Detects creation of a GKE CertificateSigningRequest (CSR) that requests the kubernetes.io/kube-apiserver-client signer. This signer issues API client certificates with broad subject restrictions, enabling persistence and potential privilege escalation for privileged identities (e.g., system:kube-controller-manager). The rule fires on GCP audit logs when io.k8s.certificates.v1.certificatesigningrequests.create occurs with signerName set to kubernetes.io/kube-apiserver-client, excluding known legitimate service accounts. For triage, identify the actor (client.user.email), source IP, and user_agent.original; decode gcp.audit.request.spec.request to inspect the CSR subject, key type/size, and extensions. Investigate whether the actor is authorized for API client certs, correlate with CSR approvals, and review related RBAC for certificatesigningrequests create/approval. Consider legitimate PKI workflows that may trigger false positives. Remediation guidance includes denying or deleting suspicious CSRs, rotating cluster signing trust if abused, and removing excessive CSR RBAC from untrusted identities. The rule aligns with MITRE ATT&CK techniques T1098 (Account Manipulation) and T1098.006 (Additional Container Cluster Roles) under Persistence and Privilege Escalation.