<p>i have this template i try to invoke: looking at the docs example <a href="https://kubernetes.io/docs/tasks/tls/managing-tls-in-a-cluster/" rel="nofollow noreferrer">here</a></p>
<pre><code>--- 
apiVersion: certificates.k8s.io/v1
kind: CertificateSigningRequest
metadata: 
  name: vault-csr
spec: 
  groups: 
    - system: authenticated
  request: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURSBSRVFVRVNULS0tLS0KTUlJRklEQ0NBd2dDQVFBd0lERWVNQndHQTFVRUF3d1ZkbUYxYkhRdWRtRjFiSFF0Y0dWeWMyOHVjM1pqTUlJQwpJakFOQmdrcWhraUc5dzBCQVFFRkFBT0NBZzhBTUlJQ0NnS0NBZ0VBdFJubkFQR2R4bG1xdjhMOW1Gc29YOXJuCk9JcTVGTnJMZmRDelZCVEVnUEV6TDgzSWFsT1cya2lrNWFRM282d2NSTmx1S3NzeUl1c0ZUSTFqR2djWjN0eXkKSDFqMlROMmNHMHp4MGVaYTJqK3JMVkkwSmVTdXFHNkdmY01rRzRudUhZSGJraDZUYmgyalc5S0RTUTVRekNzdwo0Rlg4bDZXVEVILzdSemgwNCt0RkdFamxVVktkakJYcnVqMnhBc0NqemJ2Sy9GaEhLRjJwRVpza1pSNWtCbC80Cm1KL2xHUTRUTysyVW5CbmsvalJJd3g5a0ZGWDhucEhGWxxxLS0K
  signerName: kubernetes.io/kubelet-serving
  usages:
  - digital signature
  - key encipherment
  - server auth
</code></pre>
<p>the version of kubectl:</p>
<pre><code>$ kubectl version --short
Client Version: v1.20.0
Server Version: v1.18.9-eks-d1db3c
</code></pre>
<p>And im working with AWS EKS
i keep getting :</p>
<pre><code>$ kubectl create -f csr.yaml
error: unable to recognize &quot;csr.yaml&quot;: no matches for kind &quot;CertificateSigningRequest&quot; in version &quot;certificates.k8s.io/v1&quot;
</code></pre>
<p><strong>UPDATE</strong>
after changing to apiVersion: certificates.k8s.io/v1beta1</p>
<pre><code>apiVersion: certificates.k8s.io/v1beta1
kind: CertificateSigningRequest
metadata: 
  name: vault-csr
spec: 
  groups: 
    - system: authenticated
  request: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURSB.....
  usages:
  - digital signature
  - key encipherment
  - server auth
</code></pre>
<p>Im getting now this error:</p>
<pre><code>$ kubectl create -f csr.yaml
error: error validating &quot;tmp/csr.yaml&quot;: error validating data: ValidationError(CertificateSigningRequest.spec.groups[0]): invalid type for io.k8s.api.certificates.v1beta1.CertificateSigningRequestSpec.groups: got &quot;map&quot;, expected &quot;string&quot;; if you choose to ignore these errors, turn validation off with --validate=false
</code></pre>

<p>As per the <a href="https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.19.md#api-change-5" rel="noreferrer">K8s change doc</a>, the <code>CertificateSigningRequest</code> API is promoted to <code>certificates.k8s.io/v1</code> only as part of the K8s <code>1.19</code> release.</p>
<p>It was under <code>certificates.k8s.io/v1beta1</code> before that.</p>
<p>I suspect that to be a problem as your server version is <code>v1.18</code>.</p>
<p>So, try changing your <code>apiVersion</code> as below:</p>
<p><code>apiVersion: certificates.k8s.io/v1beta1</code></p>
