The HCP CSR flow allows any CN in the incoming CSR.

    4.16.0

    Using the CSR flow, any name you add to the CN in the CSR will be your username against the Kubernetes API server - check your username using the SelfSubjectRequest API (kubectl auth whoami)

    1.create CSR with CN=whatever
    2.CSR signed, create kubeconfig
    3.using kubeconfig, kubectl auth whoami should show whatever CN
    

    any CN in CSR is the username against the cluster

    we should only allow CNs with some known prefix (system:customer-break-glass:...)