// if the approval state hasn't changed, never fail on approval validation
	// this is allowed so that a v1 client that is simply updating spec and not mutating this value doesn't get rejected.  Imagine a controller controlling a CRD spec.
	if oldApprovalState != nil && *oldApprovalState == newApprovalState {
		return nil
	}

	// in v1, we require valid approval strings
	switch newApprovalState {

                  "responseKind": {
                    "group": "",
                    "kind": "CertificateSigningRequest",
                    "version": ""
                  },
                  "subresource": "approval",
                  "verbs": [
                    "get",
                    "patch",
                    "update"
                  ]
                },
                {

                  "responseKind": {
                    "group": "",
                    "kind": "CertificateSigningRequest",
                    "version": ""
                  },
                  "subresource": "approval",
                  "verbs": [
                    "get",
                    "patch",
                    "update"
                  ]
                },
                {

		}},
		oldCSR: &capi.CertificateSigningRequest{ObjectMeta: validUpdateMetaWithFinalizers, Spec: validSpec},
		errs: []string{
			`status.conditions: Forbidden: updates may not add a condition of type "Approved"`,
		},
	}, {
		name:   "remove Approved condition",
		newCSR: &capi.CertificateSigningRequest{ObjectMeta: validUpdateMeta, Spec: validSpec},

#  - Always use single-quoted strings unless actually interpolating variables
#    or using escape characters.
#  - Use "approved verbs":
#    https://docs.microsoft.com/en-us/powershell/developer/cmdlet/approved-verbs-for-windows-powershell-commands
#  - Document functions using proper syntax:
#    https://technet.microsoft.com/en-us/library/hh847834(v=wps.620).aspx

  //
  // Deprecated: replaced by the affinity k8s settings which allows architecture nodeAffinity configuration of this behavior.
  ArchConfig arch = 1 [deprecated = true];

  // List of certSigners to allow "approve" action in the ClusterRole
  repeated string certSigners = 68;

  // TODO: remove this?
  // No longer used.
  string configRootNamespace = 50;

  // Controls whether the server-side validation is enabled.

	// writing the request headers if the request has an
	// "Expect: 100-continue" header. Zero means no timeout and
	// causes the body to be sent immediately, without
	// waiting for the server to approve.
	// This time does not include the time to send the request header.
	ExpectContinueTimeout time.Duration

	// TLSNextProto specifies how the Transport switches to an