handler func(context.Context, *certificates.CertificateSigningRequest) error

	queue workqueue.TypedRateLimitingInterface[string]
}

func NewCertificateController(
	ctx context.Context,
	name string,
	kubeClient clientset.Interface,
	csrInformer certificatesinformers.CertificateSigningRequestInformer,
	handler func(context.Context, *certificates.CertificateSigningRequest) error,
) *CertificateController {

	signerName string,
	usages []cert.KeyUsage,
	requestedLifetime time.Duration,
) (*cert.CertificateSigningRequest, error) {
	log.Debugf("create CSR for signer %v", signerName)
	csr := &cert.CertificateSigningRequest{
		// Username, UID, Groups will be injected by API server.
		TypeMeta: metav1.TypeMeta{Kind: "CertificateSigningRequest"},
		ObjectMeta: metav1.ObjectMeta{
			GenerateName: "csr-workload-",
		},

	CronJobController                            = "cronjob-controller"
	CertificateSigningRequestSigningController   = "certificatesigningrequest-signing-controller"
	CertificateSigningRequestApprovingController = "certificatesigningrequest-approving-controller"
	CertificateSigningRequestCleanerController   = "certificatesigningrequest-cleaner-controller"
	TTLController                                = "ttl-controller"

type Signer struct {
	csrs    kclient.Client[*certv1.CertificateSigningRequest]
	signers map[string]*signer.Signer
	queue   controllers.Queue
}

func NewSigner(cl kube.Client, signers map[string]*signer.Signer) *Signer {
	c := &Signer{
		csrs:    kclient.New[*certv1.CertificateSigningRequest](cl),
		signers: signers,
	}
	c.queue = controllers.NewQueue("csr",

	_, ctx := ktesting.NewTestContext(t)
	csr := &certificates.CertificateSigningRequest{
		ObjectMeta: metav1.ObjectMeta{
			Name: "test-csr",
		},
	}

	client := fake.NewSimpleClientset(csr)
	informerFactory := informers.NewSharedInformerFactory(fake.NewSimpleClientset(csr), controller.NoResyncPeriodFunc())
	handler := func(ctx context.Context, csr *certificates.CertificateSigningRequest) error {

			if !success {
				return // ignore failures
			}

			if dryrun.IsDryRun(options.DryRun) {
				return // ignore things that would not get persisted
			}

			oldCSR, ok := old.(*certificates.CertificateSigningRequest)
			if !ok {
				return
			}

			// if the old CSR already has a certificate, do not double count it
			if len(oldCSR.Status.Certificate) > 0 {
				return
			}

		return gvk.AuthorizationPolicy, true
	case *apiistioioapisecurityv1beta1.AuthorizationPolicy:
		return gvk.AuthorizationPolicy, true
	case *k8sioapicertificatesv1.CertificateSigningRequest:
		return gvk.CertificateSigningRequest, true
	case *k8sioapicorev1.ConfigMap:
		return gvk.ConfigMap, true
	case *k8sioapiextensionsapiserverpkgapisapiextensionsv1.CustomResourceDefinition:
		return gvk.CustomResourceDefinition, true

}

// Adds the list of known types to the given scheme.
func addKnownTypes(scheme *runtime.Scheme) error {
	scheme.AddKnownTypes(SchemeGroupVersion,
		&CertificateSigningRequest{},
		&CertificateSigningRequestList{},
		&ClusterTrustBundle{},
		&ClusterTrustBundleList{},
	)
	return nil

// It is controlled by "k8s:prerelease-lifecycle-gen:introduced" tags in types.go.
func (in *CertificateSigningRequest) APILifecycleIntroduced() (major, minor int) {
	return 1, 19
}

// Package-wide variables from generator "generated".
option go_package = "k8s.io/api/certificates/v1beta1";

// Describes a certificate signing request
message CertificateSigningRequest {
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // spec contains the certificate request, and is immutable after creation.