code: func (csrStrategy) PrepareForCreate(ctx context.Context, obj runtime.Object) {
  	csr := obj.(*certificates.CertificateSigningRequest)
  
  	// Clear any user-specified info
  	csr.Spec.Username = ""
  	csr.Spec.UID = ""
  	csr.Spec.Groups = nil
  	csr.Spec.Extra = nil
  	// Inject user.Info from request context
  	if user, ok := genericapirequest.UserFrom(ctx); ok {
  		csr.Spec.Username = user.GetName()
  		csr.Spec.UID = user.GetUID()
  		csr.Spec.Groups = user.GetGroups()
  		if extra := user.GetExtra(); len(extra) > 0 {
  			csr.Spec.Extra = map[string]certificates.ExtraValue{}
  			for k, v := range extra {
  				csr.Spec.Extra[k] = certificates.ExtraValue(v)
  			}
  		}
  	}
  
  	// Be explicit that users cannot create pre-approved certificate requests.
  	csr.Status = certificates.CertificateSigningRequestStatus{}
  	csr.Status.Conditions = []certificates.CertificateSigningRequestCondition{}
  }
docs: // PrepareForCreate clears fields that are not allowed to be set by end users
  // on creation.