string(UsageDigitalSignature),
		string(UsageServerAuth),
	)
)

func IsKubeletServingCSR(req *x509.CertificateRequest, usages sets.String) bool {
	return ValidateKubeletServingCSR(req, usages) == nil
}
func ValidateKubeletServingCSR(req *x509.CertificateRequest, usages sets.String) error {
	if !reflect.DeepEqual([]string{"system:nodes"}, req.Subject.Organization) {
		return organizationNotSystemNodesErr
	}