kubernetes/test/integration/certificates/admission_approval_test.go

// Verifies that the CSR approval admission plugin correctly enforces that a
// user has permission to approve CSRs for the named signer
func TestCSRSignerNameApprovalPlugin(t *testing.T) { … }

func grantUserPermissionToApproveFor(t *testing.T, client clientset.Interface, username string, signerNames ...string) { … }

func buildApprovalClusterRoleForSigners(name string, signerNames ...string) *rbacv1.ClusterRole { … }

func buildClusterRoleBindingForUser(name, username, clusterRoleName string) *rbacv1.ClusterRoleBinding { … }