"watch"
      ]
    },
    {
      "kind": "CertificateSigningRequest",
      "name": "certificatesigningrequests/approval",
      "namespaced": false,
      "singularName": "",
      "verbs": [
        "get",
        "patch",
        "update"
      ]
    },
    {
      "kind": "CertificateSigningRequest",
      "name": "certificatesigningrequests/status",
      "namespaced": false,
      "singularName": "",

			attributes: &testAttributes{
				resource:    certificatesapi.Resource("certificatesigningrequests"),
				subresource: "status",
				oldObj: &certificatesapi.CertificateSigningRequest{Status: certificatesapi.CertificateSigningRequestStatus{
					Certificate: []byte("data"),
				}},
				obj: &certificatesapi.CertificateSigningRequest{Status: certificatesapi.CertificateSigningRequestStatus{
					Certificate: []byte("data"),
				}},

	}

	tests := []struct {
		name   string
		newCSR *capi.CertificateSigningRequest
		oldCSR *capi.CertificateSigningRequest
		errs   []string
	}{{
		name:   "no-op",
		newCSR: &capi.CertificateSigningRequest{ObjectMeta: validUpdateMeta, Spec: validSpec},
		oldCSR: &capi.CertificateSigningRequest{ObjectMeta: validUpdateMeta, Spec: validSpec},
	}, {
		name:   "finalizer change with invalid status",

			a: &testAttributes{
				resource: certificatesapi.Resource("certificatesigningrequests"),
				obj: &certificatesapi.CertificateSigningRequest{Spec: certificatesapi.CertificateSigningRequestSpec{
					Request:    []byte("this is not a CSR"),
					SignerName: certificatesv1beta1.KubeAPIServerClientSignerName,
				}},
				name: "bear",
			},

		name        string
		newObj      *certapi.CertificateSigningRequest
		oldObj      *certapi.CertificateSigningRequest
		expectedObj *certapi.CertificateSigningRequest
	}{
		{
			name:        "no-op",
			newObj:      &certapi.CertificateSigningRequest{},
			oldObj:      &certapi.CertificateSigningRequest{},
			expectedObj: &certapi.CertificateSigningRequest{},
		},
		{

		wantRequested, wantHonored bool
	}{
		{
			name:    "cert parse failure",
			success: true,
			obj: &certificates.CertificateSigningRequest{
				Status: certificates.CertificateSigningRequestStatus{
					Certificate: []byte("junk"),
				},
			},
			old: &certificates.CertificateSigningRequest{
				Spec: certificates.CertificateSigningRequestSpec{
					SignerName:        "fancy",
					ExpirationSeconds: ptr.To[int32](77),

	if err := s.AddGeneratedConversionFunc((*v1beta1.CertificateSigningRequest)(nil), (*certificates.CertificateSigningRequest)(nil), func(a, b interface{}, scope conversion.Scope) error {
		return Convert_v1beta1_CertificateSigningRequest_To_certificates_CertificateSigningRequest(a.(*v1beta1.CertificateSigningRequest), b.(*certificates.CertificateSigningRequest), scope)
	}); err != nil {
		return err
	}

}

func appendApprovalCondition(csr *capi.CertificateSigningRequest, message string) {
	csr.Status.Conditions = append(csr.Status.Conditions, capi.CertificateSigningRequestCondition{
		Type:    capi.CertificateApproved,
		Status:  corev1.ConditionTrue,
		Reason:  "AutoApproved",
		Message: message,
	})
}

func isNodeClientCert(csr *capi.CertificateSigningRequest, x509cr *x509.CertificateRequest) bool {

		return nil
	}

	oldCSR, ok := a.GetOldObject().(*api.CertificateSigningRequest)
	if !ok {
		return admission.NewForbidden(a, fmt.Errorf("expected type CertificateSigningRequest, got: %T", a.GetOldObject()))
	}
	csr, ok := a.GetObject().(*api.CertificateSigningRequest)
	if !ok {
		return admission.NewForbidden(a, fmt.Errorf("expected type CertificateSigningRequest, got: %T", a.GetObject()))
	}

func RegisterConversions(s *runtime.Scheme) error {
	if err := s.AddGeneratedConversionFunc((*v1.CertificateSigningRequest)(nil), (*certificates.CertificateSigningRequest)(nil), func(a, b interface{}, scope conversion.Scope) error {
		return Convert_v1_CertificateSigningRequest_To_certificates_CertificateSigningRequest(a.(*v1.CertificateSigningRequest), b.(*certificates.CertificateSigningRequest), scope)
	}); err != nil {
		return err
	}