for _, cert := range test.certs {
				if cert.CAName != "" && certMap[cert.CAName] == nil {
					t.Errorf("Certificate %q references nonexistent CA %q", cert.Name, cert.CAName)
				}
			}
		})
	}
}

func TestMakeCertTree(t *testing.T) {
	rootCert := &KubeadmCert{
		Name: "root",
	}
	leaf0 := &KubeadmCert{
		Name:   "leaf0",
		CAName: "root",
	}
	leaf1 := &KubeadmCert{
		Name:   "leaf1",

	caMap := make(CertificateTree)

	for _, cert := range m {
		if cert.CAName == "" {
			if _, ok := caMap[cert]; !ok {
				caMap[cert] = []*KubeadmCert{}
			}
		} else {
			ca, ok := m[cert.CAName]
			if !ok {
				return nil, errors.Errorf("certificate %q references unknown CA %q", cert.Name, cert.CAName)
			}
			caMap[ca] = append(caMap[ca], cert)
		}
	}

	return caMap, nil
}

		// Too many values live across blocks can cause pathological
		// behavior in the register allocator (see issue 52180).
		return
	}

	canMove := f.Cache.allocBoolSlice(f.NumValues())
	defer f.Cache.freeBoolSlice(canMove)

	// Compute the memory states of each block.
	startMem := f.Cache.allocValueSlice(f.NumBlocks())
	defer f.Cache.freeValueSlice(startMem)

	// ExternallyManaged defines if the certificate is externally managed.
	ExternallyManaged bool `json:"externallyManaged"`

	// CAName represents the name of the CA that signed the certificate.
	// This field is empty for self-signed, root CA certificates.
	CAName string `json:"caName,omitempty"`

	// Missing represents if the certificate is missing.
	Missing bool `json:"missing"`
}

		exist: false,
	}
	tests := []struct {
		name    string
		cas     map[string]*CAExpirationHandler
		caName  string
		want    bool
		wantErr bool
	}{
		{
			name:    "caName does not exist in cas list",
			cas:     map[string]*CAExpirationHandler{},
			caName:  "foo",
			want:    false,
			wantErr: true,
		},
		{
			name: "ca exists",
			cas: map[string]*CAExpirationHandler{

	defer os.RemoveAll(dirPKI)

	// write the CA cert and key to the temporary PKI dir
	caName := kubeadmconstants.CACertAndKeyBaseName
	if err := pkiutil.WriteCertAndKey(
		dirPKI,
		caName,
		testCACert,
		testCAKey); err != nil {
		t.Fatalf("couldn't write out certificate %s to %s", caName, dirPKI)
	}

	// creates a certificate and then embeds it into a kubeconfig file

{
  "global": {
    "autoscalingv2API": true,
    "caAddress": "",
    "caName": "",
    "certSigners": [],
    "configCluster": false,
    "configValidation": true,
    "defaultPodDisruptionBudget": {
      "enabled": true
    },
    "defaultResources": {
      "requests": {
        "cpu": "10m"
      }
    },
    "enabled": false,
    "externalIstiod": false,
    "hub": "gcr.io/istio-testing",
    "imagePullPolicy": "",

{
  "global": {
    "autoscalingv2API": true,
    "caAddress": "",
    "caName": "",
    "certSigners": [],
    "configCluster": false,
    "configValidation": true,
    "defaultPodDisruptionBudget": {
      "enabled": true
    },
    "defaultResources": {
      "requests": {
        "cpu": "10m"
      }
    },
    "enabled": false,
    "externalIstiod": false,
    "hub": "gcr.io/istio-testing",
    "imagePullPolicy": "",

{
  "global": {
    "autoscalingv2API": true,
    "caAddress": "",
    "caName": "",
    "certSigners": [],
    "configCluster": false,
    "configValidation": true,
    "defaultPodDisruptionBudget": {
      "enabled": true
    },
    "defaultResources": {
      "requests": {
        "cpu": "10m"
      }
    },
    "enabled": false,
    "externalIstiod": false,
    "hub": "gcr.io/istio-testing",
    "imagePullPolicy": "",

{
  "global": {
    "autoscalingv2API": true,
    "caAddress": "",
    "caName": "",
    "certSigners": [],
    "configCluster": false,
    "configValidation": true,
    "defaultPodDisruptionBudget": {
      "enabled": true
    },
    "defaultResources": {
      "requests": {
        "cpu": "10m"
      }
    },
    "enabled": false,
    "externalIstiod": false,
    "hub": "gcr.io/istio-testing",