Thanks for the feedback. You’r right, certificates.k8s.io/v1beta1 is deprecated started from 1.22. I’ll update the article accordingly.

Could you provide additional details regarding the separate signin step ? Seems like the using a SignerName still sign the certificate while approving the CSR.