func (s *sentry) Run(ctx context.Context, conf config.SentryConfig, readyCh chan bool) {
	certAuth, err := ca.NewCertificateAuthority(conf)
	if err != nil {
		log.Fatalf("error getting certificate authority: %s", err)
	}
	log.Info("certificate authority loaded")
	err = certAuth.LoadOrStoreTrustBundle()
	if err != nil {
		log.Fatalf("error loading trust root bundle: %s", err)
	}
	log.Infof("trust root bundle loaded. issuer cert expiry: %s", certAuth.GetCACertBundle().GetIssuerCertExpiry().String())
	monitoring.IssuerCertExpiry(certAuth.GetCACertBundle().GetIssuerCertExpiry())
	v, err := createValidator()
	if err != nil {
		log.Fatalf("error creating validator: %s", err)
	}
	log.Info("validator created")
	s.server = server.NewCAServer(certAuth, v)
	go func() {
		<-ctx.Done()
		log.Info("sentry certificate authority is shutting down")
		s.server.Shutdown()  
	}()
	if readyCh != nil {
		readyCh <- true
		s.reloading = false
	}
	log.Infof("sentry certificate authority is running, protecting ya'll")
	err = s.server.Run(conf.Port, certAuth.GetCACertBundle())
	if err != nil {
		log.Fatalf("error starting gRPC server: %s", err)
	}
}
Run loads the trust anchors and issuer certs, creates a new CA and runs the CA server.
package sentry
import (
	"context"
	"github.com/pkg/errors"
	"github.com/dapr/dapr/pkg/sentry/ca"
	"github.com/dapr/dapr/pkg/sentry/config"
	"github.com/dapr/dapr/pkg/sentry/identity"
	"github.com/dapr/dapr/pkg/sentry/identity/kubernetes"
	"github.com/dapr/dapr/pkg/sentry/identity/selfhosted"
	k8s "github.com/dapr/dapr/pkg/sentry/kubernetes"
	"github.com/dapr/dapr/pkg/sentry/monitoring"
	"github.com/dapr/dapr/pkg/sentry/server"
	"github.com/dapr/kit/logger"
)
var log = logger.NewLogger("dapr.sentry")
type CertificateAuthority interface {
	Run(context.Context, config.SentryConfig, chan bool)
	Restart(ctx context.Context, conf config.SentryConfig)
}
type sentry struct {
	server    server.CAServer
	reloading bool
}
func NewSentryCA() CertificateAuthority {
	return &sentry{}
}