code: func RequestCertificate(client certificatesclient.CertificateSigningRequestInterface, csrData []byte, name string, usages []certificates.KeyUsage, privateKey interface{}) (req *certificates.CertificateSigningRequest, err error) {
  	csr := &certificates.CertificateSigningRequest{
  		// Username, UID, Groups will be injected by API server.
  		TypeMeta: metav1.TypeMeta{Kind: "CertificateSigningRequest"},
  		ObjectMeta: metav1.ObjectMeta{
  			Name: name,
  		},
  		Spec: certificates.CertificateSigningRequestSpec{
  			Request: csrData,
  			Usages:  usages,
  		},
  	}
  	if len(csr.Name) == 0 {
  		csr.GenerateName = "csr-"
  	}
  
  	req, err = client.Create(csr)
  	switch {
  	case err == nil:
  	case errors.IsAlreadyExists(err) && len(name) > 0:
  		klog.Infof("csr for this node already exists, reusing")
  		req, err = client.Get(name, metav1.GetOptions{})
  		if err != nil {
  			return nil, formatError("cannot retrieve certificate signing request: %v", err)
  		}
  		if err := ensureCompatible(req, csr, privateKey); err != nil {
  			return nil, fmt.Errorf("retrieved csr is not compatible: %v", err)
  		}
  		klog.Infof("csr for this node is still valid")
  	default:
  		return nil, formatError("cannot create certificate signing request: %v", err)
  	}
  	return req, nil
  }
docs: // RequestCertificate will either use an existing (if this process has run
  // before but not to completion) or create a certificate signing request using the
  // PEM encoded CSR and send it to API server, then it will watch the object's
  // status, once approved by API server, it will return the API server's issued
  // certificate (pem-encoded). If there is any errors, or the watch timeouts, it
  // will return an error.