}

func isSelfNodeClientCert(csr *capi.CertificateSigningRequest, x509cr *x509.CertificateRequest) bool {
	if csr.Spec.Username != x509cr.Subject.CommonName {
		return false
	}
	return isNodeClientCert(csr, x509cr)
}

func usagesToSet(usages []capi.KeyUsage) sets.String {
	result := sets.NewString()
	for _, usage := range usages {
		result.Insert(string(usage))
	}

     * {@inheritDoc}
     *
     * This method inherited from the internal interface should only be used by external code, such as plugins or build scripts,
     * as it may trigger warnings on usages that are considered "invalid" in the third-party code. If the usages
     * are still valid in the Gradle codebase, they should be changed to {@link TaskDependencyInternal#getDependenciesForInternalUse(Task)}.
     *

## Status

ACCEPTED

## Consequences

* The configuration cache serialization infrastructure should be used for all serialization.
* Existing usages of Serializer outside of this infrastructure should be migrated to use it.
* Existing usages of Java serialization should be migrated to use it.
* It is ok for Serializer to be used as a replacement for Java serialization as a migration step.

    /**
     * Ensures no new usages of resolvable + dependency scope Configurations are added and ensures usages of "maybe" methods are avoided.
     */
    @ArchTest
    public static final ArchRule maybe_create_and_resolvable_dependency_scope_factory_methods_are_avoided = freeze(

        "fieldsV1": {},
        "subresource": "subresourceValue"
      }
    ]
  },
  "spec": {
    "request": "AQ==",
    "signerName": "signerNameValue",
    "expirationSeconds": 8,
    "usages": [
      "usagesValue"
    ],
    "username": "usernameValue",
    "uid": "uidValue",
    "groups": [
      "groupsValue"
    ],
    "extra": {
      "extraKey": [
        "extraValue"
      ]

    of what was installed.
    However, it was a common source of confusion (as users would change it and nothing would happen), and did not reliably represent the current state.
    As there is no `IstioOperator` needed for these usages anymore, `istioctl install` and `helm install` no longer install the `IstioOperator` CRD.

  uid: uidValue
spec:
  expirationSeconds: 8
  extra:
    extraKey:
    - extraValue
  groups:
  - groupsValue
  request: AQ==
  signerName: signerNameValue
  uid: uidValue
  usages:
  - usagesValue
  username: usernameValue
status:
  certificate: Ag==
  conditions:
  - lastTransitionTime: "2005-01-01T01:01:01Z"
    lastUpdateTime: "2004-01-01T01:01:01Z"
    message: messageValue

        "fieldsV1": {},
        "subresource": "subresourceValue"
      }
    ]
  },
  "spec": {
    "request": "AQ==",
    "signerName": "signerNameValue",
    "expirationSeconds": 8,
    "usages": [
      "usagesValue"
    ],
    "username": "usernameValue",
    "uid": "uidValue",
    "groups": [
      "groupsValue"
    ],
    "extra": {
      "extraKey": [
        "extraValue"
      ]

  uid: uidValue
spec:
  expirationSeconds: 8
  extra:
    extraKey:
    - extraValue
  groups:
  - groupsValue
  request: AQ==
  signerName: signerNameValue
  uid: uidValue
  usages:
  - usagesValue
  username: usernameValue
status:
  certificate: Ag==
  conditions:
  - lastTransitionTime: "2005-01-01T01:01:01Z"
    lastUpdateTime: "2004-01-01T01:01:01Z"
    message: messageValue

  uid: uidValue
spec:
  expirationSeconds: 8
  extra:
    extraKey:
    - extraValue
  groups:
  - groupsValue
  request: AQ==
  signerName: signerNameValue
  uid: uidValue
  usages:
  - usagesValue
  username: usernameValue
status:
  certificate: Ag==
  conditions:
  - lastTransitionTime: "2005-01-01T01:01:01Z"
    lastUpdateTime: "2004-01-01T01:01:01Z"
    message: messageValue