func newSignedCertAndKey(config *certutil.Config, caCert *x509.Certificate, caKey crypto.Signer) (*x509.Certificate, crypto.Signer, error) {
	key, err := rsa.GenerateKey(cryptorand.Reader, rsaKeySize)
	if err != nil {
		return nil, nil, errors.Wrap(err, "unable to create private key")
	}
	cert, err := newSignedCert(config, key, caCert, caKey)
	if err != nil {
		return nil, nil, errors.Wrap(err, "unable to sign certificate")
	}
	return cert, key, nil
}
newSignedCertAndKey creates new certificate and key by passing the certificate authority certificate and key
package tlssecrets
import (
	"context"
	"crypto"
	cryptorand "crypto/rand"
	"crypto/rsa"
	"crypto/x509"
	"crypto/x509/pkix"
	"encoding/pem"
	"fmt"
	"math"
	"math/big"
	"time"
	"github.com/pkg/errors"
	corev1 "k8s.io/api/core/v1"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/types"
	certutil "k8s.io/client-go/util/cert"
	"k8s.io/client-go/util/keyutil"
	ctrl "sigs.k8s.io/controller-runtime"
	"sigs.k8s.io/controller-runtime/pkg/client"
	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
	"sigs.k8s.io/controller-runtime/pkg/manager"
	"sigs.k8s.io/controller-runtime/pkg/reconcile"
	"github.com/crossplane/crossplane-runtime/pkg/event"
	"github.com/crossplane/crossplane-runtime/pkg/logging"
	"github.com/crossplane/crossplane-runtime/pkg/resource"
	"github.com/upbound/universal-crossplane/internal/meta"
)
const (
	reconcileTimeout = 1 * time.Minute
	certificateBlockType = "CERTIFICATE"
	rsaKeySize           = 2048
	certificateValidity  = time.Hour * 24 * 365 * 10
	keyCACert  = "ca.crt"
	keyTLSCert = "tls.crt"
	keyTLSKey  = "tls.key"
	nameUpbound        = "upbound"
	cnAgent            = "upbound-agent"
	cnXgql             = "xgql"
	secretNameCA       = "uxp-ca"
	secretNameAgentTLS = "upbound-agent-tls"
	secretNameXgqlTLS  = "xgql-tls"
)
const (
	errGetSecret        = "failed to get cert secret"
	errGetCASecret      = "failed get ca secret"
	errInitCA           = "failed to initialize ca"
	errUpdateCASecret   = "failed to update ca secret"
	errUpdateCertSecret = "failed to update secret for certificate data"
)
const (
	reasonCA       event.Reason = "InitializingCA"
	reasonGenerate event.Reason = "GeneratingCertificates"
	reasonSync     event.Reason = "SyncCerts"
	reasonUpdate   event.Reason = "UpdatingSecret"
)
var (
	caConfig = &certutil.Config{
		CommonName:   nameUpbound,
		Organization: []string{nameUpbound},
	}
	certConfigs = map[string]*certutil.Config{
		secretNameAgentTLS: {
			CommonName: cnAgent,
			AltNames: certutil.AltNames{
				DNSNames: []string{cnAgent},
			},
			Usages: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
		},
		secretNameXgqlTLS: {
			CommonName: cnXgql,
			AltNames: certutil.AltNames{
				DNSNames: []string{cnXgql},
			},
			Usages: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
		},
	}
)
type ReconcilerOption func(*Reconciler)
func WithLogger(log logging.Logger) ReconcilerOption {
	return func(r *Reconciler) {
		r.log = log
	}
}
func WithRecorder(er event.Recorder) ReconcilerOption {
	return func(r *Reconciler) {
		r.record = er
	}
}
func Setup(mgr ctrl.Manager, l logging.Logger) error {
	name := "tlsSecretGeneration"
	r := NewReconciler(mgr,
		WithLogger(l.WithValues("controller", name)),
		WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
	)
	return ctrl.NewControllerManagedBy(mgr).
		Named(name).
		For(&corev1.Secret{}).
		WithEventFilter(resource.NewPredicates(resource.AnyOf(
			resource.IsNamed(secretNameAgentTLS),
			resource.IsNamed(secretNameXgqlTLS),
		))).
