csr: capi.CertificateSigningRequestSpec{
				Request:    csrWithOpts(kubeletServerPEMOptions),
				Usages:     kubeletServerUsages,
				SignerName: strPtr("example.com/not-kubelet-serving"),
			},
			expectedSignerName: "example.com/not-kubelet-serving",
		},
		"defaults usages if not set": {
			csr: capi.CertificateSigningRequestSpec{
				Request:    csrWithOpts(kubeletServerPEMOptions),
				SignerName: strPtr("example.com/test"),