/**
     * A comparator implementation based on the names returned by the given namer.
     *
     * @param <T> The type of object that the namer can name
     */
    class Comparator<T> implements java.util.Comparator<T> {

        private final Namer<? super T> namer;

        public Comparator(Namer<? super T> namer) {
            this.namer = namer;
        }

        @Override
        public int compare(T o1, T o2) {

	// does not support names.
	ObjectName(obj runtime.Object) (namespace, name string, err error)
}

type ContextBasedNaming struct {
	Namer         runtime.Namer
	ClusterScoped bool
}

// ContextBasedNaming implements ScopeNamer
var _ ScopeNamer = ContextBasedNaming{}

func (n ContextBasedNaming) Namespace(req *http.Request) (namespace string, err error) {

				"front-proxy-ca.crt": caCert,
				"front-proxy-ca.key": caKey,
				"sa.pub":             publicKey,
				"sa.key":             key,
				"etcd/ca.crt":        caCert,
				"etcd/ca.key":        caKey,
			},
			expectedErrors: 1,
		},
		{
			name: "missing ca.key",
			files: certstestutil.PKIFiles{
				"ca.crt":             caCert,
				"front-proxy-ca.crt": caCert,
				"front-proxy-ca.key": caKey,

ca.in ca.it ca.na ca.reclaim.cloud ca.us caa.aero caa.li cab cable-modem.org cadaques.museum cafe cafjs.com cagliari.it cahcesuolo.no cal cal.it calabria.it california.museum call caltanissetta.it calvinklein cam cam.it cambridge.museum camdvr.org camera camp campaign.gov.uk campania.it campidano-medio.it campidanomedio.it campinagrande.br campinas.br campobasso.it can.museum canada.museum candypop.jp canon canva-apps.cn canva-apps.com capebreton.museum capetown capital capitalone capoo.jp car ca...

	f(a, A, b /* ERROR "cannot use b (variable of type chan<- int) as namedA value in argument to f" */)
	f(b /* ERROR "cannot use b (variable of type chan<- int) as namedA value in argument to f" */, A, a)
	f(b /* ERROR "cannot use b (variable of type chan<- int) as namedA value in argument to f" */, a, A)
	f(A, a, b /* ERROR "cannot use b (variable of type chan<- int) as namedA value in argument to f" */)

			namespace:     "default",
			caCert:        "generic-mtls-split-ca",
			expectedError: "found secret, but didn't have expected keys (cert and key) or (tls.crt and tls.key); found: cacert",
		},
		// The -cacert secret has precedence
		{
			name:          "overlap-cacert",
			namespace:     "default",
			caCert:        "split-ca",

	"k8s.io/utils/ptr"
)

func Test_countCSRDurationMetric(t *testing.T) {
	caPrivateKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	if err != nil {
		t.Fatal(err)
	}
	caCert, err := certutil.NewSelfSignedCACert(certutil.Config{CommonName: "test-ca"}, caPrivateKey)
	if err != nil {
		t.Fatal(err)
	}

	tests := []struct {
		name                       string
		success                    bool

	kubeconfigtestutil.AssertKubeConfigCurrentCluster(t, config, "https://1.2.3.4:1234", caCert)
	kubeconfigtestutil.AssertKubeConfigCurrentAuthInfoWithClientCert(t, config, caCert, notAfter, "myClientName", "myOrg1", "myOrg2")
}

func TestBuildKubeConfigFromSpecWithTokenAuth(t *testing.T) {
	// Creates a CA
	caCert, _ := certstestutil.SetupCertificateAuthority(t)

type FileRenewer struct {
	caCert *x509.Certificate
	caKey  crypto.Signer
}

// NewFileRenewer returns a new certificate renewer that uses given CA cert and key for generating new certificates
func NewFileRenewer(caCert *x509.Certificate, caKey crypto.Signer) *FileRenewer {
	return &FileRenewer{
		caCert: caCert,
		caKey:  caKey,
	}
}

		cert.UsageServerAuth,
	}
	if signerName == "" {
		return nil, nil, nil, fmt.Errorf("signerName is required for Kubernetes CA")
	}
	certChain, caCert, err := SignCSRK8s(client, csrPEM, signerName, usages, dnsName, caFilePath, approveCsr, true, requestedLifetime)

	return certChain, keyPEM, caCert, err
}

// SignCSRK8s generates a certificate from CSR using the K8s CA
// 1. Submit a CSR
// 2. Approve a CSR