case <-watch1:
		keyCertBundle := watcher.GetKeyCertBundle()
		if !bytes.Equal(keyCertBundle.KeyPem, key) || !bytes.Equal(keyCertBundle.CertPem, cert) ||
			!bytes.Equal(keyCertBundle.CABundle, ca) {
			t.Errorf("got wrong keyCertBundle %v", keyCertBundle)
		}
	default:
		t.Errorf("watcher1 watched non keyCertBundle")
	}
	select {
	case <-watch2:
		keyCertBundle := watcher.GetKeyCertBundle()

}

// GetCABundle returns the CABundle.
func (w *Watcher) GetCABundle() []byte {
	w.mutex.RLock()
	defer w.mutex.RUnlock()
	return w.bundle.CABundle
}

// GetKeyCertBundle returns the bundle.
func (w *Watcher) GetKeyCertBundle() KeyCertBundle {
	w.mutex.RLock()
	defer w.mutex.RUnlock()
	return w.bundle