Introduce type alias CABundleHash for the hash of a CA bundle ([32]byte)

Co-authored-by: Ryan Richard <richardry@vmware.com>
Co-authored-by: Ashish Amarnath <ashish.amarnath@broadcom.com>

internal/controller/supervisorconfig/oidcupstreamwatcher/oidc_upstream_watcher.go

@@ -96,7 +96,7 @@ type UpstreamOIDCIdentityProviderICache interface {
 // oidcDiscoveryCacheKey is the type of keys in an oidcDiscoveryCache.
 type oidcDiscoveryCacheKey struct {
 	issuer       string
-	caBundleHash [32]byte
+	caBundleHash tlsconfigutil.CABundleHash
 }
 
 // oidcDiscoveryCacheValue is the type of cache entries in an oidcDiscoveryCache.
@@ -359,7 +359,7 @@ func (c *oidcWatcherController) validateIssuer(ctx context.Context, upstream *id
 	// Get the discovered provider and HTTP client from cache, if they are found in the cache.
 	cacheKey := oidcDiscoveryCacheKey{
 		issuer:       upstream.Spec.Issuer,
-		caBundleHash: caBundle.Hash(), // note that this will always return the same hash for nil input
+		caBundleHash: caBundle.Hash(),
 	}
 	if cacheEntry := c.validatorCache.getProvider(cacheKey); cacheEntry != nil {
 		discoveredProvider = cacheEntry.provider

internal/controller/supervisorconfig/oidcupstreamwatcher/oidc_upstream_watcher_test.go

@@ -6,7 +6,6 @@ package oidcupstreamwatcher
 import (
 	"bytes"
 	"context"
-	"crypto/sha256"
 	"crypto/x509"
 	"encoding/base64"
 	"encoding/json"
@@ -32,6 +31,7 @@ import (
 	supervisorfake "go.pinniped.dev/generated/latest/client/supervisor/clientset/versioned/fake"
 	supervisorinformers "go.pinniped.dev/generated/latest/client/supervisor/informers/externalversions"
 	"go.pinniped.dev/internal/certauthority"
+	"go.pinniped.dev/internal/controller/tlsconfigutil"
 	"go.pinniped.dev/internal/controllerlib"
 	"go.pinniped.dev/internal/federationdomain/dynamicupstreamprovider"
 	"go.pinniped.dev/internal/federationdomain/upstreamprovider"
@@ -1114,7 +1114,7 @@ func TestOIDCUpstreamWatcherControllerSync(t *testing.T) {
 				// without encountering any errors.
 				cacheKey := oidcDiscoveryCacheKey{
 					issuer:       testIssuerURL + "/this-path-does-not-exist",
-					caBundleHash: sha256.Sum256([]byte(testIssuerCA)),
+					caBundleHash: tlsconfigutil.NewCABundleHash([]byte(testIssuerCA)),
 				}
 				// Put it into the initial cache for this test.
 				return map[oidcDiscoveryCacheKey]*oidcDiscoveryCacheValue{