csr.json

{
  "apiVersion": "certificates.k8s.io/v1",
  "kind": "CertificateSigningRequest",
  "metadata": { "name": "test" },
  "spec": {
      "signerName": "example.com/signer",
      "usages": ["any"],
      "request": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURSBSRVFVRVNULS0tLS0KTUlJQnlqQ0NBVE1DQVFBd2dZa3hDekFKQmdOVkJBWVRBbFZUTVJNd0VRWURWUVFJRXdwRFlXeHBabTl5Ym1saApNUll3RkFZRFZRUUhFdzFOYjNWdWRHRnBiaUJXYVdWM01STXdFUVlEVlFRS0V3cEhiMjluYkdVZ1NXNWpNUjh3CkhRWURWUVFMRXhaSmJtWnZjbTFoZEdsdmJpQlVaV05vYm05c2IyZDVNUmN3RlFZRFZRUURFdzUzZDNjdVoyOXYKWjJ4bExtTnZiVENCbnpBTkJna3Foa2lHOXcwQkFRRUZBQU9CalFBd2dZa0NnWUVBcFp0WUpDSEo0VnBWWEhmVgpJbHN0UVRsTzRxQzAzaGpYK1prUHl2ZFlkMVE0K3FiQWVUd1htQ1VLWUhUaFZSZDVhWFNxbFB6eUlCd2llTVpyCldGbFJRZGRaMUl6WEFsVlJEV3dBbzYwS2VjcWVBWG5uVUsrNWZYb1RJL1VnV3NocmU4dEoreC9UTUhhUUtSL0oKY0lXUGhxYVFoc0p1elpidkFkR0E4MEJMeGRNQ0F3RUFBYUFBTUEwR0NTcUdTSWIzRFFFQkJRVUFBNEdCQUlobAo0UHZGcStlN2lwQVJnSTVaTStHWng2bXBDejQ0RFRvMEprd2ZSRGYrQnRyc2FDMHE2OGVUZjJYaFlPc3E0ZmtIClEwdUEwYVZvZzNmNWlKeENhM0hwNWd4YkpRNnpWNmtKMFRFc3VhYU9oRWtvOXNkcENvUE9uUkJtMmkvWFJEMkQKNmlOaDhmOHowU2hHc0ZxakRnRkh5RjNvK2xVeWorVUM2SDFRVzdibgotLS0tLUVORCBDRVJUSUZJQ0FURSBSRVFVRVNULS0tLS0="
  }
}

patch1.json

{
    "apiVersion":"certificates.k8s.io/v1",
    "kind":"CertificateSigningRequest",
    "status":{
        "conditions":[
            {
                "lastTransitionTime":"2024-02-16T15:04:31Z",
                "lastUpdateTime":"2024-02-16T15:04:31Z",
                "message":"Whatever.",
                "reason":"Blah",
                "status":"True",
                "type":"Failed"
            }
        ]
    }
}

patch2.json

{
    "apiVersion":"certificates.k8s.io/v1",
    "kind":"CertificateSigningRequest",
    "status":{
        "conditions":[
            {
                "lastTransitionTime":"2024-02-16T15:04:31Z",
                "lastUpdateTime":"2024-02-16T15:04:31Z",
                "message":"Whatever.",
                "reason":"Blah",
                "status":"True",
                "type":"Random"
            }
        ]
    }
}

usage

# make it easy to use curl
kubectl proxy &

# create
kubectl create -f csr.json 

# add a condition
curl -XPATCH 'http://localhost:8001/apis/certificates.k8s.io/v1/certificatesigningrequests/test/status?fieldManager=test' -H "Content-Type: application/apply-patch+yaml" --data  @patch1.json

# approve
kubectl certificate approve test

# add another condition
curl -XPATCH 'http://localhost:8001/apis/certificates.k8s.io/v1/certificatesigningrequests/test/status?fieldManager=test' -H "Content-Type: application/apply-patch+yaml" --data  @patch2.json