},
	}

	testRecognizer(t, badCases, isNodeClientCert, false)
	testRecognizer(t, badCases, isSelfNodeClientCert, false)

	// cn different then requestor
	differentCN := []func(b *csrBuilder){
		func(b *csrBuilder) {
			b.requestor = "joe"
		},
		func(b *csrBuilder) {
			b.cn = "system:node:bar"
		},
	}

	testRecognizer(t, differentCN, isNodeClientCert, true)

)

type A struct{}

func (A) GetObjectKind() schema.ObjectKind { return schema.EmptyObjectKind }
func (a A) DeepCopyObject() runtime.Object {
	return a
}

func TestRecognizer(t *testing.T) {
	s := runtime.NewScheme()
	s.AddKnownTypes(schema.GroupVersion{Version: "v1"}, &A{})
	d := recognizer.NewDecoder(
		json.NewSerializer(json.DefaultMetaFactory, s, s, false),

func (d *testBufferedMarshalable) Size() int {
	return len(d.data)
}

func (d *testBufferedMarshalable) DeepCopyObject() runtime.Object {
	panic("testBufferedMarshalable does not support DeepCopy")
}

func TestRecognize(t *testing.T) {
	s := protobuf.NewSerializer(nil, nil)
	ignores := [][]byte{
		nil,
		{},
		[]byte("k8s"),
		{0x6b, 0x38, 0x73, 0x01},
	}
	for i, data := range ignores {