code: func (cc *CertificateController) syncFunc(key string) error {
  	startTime := time.Now()
  	defer func() {
  		klog.V(4).Infof("Finished syncing certificate request %q (%v)", key, time.Since(startTime))
  	}()
  	csr, err := cc.csrLister.Get(key)
  	if errors.IsNotFound(err) {
  		klog.V(3).Infof("csr has been deleted: %v", key)
  		return nil
  	}
  	if err != nil {
  		return err
  	}
  
  	if csr.Status.Certificate != nil {
  		// no need to do anything because it already has a cert
  		return nil
  	}
  
  	// need to operate on a copy so we don't mutate the csr in the shared cache
  	csr = csr.DeepCopy()
  
  	return cc.handler(csr)
  }
docs: // maybeSignCertificate will inspect the certificate request and, if it has
  // been approved and meets policy expectations, generate an X509 cert using the
  // cluster CA assets. If successful it will update the CSR approve subresource
  // with the signed certificate.