This detection rule monitors Google Cloud Platform (GCP) audit logs for creation or approval of Kubernetes CertificateSigningRequests (CSRs) in GKE by non-system identities. It serves as a breadth-baseline for human or custom automation CSR activity on GKE. Attackers with cluster access can submit and approve CSRs to obtain long-lived client certificates that may survive token revocation and RBAC changes, enabling persistence and potential privilege escalation. The rule focuses on CSR creation and approval events and is designed to be complemented by companion rules that evaluate signer choice, requested identity (Common Name), and self-approval behavior. It relies on GCP audit data (gcp.audit) and the k8s.io CSR API surface to surface risky activity before broader access is gained. The detection aligns with MITRE ATT&CK techniques for Account Manipulation (T1098, including subtechnique Additional Container Cluster Roles T1098.006) and Privilege Escalation (TA0003/TA0004).