t.Errorf("Org does not match, (get %s) vs (expected %s)",
			mergedCertOptions.Org, deltaCertOptions.Org)
	}
	if mergedCertOptions.TTL != defaultCertOptions.TTL {
		t.Errorf("TTL does not match, (get %s) vs (expected %s)",
			mergedCertOptions.TTL.String(), deltaCertOptions.TTL.String())
	}
	if mergedCertOptions.IsCA != defaultCertOptions.IsCA {
		t.Errorf("IsCA does not match, (get %t) vs (expected %t)",

// update function, making it ready for use.
func NewFromFunc[T any](ttl time.Duration, opts Opts, update func(ctx context.Context) (T, error)) *Cache[T] {
	return &Cache[T]{
		ttl:      ttl,
		updateFn: update,
		opts:     opts,
	}
}

// InitOnce initializes the cache with a TTL and an update function. It is
// guaranteed to be called only once.
func (t *Cache[T]) InitOnce(ttl time.Duration, opts Opts, update func(ctx context.Context) (T, error)) {

	testCases := []struct {
		ttl      int64
		duration int64
	}{
		{
			ttl:      3600,
			duration: 60,
		},
		{
			ttl:      1000,
			duration: 50,
		},
	}
	lm := newDefaultLeaseManager(nil, NewDefaultLeaseManagerConfig())
	for i := 0; i < len(testCases); i++ {
		dur := lm.getReuseDurationSecondsLocked(testCases[i].ttl)
		if dur != testCases[i].duration {

	testCases := []struct {
		name string
		ttl  float64
		time time.Time
	}{
		{
			name: "ttl valid",
			ttl:  30,
			time: t0.Add(time.Second * 30),
		},
		{
			name: "ttl almost expired",
			ttl:  2,
			time: t0.Add(time.Second * 58),
		},
		{
			name: "ttl just expired",
			ttl:  0,
			time: t0.Add(time.Second * 60),
		},
		{
			name: "ttl-invalid",
			ttl:  -30,

	"time"
)

func TestTTLBasic(t *testing.T) {
	ttl := NewTTL(5*time.Second, 1*time.Millisecond)
	testCacheBasic(ttl, t)
}

func TestTTLConcurrent(t *testing.T) {
	ttl := NewTTL(5*time.Second, 1*time.Second)
	testCacheConcurrent(ttl, t)
}

func TestTTLExpiration(t *testing.T) {
	ttl := NewTTL(5*time.Second, 0).(*ttlCache)
	testCacheExpiration(ttl, ttl.evictExpired, t)
}

func TestTTLEvicter(t *testing.T) {

		},
		{
			name:             "Job completed now, 0s TTL",
			completionTime:   now,
			ttl:              pointer.Int32(0),
			since:            &now.Time,
			expectedTimeLeft: pointer.Duration(0 * time.Second),
			expectedExpireAt: now.Time,
		},
		{
			name:             "Job completed now, 10s TTL",
			completionTime:   now,
			ttl:              pointer.Int32(10),
			since:            &now.Time,

		},
		{
			node:       &v1.Node{},
			ttlSeconds: 10,
			patch:      "{\"metadata\":{\"annotations\":{\"node.alpha.kubernetes.io/ttl\":\"10\"}}}",
		},
		{
			node:       &v1.Node{ObjectMeta: metav1.ObjectMeta{Name: "name"}},
			ttlSeconds: 10,
			patch:      "{\"metadata\":{\"annotations\":{\"node.alpha.kubernetes.io/ttl\":\"10\"}}}",
		},
		{

	// request a lease with a little extra ttl from etcd
	ttl += reuseDurationSeconds
	lcr, err := l.client.Lease.Grant(ctx, ttl)
	if err != nil {
		return clientv3.LeaseID(0), err
	}
	// cache the new lease id
	l.prevLeaseID = lcr.ID
	l.prevLeaseExpirationTime = now.Add(time.Duration(ttl) * time.Second)
	// refresh count
	metrics.UpdateLeaseObjectCount(l.leaseAttachedObjectCount)
	l.leaseAttachedObjectCount = 1
	return lcr.ID, nil
}

// to the `queue`. The Controller has workers who consume `queue`, check whether
// the Job TTL has expired or not; if the Job TTL hasn't expired, it will add the
// Job to the queue after the TTL is expected to expire; if the TTL has expired, the
// worker will send requests to the API server to delete the Jobs accordingly.

			policy: PermissiveSigningPolicy{TTL: time.Hour, Backdate: 5 * time.Minute, Now: nowFunc},
			want: x509.Certificate{
				NotBefore:             now.Add(-5 * time.Minute),
				NotAfter:              now.Add(55 * time.Minute),
				BasicConstraintsValid: true,
			},
		},
		{
			name:   "backdate without short and super small ttl",
			policy: PermissiveSigningPolicy{TTL: time.Minute, Backdate: 5 * time.Minute, Now: nowFunc},