code: func (s *Server) evaluateAndSignNodeCert(ctx context.Context, node *api.Node) error {
  	// If the desired membership and actual state are in sync, there's
  	// nothing to do.
  	certState := node.Certificate.Status.State
  	if node.Spec.Membership == api.NodeMembershipAccepted &&
  		(certState == api.IssuanceStateIssued || certState == api.IssuanceStateRotate) {
  		return nil
  	}
  
  	// If the certificate state is renew, then it is a server-sided accepted cert (cert renewals)
  	if certState == api.IssuanceStateRenew {
  		return s.signNodeCert(ctx, node)
  	}
  
  	// Sign this certificate if a user explicitly changed it to Accepted, and
  	// the certificate is in pending state
  	if node.Spec.Membership == api.NodeMembershipAccepted && certState == api.IssuanceStatePending {
  		return s.signNodeCert(ctx, node)
  	}
  
  	return nil
  }
docs: // evaluateAndSignNodeCert implements the logic of which certificates to sign