		Complete(r)
}
type Reconciler struct {
	client client.Client
	log    logging.Logger
	record event.Recorder
	caCert *x509.Certificate
	caKey  crypto.Signer
}
func NewReconciler(mgr manager.Manager, opts ...ReconcilerOption) *Reconciler {
	r := &Reconciler{
		client: mgr.GetClient(),
		log:    logging.NewNopLogger(),
		record: event.NewNopRecorder(),
	}
	for _, f := range opts {
		f(r)
	}
	return r
}
func (r *Reconciler) Reconcile(ctx context.Context, req reconcile.Request) (reconcile.Result, error) {
	log := r.log.WithValues("request", req)
	log.Debug("Reconciling...")
	ctx, cancel := context.WithTimeout(ctx, reconcileTimeout)
	defer cancel()
	s := &corev1.Secret{}
	err := r.client.Get(ctx, types.NamespacedName{Name: req.Name, Namespace: req.Namespace}, s)
	if err != nil {
		return reconcile.Result{}, errors.Wrap(err, errGetSecret)
	}
	cert := s.Data[keyTLSCert]
	if string(cert) != "" {
		m := fmt.Sprintf("Secret %s already contains certificate, skipping generation", req.Name)
		log.Debug(m)
		r.record.Event(s, event.Normal(reasonSync, m))
		return reconcile.Result{}, nil
	}
	if err = r.createOrLoadCA(ctx, req.Namespace); err != nil {
		err = errors.Wrap(err, errInitCA)
		log.Info(err.Error())
		r.record.Event(s, event.Warning(reasonCA, err))
		return reconcile.Result{}, err
	}
	log.Info("Generating certificate...")
	c, k, err := newSignedCertAndKey(certConfigs[req.Name], r.caCert, r.caKey)
	if err != nil {
		err = errors.Wrap(err, "failed to generate signed certificate")
		log.Info(err.Error())
		r.record.Event(s, event.Warning(reasonGenerate, err))
		return reconcile.Result{}, err
	}
	d, err := tlsSecretDataFromCertAndKey(c, k, r.caCert)
	if err != nil {
		err = errors.Wrap(err, "failed to build secret data from generated certificate")
		log.Info(err.Error())
		r.record.Event(s, event.Warning(reasonGenerate, err))
		return reconcile.Result{}, err
	}
	s.Labels = map[string]string{
		meta.LabelKeyManagedBy: meta.LabelValueManagedBy,
	}
	s.Data = d
	if err = r.client.Update(ctx, s); err != nil {
		err = errors.Wrap(err, errUpdateCertSecret)
		log.Info(err.Error())
		r.record.Event(s, event.Warning(reasonUpdate, err))
		return reconcile.Result{}, err
	}
	m := "Successfully generated certificate!"
	log.Info(m)
	r.record.Event(s, event.Normal(reasonUpdate, m))
	return reconcile.Result{}, nil
}
func (r *Reconciler) createOrLoadCA(ctx context.Context, namespace string) error {
	cas := &corev1.Secret{}
	err := r.client.Get(ctx, types.NamespacedName{Name: secretNameCA, Namespace: namespace}, cas)
	if resource.IgnoreNotFound(err) != nil {
		return errors.Wrap(err, errGetCASecret)
	}
	if err == nil && string(cas.Data[keyTLSKey]) != "" {
		c, k, _, err := certFromTLSSecretData(cas.Data)
		if err != nil {
			return errors.Wrap(err, "failed to parts existing ca secret")
		}
		r.caCert = c
		r.caKey = k
		return nil
	}
	c, k, err := newCertificateAuthority(caConfig)
	if err != nil {
		return errors.Wrap(err, "failed to generate new ca")
	}
	r.caCert = c
	r.caKey = k
	d, err := tlsSecretDataFromCertAndKey(c, k, c)
	if err != nil {
		return errors.Wrap(err, "failed to build tls secret data from generated ca")
	}
	cas = &corev1.Secret{
		ObjectMeta: metav1.ObjectMeta{
			Name:      secretNameCA,
			Namespace: namespace,
			Labels: map[string]string{
				meta.LabelKeyManagedBy: meta.LabelValueManagedBy,
			},
		},
		Type: corev1.SecretTypeTLS,
	}
	_, err = controllerutil.CreateOrUpdate(ctx, r.client, cas, func() error {
		cas.Data = d
		return nil
	})
	return errors.Wrap(err, errUpdateCASecret)
}
func newCertificateAuthority(config *certutil.Config) (*x509.Certificate, crypto.Signer, error) {
	key, err := rsa.GenerateKey(cryptorand.Reader, rsaKeySize)
	if err != nil {
		return nil, nil, errors.Wrap(err, "unable to create private key while generating CA certificate")
	}
	cert, err := certutil.NewSelfSignedCACert(*config, key)
	if err != nil {
		return nil, nil, errors.Wrap(err, "unable to create self-signed CA certificate")
	}
	return cert, key, nil
}