const PluginName … // Register registers the plugin func Register(plugins *admission.Plugins) { … } type Plugin … // ValidateInitialization always returns nil. func (p *Plugin) ValidateInitialization() error { … } var _ … // NewPlugin constructs a new instance of the CertificateSubjectRestrictions admission interface. func NewPlugin() *Plugin { … } var csrGroupResource … // Validate ensures that if the signerName on a CSR is set to // `kubernetes.io/kube-apiserver-client`, that its organization (group) // attribute is not set to `system:masters`. func (p *Plugin) Validate(_ context.Context, a admission.Attributes, _ admission.ObjectInterfaces) error { … }