jitter:       jitter,
		backoffTimer: nil,
	}
}

func (j *jitteredBackoffManagerImpl) getNextBackoff() time.Duration {
	jitteredPeriod := j.duration
	if j.jitter > 0.0 {
		jitteredPeriod = Jitter(j.duration, j.jitter)
	}
	return jitteredPeriod
}

// Backoff implements BackoffManager.Backoff, it returns a timer so caller can block on the timer for jittered backoff.

	const estimatedLoopOverhead = time.Millisecond
	// estimate how long this delay can be
	intervalMax := func(backoff Backoff) time.Duration {
		d := backoff.Duration
		if backoff.Jitter > 0 {
			d += time.Duration(backoff.Jitter * float64(d))
		}
		return d
	}
	// estimate how short this delay can be
	intervalMin := func(backoff Backoff) time.Duration {
		d := backoff.Duration
		return d
	}

	jitter := time.Duration(rand.Float64()*maxJitter.Seconds()) * time.Second
	if now.After(iat.Add(maxTTL - jitter)) {
		return true
	}
	// Require a refresh if within 20% of the TTL plus a jitter from the expiration time.
	if now.After(exp.Add(-1*time.Duration((*tr.Spec.ExpirationSeconds*20)/100)*time.Second - jitter)) {
		return true
	}
	return false
}

	// positive jitter
	backoff := Backoff{Duration: 1, Jitter: 1}.DelayWithReset(testingclock.NewFakeClock(time.Now()), 0)
	for i := 0; i < 5; i++ {
		value := backoff()
		if value < 1 || value > 2 {
			t.Errorf("backoff out of range: %d", value)
		}
	}

	// negative jitter, shall be a fixed backoff
	backoff = Backoff{Duration: 1, Jitter: -1}.DelayWithReset(testingclock.NewFakeClock(time.Now()), 0)

	// second open is attempted, it draws an error.”
	//
	// So we can try to open a locked file, but if it fails we're on our own to
	// figure out when it becomes available. We'll use exponential backoff with
	// some jitter and an arbitrary limit of 500ms.

	// If the file was unpacked or created by some other program, it might not
	// have the ModeExclusive bit set. Set it before we call OpenFile, so that we

)

var caLog = log.RegisterScope("ca", "ca client")

// CARetryOptions returns the default retry options recommended for CA calls
// This includes 5 retries, with backoff from 100ms -> 1.6s with jitter.
var CARetryOptions = []retry.CallOption{
	retry.WithMax(5),
	retry.WithBackoff(wrapBackoffWithMetrics(retry.BackoffExponentialWithJitter(100*time.Millisecond, 0.1))),

func (rotator *SelfSignedCARootCertRotator) Run(stopCh chan struct{}) {
	if rotator.config.enableJitter {
		rootCertRotatorLog.Infof("Jitter is enabled, wait %s before "+
			"starting root cert rotator.", rotator.backOffTime.String())
		select {
		case <-time.After(rotator.backOffTime):
			rootCertRotatorLog.Infof("Jitter complete, start rotator.")
		case <-stopCh:
			rootCertRotatorLog.Info("Received stop signal, so stop the root cert rotator.")

func Forever(f func(), period time.Duration) {
	Until(f, period, NeverStop)
}

// Jitter returns a time.Duration between duration and duration + maxFactor *
// duration.
//
// This allows clients to avoid converging on periodic behavior. If maxFactor
// is 0.0, a suggested default value will be chosen.
func Jitter(duration time.Duration, maxFactor float64) time.Duration {
	if maxFactor <= 0.0 {
		maxFactor = 1.0
	}

		WebhookCacheAuthorizedTTL:   60 * time.Second,
		WebhookCacheUnauthorizedTTL: 30 * time.Second,
		WebhookRetryBackoff: &wait.Backoff{
			Duration: 500 * time.Millisecond,
			Factor:   1.5,
			Jitter:   0.2,
			Steps:    5,
		},
	}

	opts := NewBuiltInAuthorizationOptions()
	pf := pflag.NewFlagSet("test-builtin-authorization-opts", pflag.ContinueOnError)
	opts.AddFlags(pf)

	// the connection is closed.
	Timeout time.Duration
	// MaxServerConnectionAge is a duration for the maximum amount of time a
	// connection may exist before it will be closed by the server sending a GoAway.
	// A random jitter is added to spread out connection storms.
	// See https://github.com/grpc/grpc-go/blob/bd0b3b2aa2a9c87b323ee812359b0e9cda680dad/keepalive/keepalive.go#L49
	MaxServerConnectionAge time.Duration // default value is infinity