public Pkcs10Csr generateRoleCsr(AthenzIdentity identity,
                                     AthenzRole role,
                                     VespaUniqueInstanceId instanceId,
                                     ClusterType clusterType,
                                     KeyPair keyPair) {
        X500Principal principal = new X500Principal(String.format("OU=%s, cn=%s:role.%s", providerService, role.domain().getName(), role.roleName()));
        var b = Pkcs10CsrBuilder.fromKeypair(principal, keyPair, SHA256_WITH_RSA)
                .addSubjectAlternativeName(DNS, getIdentitySAN(instanceId))
                .addSubjectAlternativeName(EMAIL, String.format("%s.%s@%s", identity.getDomainName(), identity.getName(), dnsSuffix))
                .addSubjectAlternativeName(URI, "spiffe://%s/ra/%s".formatted(role.domain().getName(), role.roleName()));
        if (clusterType != null) b.addSubjectAlternativeName(URI, clusterType.asCertificateSanUri().toString());
        return b.build();
    }
Generates a {@link Pkcs10Csr} for an instance.

@author bjorncs
vespa-athenz/src/main/java/com/yahoo/vespa/athenz/identityprovider/client/CsrGenerator.java