Add tests for the new cert controllers and some other small refactorings

- Add a unit test for each cert controller
- Make DynamicTLSServingCertProvider an interface and use a mutex
  internally
- Create a shared ToPEM function instead of having two very similar
  functions
- Move the ObservableWithInformerOption test helper to testutils
- Rename some variables and imports

internal/provider/dynamic_tls_serving_cert_provider.go

@@ -5,15 +5,40 @@ SPDX-License-Identifier: Apache-2.0
 
 package provider
 
-type DynamicTLSServingCertProvider struct {
-	CertPEM []byte
-	KeyPEM  []byte
+import (
+	"sync"
+
+	"k8s.io/apiserver/pkg/server/dynamiccertificates"
+)
+
+type DynamicTLSServingCertProvider interface {
+	dynamiccertificates.CertKeyContentProvider
+	Set(certPEM, keyPEM []byte)
 }
 
-func (*DynamicTLSServingCertProvider) Name() string {
+type dynamicTLSServingCertProvider struct {
+	certPEM []byte
+	keyPEM  []byte
+	mutex   sync.RWMutex
+}
+
+func NewDynamicTLSServingCertProvider() DynamicTLSServingCertProvider {
+	return &dynamicTLSServingCertProvider{}
+}
+
+func (p *dynamicTLSServingCertProvider) Set(certPEM, keyPEM []byte) {
+	p.mutex.Lock() // acquire a write lock
+	defer p.mutex.Unlock()
+	p.certPEM = certPEM
+	p.keyPEM = keyPEM
+}
+
+func (p *dynamicTLSServingCertProvider) Name() string {
 	return "DynamicTLSServingCertProvider"
 }
 
-func (p *DynamicTLSServingCertProvider) CurrentCertKeyContent() (cert []byte, key []byte) {
-	return p.CertPEM, p.KeyPEM
+func (p *dynamicTLSServingCertProvider) CurrentCertKeyContent() (cert []byte, key []byte) {
+	p.mutex.RLock() // acquire a read lock
+	defer p.mutex.RUnlock()
+	return p.certPEM, p.keyPEM
 }