WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package rest

import (
	certificatesapiv1 "k8s.io/api/certificates/v1"
	certificatesapiv1alpha1 "k8s.io/api/certificates/v1alpha1"
	"k8s.io/apiserver/pkg/registry/generic"
	"k8s.io/apiserver/pkg/registry/rest"
	genericapiserver "k8s.io/apiserver/pkg/server"

	authorizationapiv1 "k8s.io/api/authorization/v1"
	autoscalingapiv1 "k8s.io/api/autoscaling/v1"
	autoscalingapiv2 "k8s.io/api/autoscaling/v2"
	batchapiv1 "k8s.io/api/batch/v1"
	certificatesapiv1 "k8s.io/api/certificates/v1"
	certificatesv1alpha1 "k8s.io/api/certificates/v1alpha1"
	coordinationapiv1 "k8s.io/api/coordination/v1"
	apiv1 "k8s.io/api/core/v1"
	discoveryv1 "k8s.io/api/discovery/v1"

			attributes: &testAttributes{
				resource:    certificatesapi.Resource("certificatesigningrequests"),
				subresource: "status",
				oldObj: &certificatesapi.CertificateSigningRequest{Spec: certificatesapi.CertificateSigningRequestSpec{
					SignerName: "abc.com/xyz",
				}},
				obj: &certificatesapi.CertificateSigningRequest{
					Spec: certificatesapi.CertificateSigningRequestSpec{
						SignerName: "abc.com/xyz",
					},

			attributes: &testAttributes{
				resource:    certificatesapi.Resource("certificatesigningrequests"),
				subresource: "approval",
				oldObj: &certificatesapi.CertificateSigningRequest{Spec: certificatesapi.CertificateSigningRequestSpec{
					SignerName: "notallowed.com/xyz",
				}},
				obj: &certificatesapi.CertificateSigningRequest{Spec: certificatesapi.CertificateSigningRequestSpec{
					SignerName: "allowed.com/xyz",

			allowedName:                      "abc.com/xyz",
			attributes: &testAttributes{
				resource: certificatesapi.Resource("clustertrustbundles"),
				oldObj: &certificatesapi.ClusterTrustBundle{
					Spec: certificatesapi.ClusterTrustBundleSpec{},
				},
				obj: &certificatesapi.ClusterTrustBundle{
					Spec: certificatesapi.ClusterTrustBundleSpec{},
				},
				operation: admission.Update,
			},
			allowed: true,
		},

			[]certificatesapi.CertificateSigningRequestCondition{
				{
					Type: certificatesapi.CertificateApproved,
				},
				{
					Type: certificatesapi.CertificateDenied,
				},
			},
			false,
		},
	}

	for _, tc := range testCases {
		csr := &certificatesapi.CertificateSigningRequest{
			ObjectMeta: v1.ObjectMeta{
				Name: "fake-csr",
			},
			Status: certificatesapi.CertificateSigningRequestStatus{

		},
		{
			name: "ignored subresource",
			a: &testAttributes{
				resource:    certificatesapi.Resource("certificatesigningrequests"),
				subresource: "approve",
			},
			wantErr: "",
		},
		{
			name: "wrong type",
			a: &testAttributes{
				resource: certificatesapi.Resource("certificatesigningrequests"),
				obj:      &certificatesapi.CertificateSigningRequestList{},
				name:     "panda",
			},

		return nil
	}

	csr, ok := a.GetObject().(*certificatesapi.CertificateSigningRequest)
	if !ok {
		return admission.NewForbidden(a, fmt.Errorf("expected type CertificateSigningRequest, got: %T", a.GetObject()))
	}

	if csr.Spec.SignerName != certificatesv1beta1.KubeAPIServerClientSignerName {
		return nil
	}

	csrParsed, err := certificatesapi.ParseCSR(csr.Spec.Request)
	if err != nil {