## 2. Create Kubernetes secret

[Kubernetes secrets](https://kubernetes.io/docs/concepts/configuration/secret) are intended to hold sensitive information.
We'll use secrets to hold the TLS certificate and key. To create a secret, update the paths to `private.key` and `public.crt`
below.

Then type

```sh

    assertEquals(ImmutableSortedSet.of(4, 6, 8, 10), Sets.subSet(set, Range.atLeast(4)));
    assertEquals(ImmutableSortedSet.of(8, 10), Sets.subSet(set, Range.atLeast(7)));
    assertEquals(empty, Sets.subSet(set, Range.atLeast(20)));

    assertEquals(set, Sets.subSet(set, Range.greaterThan(0)));
    assertEquals(ImmutableSortedSet.of(6, 8, 10), Sets.subSet(set, Range.greaterThan(4)));

    return client


def test_post_body_form(client: TestClient):
    response = client.post("/login/", data={"username": "Foo", "password": "secret"})
    assert response.status_code == 200
    assert response.json() == {"username": "Foo", "password": "secret"}


def test_post_body_form_no_password(client: TestClient):
    response = client.post("/login/", data={"username": "Foo"})
    assert response.status_code == 422

    applyConnectionSpec(connectionSpec, socket, false)
    assertArrayEquals(arrayOf("TLS_A", "TLS_C"), socket.enabledCipherSuites)
  }

  @Test
  fun applyIntersectionRetainsSslPrefixes() {
    val socket = FakeSslSocket()
    socket.enabledProtocols = arrayOf("TLSv1")
    socket.supportedCipherSuites =
      arrayOf("TLS_A", "TLS_B", "TLS_C", "TLS_D", "TLS_E")
    socket.enabledCipherSuites = arrayOf("TLS_A", "TLS_B", "TLS_C")

    assertThat(set.subSet(1, 4)).containsExactly(1, 2, 3).inOrder();
    assertThat(set.subSet(2, 4)).containsExactly(2, 3).inOrder();
    assertThat(set.subSet(3, 4)).containsExactly(3).inOrder();
    assertThat(set.subSet(3, 3)).isEmpty();
    assertThat(set.subSet(2, 3)).containsExactly(2).inOrder();
    assertThat(set.subSet(1, 3)).containsExactly(1, 2).inOrder();

	}
	for _, secret := range secretDump.DynamicActiveSecrets {
		// check the ROOTCA from secret dump
		if secret.Name == "ROOTCA" {
			var returnStr string
			var returnErr error
			strCA, err := c.configDump.GetRootCAFromSecretConfigDump(secret.GetSecret())
			if err != nil {
				returnStr = ""
				returnErr = fmt.Errorf("can not dump ROOTCA from secret: %v", err)
			} else {
				returnStr = strCA

    response = client.post(
        "/login",
        data={"username": "johndoe", "password": "secret", "grant_type": "password"},
    )
    assert response.status_code == 200
    assert response.json() == {
        "grant_type": "password",
        "username": "johndoe",
        "password": "secret",
        "scopes": [],
        "client_id": None,
        "client_secret": None,
    }

	return saName + "-istio-remote-secret-token"
}

func secretReferencesServiceAccount(serviceAccount *v1.ServiceAccount, secret *v1.Secret) error {
	if secret.Type != v1.SecretTypeServiceAccountToken ||
		secret.Annotations[v1.ServiceAccountNameKey] != serviceAccount.Name {
		return fmt.Errorf("secret %s/%s does not reference ServiceAccount %s",
			secret.Namespace, secret.Name, serviceAccount.Name)
	}
	return nil
}

      }

      val source = socket.source().buffer()
      val sink = socket.sink().buffer()

      while (processOneRequest(socket, source, sink)) {
      }

      if (sequenceNumber == 0) {
        logger.warning(
          "${this@MockWebServer} connection from ${raw.inetAddress} didn't make a request",
        )
      }

      socket.close()
      openClientSockets.remove(socket)
    }

    /**

    assertThat(attempt1).isNotNull()
    assertThat(attempt1!!.isTlsFallback).isTrue()
    socket.close()

    // COMPATIBLE_TLS is used here.
    socket = createSocketWithEnabledProtocols(*enabledSocketTlsVersions)
    connectionSpecs[attempt1.connectionSpecIndex].apply(socket, attempt1.isTlsFallback)
    assertEnabledProtocols(socket, TlsVersion.TLS_1_2, TlsVersion.TLS_1_1, TlsVersion.TLS_1_0)