import (
	"fmt"
	"time"

	"istio.io/istio/security/pkg/pki/util"
)

// CertUtil is an interface for utility functions on certificate.
type CertUtil interface {
	// GetWaitTime returns the waiting time before renewing the certificate.
	GetWaitTime([]byte, time.Time) (time.Duration, error)
}

// CertUtilImpl is the implementation of CertUtil, for production use.
type CertUtilImpl struct {
	gracePeriodPercentage int
}

package mock

import "time"

// FakeCertUtil is a mocked CertUtil for testing.
type FakeCertUtil struct {
	Duration time.Duration
	Err      error
}

// GetWaitTime returns duration if err is nil, otherwise, it returns err.
func (f FakeCertUtil) GetWaitTime(certBytes []byte, now time.Time) (time.Duration, error) {
	if f.Err != nil {
		return time.Duration(0), f.Err
	}
	return f.Duration, nil

			expectedErr: "invalid PEM encoded certificate",
		},
	}

	cu := NewCertUtil(50) // Grace period percentage is set to 50
	for id, c := range testCases {
		waitTime, err := cu.GetWaitTime(c.cert, c.now)
		if c.expectedErr != "" {
			if err == nil {
				t.Errorf("%s: no error is returned.", id)
			}
			if err.Error() != c.expectedErr {

	signerName string,
	approveCsr bool,
	requestedLifetime time.Duration,
) {
	certUtil := certutil.NewCertUtil(int(defaultCertGracePeriodRatio * 100))
	for {
		waitTime, _ := certUtil.GetWaitTime(s.istiodCertBundleWatcher.GetKeyCertBundle().CertPem, time.Now())
		if !sleep.Until(stop, waitTime) {
			return
		}
		certChain, keyPEM, _, err := chiron.GenKeyCertK8sCA(s.kubeClient.Kube(),

			rotator.config.secretName)
		return
	}
	// Check root certificate expiration time in CA secret
	waitTime, err := rotator.config.certInspector.GetWaitTime(caSecret.Data[CACertFile], time.Now())
	if err == nil && waitTime > 0 {
		rootCertRotatorLog.Info("Root cert is not about to expire, skipping root cert rotation.")