kubernetes/test/integration/certificates/admission_sign_test.go

// Verifies that the CSR approval admission plugin correctly enforces that a
// user has permission to sign CSRs for the named signer
func TestCSRSignerNameSigningPlugin(t *testing.T) { … }

func grantUserPermissionToSignFor(t *testing.T, client clientset.Interface, username string, signerNames ...string) { … }

func buildSigningClusterRoleForSigners(name string, signerNames ...string) *rbacv1.ClusterRole { … }