code: func (a *AuthWithRoles) ProcessKubeCSR(req KubeCSR) (*KubeCSRResponse, error) {
  	// limits the requests types to proxies to make it harder to break
  	if !a.hasBuiltinRole(string(teleport.RoleProxy)) {
  		return nil, trace.AccessDenied("this request can be only executed by a proxy")
  	}
  	return a.authServer.ProcessKubeCSR(req)
  }
docs: // ProcessKubeCSR processes CSR request against Kubernetes CA, returns
  // signed certificate if sucessful.