MOVW	CPSR, R1                                          // 00100fe1
	MOVW	R1, CPSR                                          // 01f02ce1
	MOVW	$0xff, CPSR          // MOVW $255, CPSR           // fff02ce3
	MOVW	$0xff000000, CPSR    // MOVW $4278190080, CPSR    // fff42ce3
	MOVW	FPSR, R9                                          // 109af1ee
	MOVW	FPSR, g                                           // 10aaf1ee

	maxLengthSignerName := fmt.Sprintf("%s/%s.%s", maxLengthFQDN, repeatString("a", 63), repeatString("a", 253))
	tests := map[string]struct {
		csr  capi.CertificateSigningRequest
		errs field.ErrorList
	}{
		"CSR with empty request data should fail": {
			csr: capi.CertificateSigningRequest{
				ObjectMeta: validObjectMeta,
				Spec: capi.CertificateSigningRequestSpec{
					Usages:     validUsages,

func ParseCertificateRequest(asn1Data []byte) (*CertificateRequest, error) {
	var csr certificateRequest

	rest, err := asn1.Unmarshal(asn1Data, &csr)
	if err != nil {
		return nil, err
	} else if len(rest) != 0 {
		return nil, asn1.SyntaxError{Msg: "trailing data"}
	}

	return parseCertificateRequest(&csr)
}

func parseCertificateRequest(in *certificateRequest) (*CertificateRequest, error) {

	{AMOVBU, C_ADDR, C_NONE, C_REG, 65, 8, 0, LFROM | LPCREL, 4, C_PBIT | C_WBIT | C_UBIT},
	{AMOVW, C_LACON, C_NONE, C_REG, 34, 8, REGSP, LFROM, 0, C_SBIT},
	{AMOVW, C_PSR, C_NONE, C_REG, 35, 4, 0, 0, 0, 0},
	{AMOVW, C_REG, C_NONE, C_PSR, 36, 4, 0, 0, 0, 0},
	{AMOVW, C_RCON, C_NONE, C_PSR, 37, 4, 0, 0, 0, 0},
	{AMOVM, C_REGLIST, C_NONE, C_SOREG, 38, 4, 0, 0, 0, C_PBIT | C_WBIT | C_UBIT},

                "group": "",
                "kind": "CertificateSigningRequest",
                "version": ""
              },
              "scope": "Cluster",
              "shortNames": [
                "csr"
              ],
              "singularResource": "certificatesigningrequest",
              "subresources": [
                {
                  "responseKind": {
                    "group": "",

                "group": "",
                "kind": "CertificateSigningRequest",
                "version": ""
              },
              "scope": "Cluster",
              "shortNames": [
                "csr"
              ],
              "singularResource": "certificatesigningrequest",
              "subresources": [
                {
                  "responseKind": {
                    "group": "",

  && r == s390x.NewRotateParams(0, 0, 0)
  => (LGDR (CPSDR <t> y x))
(OR (RISBGZ (LGDR x) {r}) (MOVDconst [c]))
  && c >= 0
  && r == s390x.NewRotateParams(0, 0, 0)
  => (LGDR (CPSDR <x.Type> (FMOVDconst <x.Type> [math.Float64frombits(uint64(c))]) x))
(CPSDR y (FMOVDconst [c])) && !math.Signbit(c) => (LPDFR y)
(CPSDR y (FMOVDconst [c])) && math.Signbit(c)  => (LNDFR y)

	MSR	R25, FAR_EL1                       // 196018d5
	MRS	FPCR, R1                           // 01443bd5
	MSR	R27, FPCR                          // 1b441bd5
	MRS	FPSR, R5                           // 25443bd5
	MSR	R15, FPSR                          // 2f441bd5
	MRS	ID_AA64AFR0_EL1, R19               // 930538d5
	MRS	ID_AA64AFR1_EL1, R24               // b80538d5
	MRS	ID_AA64DFR0_EL1, R21               // 150538d5

			Patches: make(map[networking.EnvoyFilter_ApplyTo][]*EnvoyFilterConfigPatchWrapper),
		}
		// merge EnvoyFilterWrapper
		for _, efw := range matchedEnvoyFilters {
			for applyTo, cps := range efw.Patches {
				for _, cp := range cps {
					if proxyMatch(proxy, cp) {
						out.Patches[applyTo] = append(out.Patches[applyTo], cp)
					}
				}
			}
		}
	}

	return out
}

    # Grant kubelets permission to request client certificates
    ${KUBECTL} --kubeconfig "${CERT_DIR}/admin.kubeconfig" create clusterrolebinding kubelet-csr --clusterrole=system:certificates.k8s.io:certificatesigningrequests:selfnodeclient --group=system:nodes

    ${CONTROLPLANE_SUDO} cp "${CERT_DIR}/admin.kubeconfig" "${CERT_DIR}/admin-kube-aggregator.kubeconfig"