Detects self-approved CertificateSigningRequests (CSRs) in GKE/Kubernetes by correlating CSR creation and approval events from Google Cloud Audit Logs. The rule groups events by client.user.email and a normalized CSR name (Esql.csr_name, derived from gcp.audit.resource_name with the "/approval" suffix removed) and flags cases where a non-system user creates and then approves the same CSR within five minutes. This behavior is unusual because, in normal operations, CSR approvals are performed by cluster operators or automated controllers (e.g., system:gcp-controller-manager). A self-approval can yield a long-lived client certificate without operator involvement, enabling persistence or privilege escalation within the cluster. The rule filters out common false positives such as automated workflows that create and approve CSRs in one pass and known system accounts.