]
    },
    {
      "kind": "CertificateSigningRequest",
      "name": "certificatesigningrequests/approval",
      "namespaced": false,
      "singularName": "",
      "verbs": [
        "get",
        "patch",
        "update"
      ]
    },
    {
      "kind": "CertificateSigningRequest",
      "name": "certificatesigningrequests/status",
      "namespaced": false,
      "singularName": "",
      "verbs": [

			Message: "test message",
		})
		_, err := client.CertificatesV1().CertificateSigningRequests().UpdateApproval(context.TODO(), csr.Name, csr, metav1.UpdateOptions{})
		if err != nil {
			return err
		}
		return nil
	}

	controller := NewCertificateController(
		ctx,
		"test",
		client,
		informerFactory.Certificates().V1().CertificateSigningRequests(),
		handler,
	)
	controller.csrsSynced = func() bool { return true }

	}
}

var csrGroupResource = api.Resource("certificatesigningrequests")

// Validate verifies that the requesting user has permission to approve
// CertificateSigningRequests for the specified signerName.
func (p *Plugin) Validate(ctx context.Context, a admission.Attributes, _ admission.ObjectInterfaces) error {
	// Ignore all calls to anything other than 'certificatesigningrequests/approval'.
	// Ignore all operations other than UPDATE.

				resource:    certificatesapi.Resource("certificatesigningrequests"),
				subresource: "approve",
			},
			wantErr: "",
		},
		{
			name: "wrong type",
			a: &testAttributes{
				resource: certificatesapi.Resource("certificatesigningrequests"),
				obj:      &certificatesapi.CertificateSigningRequestList{},
				name:     "panda",
			},

				resource:    certificatesapi.Resource("certificatesigningrequests"),
				subresource: "approval",
				oldObj:      &certificatesapi.CertificateSigningRequestList{},
				operation:   admission.Update,
			},
			allowed: false,
		},
		"reject requests if looking up permissions fails": {
			attributes: &testAttributes{
				resource:    certificatesapi.Resource("certificatesigningrequests"),
				subresource: "approval",

		attributes  admission.Attributes
		allowedName string
		allowed     bool
		authzErr    error
	}{
		"wrong type": {
			attributes: &testAttributes{
				resource:    certificatesapi.Resource("certificatesigningrequests"),
				subresource: "status",
				oldObj:      &certificatesapi.CertificateSigningRequestList{},
				obj:         &certificatesapi.CertificateSigningRequestList{},
				operation:   admission.Update,
			},

  - "certificates.k8s.io"
  resources:
  - certificatesigningrequests/nodeclient
  verbs:
  - "create"
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: gce:beta:kubelet-certificate-rotation
  labels:
    addonmanager.kubernetes.io/mode: Reconcile
rules:
- apiGroups:
  - "certificates.k8s.io"
  resources:
  - certificatesigningrequests/selfnodeclient

	}
}

var csrGroupResource = api.Resource("certificatesigningrequests")

// Validate verifies that the requesting user has permission to sign
// CertificateSigningRequests for the specified signerName.
func (p *Plugin) Validate(ctx context.Context, a admission.Attributes, o admission.ObjectInterfaces) error {
	// Ignore all calls to anything other than 'certificatesigningrequests/status'.
	// Ignore all operations other than UPDATE.

	cleaner := cleaner.NewCSRCleanerController(
		controllerContext.ClientBuilder.ClientOrDie("certificate-controller").CertificatesV1().CertificateSigningRequests(),
		controllerContext.InformerFactory.Certificates().V1().CertificateSigningRequests(),
	)
	go cleaner.Run(ctx, 1)
	return nil, true, nil
}

func newRootCACertificatePublisherControllerDescriptor() *ControllerDescriptor {

	case createError:
		f.PrependReactor("create", "certificatesigningrequests", func(action clienttesting.Action) (handled bool, ret runtime.Object, err error) {
			switch action.GetResource().Version {
			case "v1":
				return true, nil, fmt.Errorf("create error")
			default:
				return true, nil, apierrors.NewNotFound(certificatesv1.Resource("certificatesigningrequests"), "")
			}
		})
	default: