Laura Kassovic <******@****.***> 1701107622 -0800

		},
		{
			name:          "invalid: partially incorrect usages",
			token:         "abcdef.1234567890123456",
			usages:        []string{"foo", "authentication"},
			extraGroups:   []string{"system:bootstrappers:foo"},
			expectedError: true,
		},
		{
			name:          "invalid: all incorrect usages",
			token:         "abcdef.1234567890123456",
			usages:        []string{"foo", "bar"},

			usages: kubeletClientUsages,
			exp:    false,
		},
		"does not default to kube-apiserver-client-kubelet if CN does not have 'system:node:' prefix": {
			req:    newCSR(kubeletClientPEMOptions, pemOptions{cn: "not-prefixed"}),
			usages: kubeletClientUsages,
			exp:    false,
		},
		"does not default to kube-apiserver-client-kubelet if it has an unexpected usage": {
			req:    newCSR(kubeletClientPEMOptions),

}

func IsKubeletClientCSR(req *x509.CertificateRequest, usages []certificatesv1beta1.KeyUsage) bool {
	return certificates.IsKubeletClientCSR(req, usagesToSet(usages))
}

func usagesToSet(usages []certificatesv1beta1.KeyUsage) sets.String {
	result := sets.NewString()
	for _, usage := range usages {
		result.Insert(string(usage))
	}
	return result

		string(UsageDigitalSignature),
		string(UsageServerAuth),
	)
)

func IsKubeletServingCSR(req *x509.CertificateRequest, usages sets.String) bool {
	return ValidateKubeletServingCSR(req, usages) == nil
}
func ValidateKubeletServingCSR(req *x509.CertificateRequest, usages sets.String) error {
	if !reflect.DeepEqual([]string{"system:nodes"}, req.Subject.Organization) {
		return organizationNotSystemNodesErr
	}

	testcases := []struct {
		usages              []capi.KeyUsage
		expectedKeyUsage    x509.KeyUsage
		expectedExtKeyUsage []x509.ExtKeyUsage
		expectErr           bool
	}{
		{
			usages:              []capi.KeyUsage{"signing"},
			expectedKeyUsage:    x509.KeyUsageDigitalSignature,
			expectedExtKeyUsage: nil,
			expectErr:           false,
		},
		{
			usages:              []capi.KeyUsage{"client auth"},

            }
            Integer depth = usages.get(Thread.currentThread());
            if (depth == null) {
                usages.put(Thread.currentThread(), 1);
            } else {
                usages.put(Thread.currentThread(), depth + 1);
            }
        } finally {
            lock.unlock();
        }

        try {

            comp.usages.add(new TestUsage(
                    name: 'api',
                    usage: objects.named(Usage, 'api'),
                    dependencies: configurations.implementation.allDependencies,
                    attributes: testAttributes))

            comp.usages.add(new TestUsage(
                    name: 'impl',
                    usage: objects.named(Usage, 'api'),

			usages = append(usages, "client")
			continue
		}
		if curr == x509.ExtKeyUsageServerAuth {
			usages = append(usages, "serving")
			continue
		}

		usages = append(usages, fmt.Sprintf("%d", curr))
	}

	validServingNames := []string{}
	for _, ip := range certificate.IPAddresses {
		validServingNames = append(validServingNames, ip.String())
	}

	}
	return nil
}

func usagesToSet(usages []capi.KeyUsage) sets.String {
	result := sets.NewString()
	for _, usage := range usages {
		result.Insert(string(usage))
	}
	return result