return certificatesv1beta1.KubeAPIServerClientKubeletSignerName
	case IsKubeletServingCSR(csr, obj.Usages):
		return certificatesv1beta1.KubeletServingSignerName
	default:
		return certificatesv1beta1.LegacyUnknownSignerName
	}
}

func IsKubeletServingCSR(req *x509.CertificateRequest, usages []certificatesv1beta1.KeyUsage) bool {
	return certificates.IsKubeletServingCSR(req, usagesToSet(usages))
}

		string(UsageKeyEncipherment),
		string(UsageServerAuth),
	)
	kubeletServingRequiredUsagesNoRSA = sets.NewString(
		string(UsageDigitalSignature),
		string(UsageServerAuth),
	)
)

func IsKubeletServingCSR(req *x509.CertificateRequest, usages sets.String) bool {
	return ValidateKubeletServingCSR(req, usages) == nil
}
func ValidateKubeletServingCSR(req *x509.CertificateRequest, usages sets.String) error {

			usages: kubeletServerUsages,
			exp:    false,
		},
	}
	for name, test := range tests {
		t.Run(name, func(t *testing.T) {
			got := IsKubeletServingCSR(test.req, test.usages)
			if test.exp != got {
				t.Errorf("unexpected IsKubeletClientCSR output: exp=%v, got=%v", test.exp, got)
			}
		})
	}
}

func TestIsKubeletClientCSR(t *testing.T) {