code: func isIssuedExpired(csr *capi.CertificateSigningRequest) (bool, error) {
  	isExpired, err := isExpired(csr)
  	if err != nil {
  		return false, err
  	}
  	for _, c := range csr.Status.Conditions {
  		if c.Type == capi.CertificateApproved && isIssued(csr) && isExpired {
  			klog.Infof("Cleaning CSR %q as the associated certificate is expired.", csr.Name)
  			return true, nil
  		}
  	}
  	return false, nil
  }
docs: // isIssuedExpired checks if the CSR has been issued a certificate and if the
  // expiration of the certificate (the NotAfter value) has passed.