anchor.diff:  ----
   $ oc adm certificate approve <csr_name>
   ----
  +
  +. For user-provisioned installations, approve each valid kubelet serving CSR:
  ++
  +[source,terminal]
  +----
  +$ oc adm certificate approve <csr_name>
  +----
  
positive.code: ----
  $ oc get csr
  ----
  
  . Review the details of a CSR to verify that it is valid:
  +
  
negative.code: [id="dr-scenario-3-recovering-expired-certs_{context}"]
  = Recovering from expired control plane certificates
  
  The cluster can automatically recover from expired control plane certificates.
  
  However, you must manually approve the pending `node-bootstrapper` certificate signing requests (CSRs) to recover kubelet certificates. For user-provisioned installations, you might also need to approve pending kubelet serving CSRs.
  
  Use the following steps to approve the pending CSRs:
  
  .Procedure
  
  