SPEC
+          valueFrom:
+            configMapKeyRef:
+              key: openshift-kubecsr-openshift-4.0.yaml
+              name: ci-operator-4.0-configs
+        - name: JOB_NAME_SAFE
+          value: e2e-aws
+        - name: TEST_COMMAND
+          value: TEST_SUITE=openshift/conformance/parallel run-tests
+        image: ci-operator:latest
+        imagePullPolicy: Always
+        name: ""
+        resources:
+          requests:
+            cpu: 10m
+        volumeMounts:
+        - mountPath: /usr/local/e2e-aws-cluster-profile
+          name: cluster-profile
+        - mountPath: /usr/local/e2e-aws
+          name: job-definition
+          subPath: cluster-launch-installer-e2e.yaml
+      serviceAccountName: ci-operator
+      volumes:
+      - name: cluster-profile
+        projected:
+          sources:
+          - secret:
+              name: cluster-secrets-aws
+      - configMap:
+          name: prow-job-cluster-launch-installer-e2e
+        name: job-definition
+    trigger: '(?m)^/test (?:.*? )?e2e-aws(?: .*?)?$'
+  - agent: kubernetes
+    always_run: true
+    branches:
+    - openshift-4.0
+    context: ci/prow/images
+    decorate: true
+    decoration_config:
+      skip_cloning: true
+    name: pull-ci-openshift-kubecsr-openshift-4.0-images
+    rerun_command: /test images
+    spec:
+      containers:
+      - args:
+        - --artifact-dir=$(ARTIFACTS)
+        - --give-pr-author-access-to-namespace=true
+        - --target=[images]
+        - --target=[release:latest]
+        command:
+        - ci-operator
+        env:
+        - name: CONFIG_SPEC
+          valueFrom:
+            configMapKeyRef:
+              key: openshift-kubecsr-openshift-4.0.yaml
+              name: ci-operator-4.0-configs
+        image: ci-operator:latest
+        imagePullPolicy: Always
+        name: ""
+        resources:
+          requests:
+            cpu: 10m
+      serviceAccountName: ci-operator
+    trigger: '(?m)^/test (?:.*? )?images(?: .*?)?$'
+  - agent: kubernetes
+    always_run: true
+    branches:
+    - openshift-4.0
+    context: ci/prow/unit
+    decorate: true
+    decoration_config:
+      skip_cloning: true
+    name: pull-ci-openshift-kubecsr-openshift-4.0-unit
+    rerun_command: /test unit
+    spec:
+      containers:
+      - args:
+        - --artifact-dir=$(ARTIFACTS)
+        - --give-pr-author-access-to-namespace=true
+        - --target=unit
+        command:
+        - ci-operator
+        env:
+        - name: CONFIG_SPEC
+          valueFrom:
+            configMapKeyRef:
+              key: openshift-kubecsr-openshift-4.0.yaml
+              name: ci-operator-4.0-configs
+        image: ci-operator:latest
+        imagePullPolicy: Always
+        name: ""
+        resources:
+          requests:
+            cpu: 10m
+      serviceAccountName: ci-operator
+    trigger: '(?m)^/test (?:.*? )?unit(?: .*?)?$'
diff --git a/cluster/ci/config/prow/config.yaml b/cluster/ci/config/prow/config.yaml
index 33204b19f5a99..d79e050b91d88 100644
--- a/cluster/ci/config/prow/config.yaml
+++ b/cluster/ci/config/prow/config.yaml
@@ -144,6 +144,7 @@ tide:
     - openshift/router
     - openshift/imagebuilder
     - openshift/must-gather
+    - openshift/kubecsr
     - openshift/kubernetes-metrics-server
     - openshift/cluster-version-operator
     - openshift/service-catalog
diff --git a/cluster/ci/config/prow/plugins.yaml b/cluster/ci/config/prow/plugins.yaml
index 5cb3efd71d55c..9113418bd51e0 100644
--- a/cluster/ci/config/prow/plugins.yaml
+++ b/cluster/ci/config/prow/plugins.yaml
@@ -137,6 +137,9 @@ plugins:
   openshift/image-registry:
   - approve
 
+  openshift/kubecsr:
+  - approve
+
   openshift/kubernetes-metrics-server:
   - approve