signerName string,
	usages []cert.KeyUsage,
	requestedLifetime time.Duration,
) (*cert.CertificateSigningRequest, error) {
	log.Debugf("create CSR for signer %v", signerName)
	csr := &cert.CertificateSigningRequest{
		// Username, UID, Groups will be injected by API server.
		TypeMeta: metav1.TypeMeta{Kind: "CertificateSigningRequest"},
		ObjectMeta: metav1.ObjectMeta{
			GenerateName: "csr-workload-",
		},

	_, ctx := ktesting.NewTestContext(t)
	csr := &certificates.CertificateSigningRequest{
		ObjectMeta: metav1.ObjectMeta{
			Name: "test-csr",
		},
	}

	client := fake.NewSimpleClientset(csr)
	informerFactory := informers.NewSharedInformerFactory(fake.NewSimpleClientset(csr), controller.NoResyncPeriodFunc())
	handler := func(ctx context.Context, csr *certificates.CertificateSigningRequest) error {

}

// CertificateSigningRequestList is a collection of CertificateSigningRequest objects
message CertificateSigningRequestList {
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;

  // items is a collection of CertificateSigningRequest objects
  repeated CertificateSigningRequest items = 2;
}

// CertificateSigningRequestSpec contains the certificate request.

func (in *CertificateSigningRequest) DeepCopyInto(out *CertificateSigningRequest) {
	*out = *in
	out.TypeMeta = in.TypeMeta
	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
	in.Spec.DeepCopyInto(&out.Spec)
	in.Status.DeepCopyInto(&out.Status)
	return
}

// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CertificateSigningRequest.

// All generated defaulters are covering - they call all nested defaulters.
func RegisterDefaults(scheme *runtime.Scheme) error {
	scheme.AddTypeDefaultingFunc(&v1beta1.CertificateSigningRequest{}, func(obj interface{}) {
		SetObjectDefaults_CertificateSigningRequest(obj.(*v1beta1.CertificateSigningRequest))
	})
	scheme.AddTypeDefaultingFunc(&v1beta1.CertificateSigningRequestList{}, func(obj interface{}) {

	"uid":               "uid contains the uid of the user that created the CertificateSigningRequest. Populated by the API server on creation and immutable.",
	"groups":            "groups contains group membership of the user that created the CertificateSigningRequest. Populated by the API server on creation and immutable.",

// +genclient:method=UpdateApproval,verb=update,subresource=approval,input=k8s.io/api/certificates/v1.CertificateSigningRequest,result=k8s.io/api/certificates/v1.CertificateSigningRequest
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
// +k8s:prerelease-lifecycle-gen:introduced=1.19

// CertificateSigningRequest objects provide a mechanism to obtain x509 certificates

}

// CertificateSigningRequestList is a collection of CertificateSigningRequest objects
message CertificateSigningRequestList {
  // +optional
  optional .k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;

  // items is a collection of CertificateSigningRequest objects
  repeated CertificateSigningRequest items = 2;
}

// CertificateSigningRequestSpec contains the certificate request.

func (in *CertificateSigningRequest) APILifecycleReplacement() schema.GroupVersionKind {
	return schema.GroupVersionKind{Group: "certificates.k8s.io", Version: "v1", Kind: "CertificateSigningRequest"}
}

// APILifecycleRemoved is an autogenerated function, returning the release in which the API is no longer served as int versions of major and minor for comparison.

// CSR, the CSR statuses that are visible via `kubectl` will include 'Issued'.
func isIssued(csr *capi.CertificateSigningRequest) bool {
	return len(csr.Status.Certificate) > 0
}

// isExpired checks if the CSR has a certificate and the date in the `NotAfter`
// field has gone by.
func isExpired(csr *capi.CertificateSigningRequest) bool {
	if len(csr.Status.Certificate) == 0 {
		return false
	}