apiVersion: certificates.k8s.io/v1
kind: CertificateSigningRequest
metadata:
  name: <USER>
spec:
  request: <REQUEST>
  signerName: kubernetes.io/kube-apiserver-client
  # expirationSeconds: 86400  # one day
  usages:
  - client auth
