_, err = os.Stat(path.Join(dir, "ca.crt"))
	g.Expect(os.IsNotExist(err)).Should(Equal(true))

	// Should load remote cacerts successfully.
	createCATLSSecret(t, s.kubeClient)

	err = s.loadCACerts(caOpts, dir)
	g.Expect(err).Should(BeNil())

	expectedRoot, err := readSampleCertFromFile("root-cert.pem")
	g.Expect(err).Should(BeNil())

	g.Expect(os.ReadFile(path.Join(dir, "ca.crt"))).Should(Equal(expectedRoot))

          - --cluster=cluster-0
          - --grpc=7070
          - --port=8090
          - --port=8080
          - --port=3333
          - --version=bar
          - --istio-version=
          - --crt=/cert.crt
          - --key=/cert.key
        ports:
        - containerPort: 7070
        - containerPort: 8090
        - containerPort: 8080
        - containerPort: 3333
          name: tcp-health-port
        env:

	}{
		{
			keyName:            "apiserver-kubelet-client.crt",
			expectedSecretName: "apiserver-kubelet-client.crt",
		},
		{
			keyName:            "etcd/ca.crt",
			expectedSecretName: "etcd-ca.crt",
		},
		{
			keyName:            "etcd/healthcheck-client.crt",
			expectedSecretName: "etcd-healthcheck-client.crt",
		},
	}

	for _, tc := range tests {

          - --cluster=cluster-0
          - --grpc=7070
          - --port=8090
          - --port=8080
          - --port=3333
          - --version=bar
          - --istio-version=
          - --crt=/cert.crt
          - --key=/cert.key
        ports:
        - containerPort: 7070
        - containerPort: 8090
        - containerPort: 8080
        - containerPort: 3333
          name: tcp-health-port
        env:

		clientSigningKey, err := testutil.NewPrivateKey()
		if err != nil {
			return result, err
		}
		clientSigningCert, err := cert.NewSelfSignedCACert(cert.Config{CommonName: "client-ca"}, clientSigningKey)
		if err != nil {
			return result, err
		}
		clientCACertFile := filepath.Join(s.SecureServing.ServerCert.CertDirectory, "client-ca.crt")

package x509

import "internal/goos"

// Possible certificate files; stop after finding one.
var certFiles = []string{
	"/etc/ssl/certs/ca-certificates.crt",                // Debian/Ubuntu/Gentoo etc.
	"/etc/pki/tls/certs/ca-bundle.crt",                  // Fedora/RHEL 6
	"/etc/ssl/ca-bundle.pem",                            // OpenSUSE
	"/etc/pki/tls/cacert.pem",                           // OpenELEC

		"--etcd-keyfile=/var/run/kubernetes/etcd.key",
		"--etcd-certfile=/var/run/kubernetes/etcdce.crt",
		"--etcd-cafile=/var/run/kubernetes/etcdca.crt",
		"--http2-max-streams-per-connection=42",
		"--tracing-config-file=/var/run/kubernetes/tracing_config.yaml",
		"--proxy-client-cert-file=/var/run/kubernetes/proxy.crt",
		"--proxy-client-key-file=/var/run/kubernetes/proxy.key",
		"--request-timeout=2m",

	if err != nil {
		return "", "", fmt.Errorf("failed to read private key from file %s: %s", keyFile, err)
	}
	crt, err := os.ReadFile(crtFile)
	if err != nil {
		return "", "", fmt.Errorf("failed to read certificate from file %s: %s", crtFile, err)
	}
	return string(key), string(crt), nil
}

func openssl(args ...string) error {
	cmd := exec.Command("openssl", args...)

			Data: map[string]string{
				"ca.crt": string(c.rootCA),
			},
		}, metav1.CreateOptions{})
		// don't retry a create if the namespace doesn't exist or is terminating
		if apierrors.IsNotFound(err) || apierrors.HasStatusCause(err, v1.NamespaceTerminatingCause) {
			return nil
		}
		return err
	case err != nil:
		return err
	}

	data := map[string]string{
		"ca.crt": string(c.rootCA),
	}

          - --xds-grpc-server=7070
          - --port=8080
          - --port=3333
          - --grpc=17171
          - --bind-localhost=17171
          - --version=bar
          - --istio-version=
          - --crt=/cert.crt
          - --key=/cert.key
        ports:
        - containerPort: 7070
        - containerPort: 8080
        - containerPort: 3333
          name: tcp-health-port
        - containerPort: 17171
        env: