if err != nil {
			return err
		}
		parentKey := resourceKey{
			Name:    r.Name,
			TypeURL: r.Resource.TypeUrl,
		}
		c.establishResource(parentKey)
		if ctx.nack != nil {
			rejects = append(rejects, ctx.nack)
			// On NACK, do not apply resource changes
			continue
		}

		remove, add := c.tree[parentKey].Children.Diff(ctx.sub)
		for _, key := range add {

	derBytes, err := CreateCertificate(rand.Reader, template, parent, &key.PublicKey, parentKey)
	if err != nil {
		return nil, err
	}

	caCert, err := ParseCertificate(derBytes)
	if err != nil {
		return nil, err
	}

	return caCert, nil
}

func makeConstraintsLeafCert(leaf leafSpec, key *ecdsa.PrivateKey, parent *Certificate, parentKey *ecdsa.PrivateKey) (*Certificate, error) {
	var serialBytes [16]byte

		instancesUpdated = append(instancesUpdated, instance...)
		parentKey := configKeyWithParent{
			configKey: key,
			parent:    namespacedName,
		}
		if event == model.EventDelete {
			s.serviceInstances.deleteServiceEntryInstances(namespacedName, key)
			s.serviceInstances.deleteInstanceKeys(parentKey, instancesUpdated)
		} else {
			s.serviceInstances.updateInstances(parentKey, instancesUpdated)

func NewIntermediateCertificateAuthority(parentCert *x509.Certificate, parentKey crypto.Signer, config *CertConfig) (*x509.Certificate, crypto.Signer, error) {
	key, err := NewPrivateKey(config.EncryptionAlgorithm)
	if err != nil {
		return nil, nil, errors.Wrap(err, "unable to create private key while generating intermediate CA certificate")
	}

	cert, err := NewSignedCert(config, key, parentCert, parentKey, true)
	if err != nil {

class Object : public Handle {
 public:
  /// Constructs a handle that acts as an object.
  Object() : Handle(TaggedValue::Dict()) {}
  /// Retrieves the key of the object's parent.
  static const String& ParentKey();

  /// @brief Gets an object member attribute`key`.
  ///
  /// If the `key` is not found in the object, the object's "__parent__"
  /// attribute is then searched.
  ///