diff --git a/vertical-pod-autoscaler/admission-controller/main.go b/vertical-pod-autoscaler/admission-controller/main.go
index 7526619759..40cb8077b8 100644
--- a/vertical-pod-autoscaler/admission-controller/main.go
+++ b/vertical-pod-autoscaler/admission-controller/main.go
@@ -33,7 +33,7 @@ import (
 )
 
 var (
-	certsDir = *flag.String("certs-dir", "/etc/tls-certs", `Where the TLS cert files are stored.`)
+	certsDir = flag.String("certs-dir", "/etc/tls-certs", `Where the TLS cert files are stored.`)
 )
 
 func newReadyVPALister(stopChannel <-chan struct{}) vpa_lister.VerticalPodAutoscalerLister {
@@ -53,7 +53,7 @@ func newReadyVPALister(stopChannel <-chan struct{}) vpa_lister.VerticalPodAutosc
 
 func main() {
 	flag.Parse()
-	certs := initCerts(certsDir)
+	certs := initCerts(*certsDir)
 	stopChannel := make(chan struct{})
 	vpaLister := newReadyVPALister(stopChannel)
 	as := &admissionServer{logic.NewRecommendationProvider(vpaLister)}
diff --git a/vertical-pod-autoscaler/deploy/vpa-rbac.yaml b/vertical-pod-autoscaler/deploy/vpa-rbac.yaml
index 0fb9e10760..1f61cd0a87 100644
--- a/vertical-pod-autoscaler/deploy/vpa-rbac.yaml
+++ b/vertical-pod-autoscaler/deploy/vpa-rbac.yaml
@@ -33,6 +33,7 @@ rules:
   - list
   - watch
   - patch
+---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata: