anchor.diff:  [id="dr-scenario-3-recovering-expired-certs_{context}"]
   = Recovering from expired control plane certificates
   
  -As of {product-title} 4.4.8, the cluster can automatically recover from expired control plane certificates. You no longer need to perform the manual steps that were required in previous versions.
  +The cluster can automatically recover from expired control plane certificates.
   
  -The exception is that you must manually approve the pending `node-bootstrapper` certificate signing requests (CSRs) to recover kubelet certificates.
  +However, you must manually approve the pending `node-bootstrapper` certificate signing requests (CSRs) to recover kubelet certificates. For user-provisioned installations, you might also need to approve pending kubelet serving CSRs.
   
  -Use the following steps to approve the pending `node-bootstrapper` CSRs.
  +Use the following steps to approve the pending CSRs:
   
   .Procedure
   
  
positive.code: ----
  $ oc adm certificate approve <csr_name>
  ----
  
negative.code: ----
  $ oc get csr
  ----
  +
  .Example output
  ----
  NAME        AGE    SIGNERNAME                                    REQUESTOR                                                                   CONDITION
  csr-2s94x   8m3s   kubernetes.io/kubelet-serving                 system:node:<node_name>                                                     Pending <1>
  csr-4bd6t   8m3s   kubernetes.io/kubelet-serving                 system:node:<node_name>                                                     Pending <1>
  csr-4hl85   13m    kubernetes.io/kube-apiserver-client-kubelet   system:serviceaccount:openshift-machine-config-operator:node-bootstrapper   Pending <2>
  csr-zhhhp   3m8s   kubernetes.io/kube-apiserver-client-kubelet   system:serviceaccount:openshift-machine-config-operator:node-bootstrapper   Pending <2>
  ...
  ----
  <1> A pending kubelet service CSR (for user-provisioned installations).
  <2> A pending `node-bootstrapper` CSR.
  
  . Review the details of a CSR to verify that it is valid:
  +
  