Detects creation of a GKE CertificateSigningRequest (CSR) where the requested Common Name (CN) targets highly privileged Kubernetes identities (system:masters, system:kube-controller-manager, system:admin). The rule reads the CSR from gcp.audit.request.spec.request in GCP audit logs, base64-decodes it to PEM and DER, and flags requests whose DER contains any of the privileged CNs. It is scoped to identities with cluster-admin-equivalent or control-plane impersonation values. Alerts include Esql.csr_pem and Esql.csr_der for immediate visibility. This telemetry helps detect potential persistence or privilege escalation via client certificates, even from legitimate kubelet signers. Requirements: GCP Fleet integration with GKE audit logs enabled. Investigate actor, signer, approvals, related RBAC and secret access, and look for self-approval or simultaneous CSR activity. False positives are rare; exclude documented custom PKI workflows. Remediation: deny/delete the CSR, revoke issued credentials, tighten CSR create/approval RBAC. Risk score: 73; severity: high.