return certificates.IsKubeletServingCSR(req, usagesToSet(usages))
}

func IsKubeletClientCSR(req *x509.CertificateRequest, usages []certificatesv1beta1.KeyUsage) bool {
	return certificates.IsKubeletClientCSR(req, usagesToSet(usages))
}

func usagesToSet(usages []certificatesv1beta1.KeyUsage) sets.String {
	result := sets.NewString()
	for _, usage := range usages {

		string(UsageClientAuth),
	)
	kubeletClientRequiredUsages = sets.NewString(
		string(UsageDigitalSignature),
		string(UsageKeyEncipherment),
		string(UsageClientAuth),
	)
)

func IsKubeletClientCSR(req *x509.CertificateRequest, usages sets.String) bool {
	return ValidateKubeletClientCSR(req, usages) == nil
}
func ValidateKubeletClientCSR(req *x509.CertificateRequest, usages sets.String) error {

			usages: kubeletClientUsagesNoRSA,
			exp:    true,
		},
	}
	for name, test := range tests {
		t.Run(name, func(t *testing.T) {
			got := IsKubeletClientCSR(test.req, test.usages)
			if test.exp != got {
				t.Errorf("unexpected IsKubeletClientCSR output: exp=%v, got=%v", test.exp, got)
			}
		})
	}
}

var (
	kubeletClientUsages = []capi.KeyUsage{
		capi.UsageDigitalSignature,

}

func isNodeClientCert(csr *capi.CertificateSigningRequest, x509cr *x509.CertificateRequest) bool {
	if csr.Spec.SignerName != capi.KubeAPIServerClientKubeletSignerName {
		return false
	}
	return capihelper.IsKubeletClientCSR(x509cr, usagesToSet(csr.Spec.Usages))
}

func isSelfNodeClientCert(csr *capi.CertificateSigningRequest, x509cr *x509.CertificateRequest) bool {
	if csr.Spec.Username != x509cr.Subject.CommonName {
		return false