"fmt"
	"sync/atomic"

	"k8s.io/apiserver/pkg/server/dynamiccertificates"
	"k8s.io/client-go/util/cert"
	"k8s.io/client-go/util/keyutil"
	"k8s.io/kubernetes/pkg/controller/certificates/authority"
)

func newCAProvider(caFile, caKeyFile string) (*caProvider, error) {
	caLoader, err := dynamiccertificates.NewDynamicServingContentFromFiles("csr-controller", caFile, caKeyFile)
	if err != nil {

)

type Signer struct {
	caProvider *caProvider
	CertTTL    time.Duration
}

func NewSigner(signerRoot, signerName string, certificateDuration time.Duration) (*Signer, error) {
	caProvider, err := newCAProvider(signerRoot, signerName)
	if err != nil {
		return nil, err
	}

	ret := &Signer{
		caProvider: caProvider,
		CertTTL:    certificateDuration,
	}
	return ret, nil
}

	"fmt"
	"os"
	"sync/atomic"
	"time"

	"k8s.io/client-go/util/cert"
	"k8s.io/client-go/util/keyutil"

	"istio.io/istio/pkg/test/cert/ca"
	"istio.io/istio/pkg/test/csrctrl/authority"
)

func newCAProvider(signerRoot, signerName string) (*caProvider, error) {
	strRoot := signerRoot + "/" + signerName + "/"
	// create the folder if it does not exist
	if _, err := os.Stat(strRoot); os.IsNotExist(err) {

	isRequestForSignerFn, err := getCSRVerificationFuncForSignerName(signerName)
	if err != nil {
		return nil, err
	}
	caProvider, err := newCAProvider(caFile, caKeyFile)
	if err != nil {
		return nil, err
	}

	ret := &signer{
		caProvider:           caProvider,
		client:               client,
		certTTL:              certificateDuration,