dynamiccert: split into serving cert and CA providers

Signed-off-by: Monis Khan <mok@vmware.com>

cmd/local-user-authenticator/main.go

@@ -54,12 +54,12 @@ const (
 )
 
 type webhook struct {
-	certProvider   dynamiccert.Provider
+	certProvider   dynamiccert.Private
 	secretInformer corev1informers.SecretInformer
 }
 
 func newWebhook(
-	certProvider dynamiccert.Provider,
+	certProvider dynamiccert.Private,
 	secretInformer corev1informers.SecretInformer,
 ) *webhook {
 	return &webhook{
@@ -281,7 +281,7 @@ func respondWithAuthenticated(
 
 func startControllers(
 	ctx context.Context,
-	dynamicCertProvider dynamiccert.Provider,
+	dynamicCertProvider dynamiccert.Private,
 	kubeClient kubernetes.Interface,
 	kubeInformers kubeinformers.SharedInformerFactory,
 ) {
@@ -328,7 +328,7 @@ func startControllers(
 func startWebhook(
 	ctx context.Context,
 	l net.Listener,
-	dynamicCertProvider dynamiccert.Provider,
+	dynamicCertProvider dynamiccert.Private,
 	secretInformer corev1informers.SecretInformer,
 ) error {
 	return newWebhook(dynamicCertProvider, secretInformer).start(ctx, l)
@@ -355,7 +355,7 @@ func run() error {
 		kubeinformers.WithNamespace(namespace),
 	)
 
-	dynamicCertProvider := dynamiccert.New("local-user-authenticator-tls-serving-certificate")
+	dynamicCertProvider := dynamiccert.NewServingCert("local-user-authenticator-tls-serving-certificate")
 
 	startControllers(ctx, dynamicCertProvider, client.Kubernetes, kubeInformers)
 	plog.Debug("controllers are ready")

cmd/local-user-authenticator/main_test.go

@@ -458,7 +458,7 @@ func createSecretInformer(ctx context.Context, t *testing.T, kubeClient kubernet
 // newClientProvider returns a dynamiccert.Provider configured
 // with valid serving cert, the CA bundle that can be used to verify the serving
 // cert, and the server name that can be used to verify the TLS peer.
-func newCertProvider(t *testing.T) (dynamiccert.Provider, []byte, string) {
+func newCertProvider(t *testing.T) (dynamiccert.Private, []byte, string) {
 	t.Helper()
 
 	serverName := "local-user-authenticator"
@@ -472,7 +472,7 @@ func newCertProvider(t *testing.T) (dynamiccert.Provider, []byte, string) {
 	certPEM, keyPEM, err := certauthority.ToPEM(cert)
 	require.NoError(t, err)
 
-	certProvider := dynamiccert.New(t.Name())
+	certProvider := dynamiccert.NewServingCert(t.Name())
 	err = certProvider.SetCertKeyContent(certPEM, keyPEM)
 	require.NoError(t, err)