code: func requestNodeCertificate(client certificatesv1beta1.CertificateSigningRequestInterface, privateKeyData []byte, nodeName types.NodeName) (certData []byte, err error) {
  	subject := &pkix.Name{
  		Organization: []string{"system:nodes"},
  		CommonName:   "system:node:" + string(nodeName),
  	}
  
  	privateKey, err := keyutil.ParsePrivateKeyPEM(privateKeyData)
  	if err != nil {
  		return nil, fmt.Errorf("invalid private key for certificate request: %v", err)
  	}
  	csrData, err := certutil.MakeCSR(privateKey, subject, nil, nil)
  	if err != nil {
  		return nil, fmt.Errorf("unable to generate certificate request: %v", err)
  	}
  
  	usages := []certificates.KeyUsage{
  		certificates.UsageDigitalSignature,
  		certificates.UsageKeyEncipherment,
  		certificates.UsageClientAuth,
  	}
  	name := digestedName(privateKeyData, subject, usages)
  	req, err := csr.RequestCertificate(client, csrData, name, usages, privateKey)
  	if err != nil {
  		return nil, err
  	}
  	return csr.WaitForCertificate(client, req, 3600*time.Second)
  }
docs: // requestNodeCertificate will create a certificate signing request for a node
  // (Organization and CommonName for the CSR will be set as expected for node
  // certificates) and send it to API server, then it will watch the object's
  // status, once approved by API server, it will return the API server's issued
  // certificate (pem-encoded). If there is any errors, or the watch timeouts, it
  // will return an error. This is intended for use on nodes (kubelet and
  // kubeadm).