* Updates to documentation do not require explicit approval from the Technical Oversight Committee (TOC). This can be
  held off after the release. Hiding/Showing documentation does not require TOC approval.
* Cases for other API changes require TOC approval
    * Simple `meshConfig` changes have been approved in the past. Functionality should not be enabled by default.

	// Ignore all calls to anything other than 'certificatesigningrequests/approval'.
	// Ignore all operations other than UPDATE.
	if a.GetSubresource() != "approval" ||
		a.GetResource().GroupResource() != csrGroupResource {
		return nil
	}

	// We check permissions against the *old* version of the resource, in case
	// a user is attempting to update the SignerName when calling the approval
	// endpoint (which is an invalid/not allowed operation)

				subresource: "approval",
				oldObj:      &certificatesapi.CertificateSigningRequestList{},
				operation:   admission.Update,
			},
			allowed: false,
		},
		"reject requests if looking up permissions fails": {
			attributes: &testAttributes{
				resource:    certificatesapi.Resource("certificatesigningrequests"),
				subresource: "approval",

		},
		{
			name:              "invalid annotation",
			group:             "sigs.k8s.io",
			annotationValue:   "bad value",

# See the OWNERS docs at https://go.k8s.io/owners

# approval on api packages bubbles to api-approvers
reviewers:
  - sig-auth-authenticators-approvers
  - sig-auth-authenticators-reviewers
labels:

        "get",
        "list",
        "patch",
        "update",
        "watch"
      ]
    },
    {
      "kind": "CertificateSigningRequest",
      "name": "certificatesigningrequests/approval",
      "namespaced": false,
      "singularName": "",
      "verbs": [
        "get",
        "patch",
        "update"
      ]
    },
    {
      "kind": "CertificateSigningRequest",

		return false
	}

}

// APIApprovalState covers the various options for API approval annotation states
type APIApprovalState int

const (
	// APIApprovalInvalid means the annotation doesn't have an expected value
	APIApprovalInvalid APIApprovalState = iota
	// APIApproved if the annotation has a URL (this means the API is approved)
	APIApproved

options:
  # make root approval non-recursive
  no_parent_owners: true
reviewers:
  - bentheelder
  - cblecker
  - cpanato # SIG Technical Lead / RelEng subproject owner / Release Manager
  - dims
  - jeremyrickard # SIG Technical Lead / RelEng subproject owner
  #- justaugustus # SIG Chair / RelEng subproject owner / Release Manager - approvals only
  - liggitt
  - palnabarun # Release Manager

# See the OWNERS docs at https://go.k8s.io/owners

# approval on api packages bubbles to api-approvers
reviewers:
  - sig-auth-certificates-approvers
  - sig-auth-certificates-reviewers
labels:

# See the OWNERS docs at https://go.k8s.io/owners

options:
  # make root approval non-recursive
  no_parent_owners: true
reviewers:
  - dchen1107
  - dims
  - liggitt
  - smarterclayton
  - thockin
  - wojtek-t
approvers:
  - dchen1107
  - dims
  - liggitt
  - smarterclayton
  - thockin
  - wojtek-t
emeritus_approvers:
  - brendandburns