Code review comment: Agree, these tests should be rewritten to use DeploymentTester.

Code before review:
public void includes_application_endpoint_when_declared() {
Instance instance = new Instance(ApplicationId.from("t1", "a1", "default"));
ZoneId zone1 = ZoneId.from(Environment.prod, RegionName.from("aws-us-east-1c"));
ZoneId zone2 = ZoneId.from(Environment.prod, RegionName.from("aws-us-west-2a"));
ApplicationPackage applicationPackage = new ApplicationPackageBuilder()
.instances("beta,main")
.region(zone1.region())
.region(zone2.region())
.applicationEndpoint("a", "qrs", zone2.region().value(),
Map.of(InstanceName.from("beta"), 2,
InstanceName.from("main"), 8))
.applicationEndpoint("b", "qrs", zone2.region().value(),
Map.of(InstanceName.from("beta"), 1,
InstanceName.from("main"), 1))
.applicationEndpoint("c", "qrs", zone1.region().value(),
Map.of(InstanceName.from("beta"), 4,
InstanceName.from("main"), 6))
.build();
ControllerTester tester = new ControllerTester(SystemName.Public);
EndpointCertificateValidatorImpl endpointCertificateValidator = new EndpointCertificateValidatorImpl(secretStore, clock);
EndpointCertificates endpointCertificates = new EndpointCertificates(tester.controller(), endpointCertificateMock, endpointCertificateValidator);
List<String> expectedSans = List.of(
"vlfms2wpoa4nyrka2s5lktucypjtxkqhv.internal.vespa-app.cloud",
"a1.t1.g.vespa-app.cloud",
"*.a1.t1.g.vespa-app.cloud",
"a1.t1.aws-us-west-2a.r.vespa-app.cloud",
"*.a1.t1.aws-us-west-2a.r.vespa-app.cloud",
"a1.t1.aws-us-east-1c.r.vespa-app.cloud",
"*.a1.t1.aws-us-east-1c.r.vespa-app.cloud",
"a1.t1.aws-us-east-1c.z.vespa-app.cloud",
"*.a1.t1.aws-us-east-1c.z.vespa-app.cloud",
"a1.t1.aws-us-east-1c.test.z.vespa-app.cloud",
"*.a1.t1.aws-us-east-1c.test.z.vespa-app.cloud",
"a1.t1.aws-us-east-1c.staging.z.vespa-app.cloud",
"*.a1.t1.aws-us-east-1c.staging.z.vespa-app.cloud"
);
Optional<EndpointCertificateMetadata> endpointCertificateMetadata = endpointCertificates.getMetadata(instance, zone1, applicationPackage.deploymentSpec());
assertTrue(endpointCertificateMetadata.isPresent());
assertTrue(endpointCertificateMetadata.get().keyName().matches("vespa.tls.t1.a1.*-key"));
assertTrue(endpointCertificateMetadata.get().certName().matches("vespa.tls.t1.a1.*-cert"));
assertEquals(0, endpointCertificateMetadata.get().version());
assertEquals(expectedSans, endpointCertificateMetadata.get().requestedDnsSans());
}

Line under review: List<String> expectedSans = List.of(

Code after addressing the review:
public void includes_application_endpoint_when_declared() {
Instance instance = new Instance(ApplicationId.from("t1", "a1", "default"));
ZoneId zone1 = ZoneId.from(Environment.prod, RegionName.from("aws-us-east-1c"));
ZoneId zone2 = ZoneId.from(Environment.prod, RegionName.from("aws-us-west-2a"));
ApplicationPackage applicationPackage = new ApplicationPackageBuilder()
.instances("beta,main")
.region(zone1.region())
.region(zone2.region())
.applicationEndpoint("a", "qrs", zone2.region().value(),
Map.of(InstanceName.from("beta"), 2,
InstanceName.from("main"), 8))
.applicationEndpoint("b", "qrs", zone2.region().value(),
Map.of(InstanceName.from("beta"), 1,
InstanceName.from("main"), 1))
.applicationEndpoint("c", "qrs", zone1.region().value(),
Map.of(InstanceName.from("beta"), 4,
InstanceName.from("main"), 6))
.build();
ControllerTester tester = new ControllerTester(SystemName.Public);
EndpointCertificateValidatorImpl endpointCertificateValidator = new EndpointCertificateValidatorImpl(secretStore, clock);
EndpointCertificates endpointCertificates = new EndpointCertificates(tester.controller(), endpointCertificateMock, endpointCertificateValidator);
List<String> expectedSans = List.of(
"vlfms2wpoa4nyrka2s5lktucypjtxkqhv.internal.vespa-app.cloud",
"a1.t1.g.vespa-app.cloud",
"*.a1.t1.g.vespa-app.cloud",
"a1.t1.aws-us-west-2a.r.vespa-app.cloud",
"*.a1.t1.aws-us-west-2a.r.vespa-app.cloud",
"a1.t1.aws-us-east-1c.r.vespa-app.cloud",
"*.a1.t1.aws-us-east-1c.r.vespa-app.cloud",
"a1.t1.aws-us-east-1c.z.vespa-app.cloud",
"*.a1.t1.aws-us-east-1c.z.vespa-app.cloud",
"a1.t1.aws-us-east-1c.test.z.vespa-app.cloud",
"*.a1.t1.aws-us-east-1c.test.z.vespa-app.cloud",
"a1.t1.aws-us-east-1c.staging.z.vespa-app.cloud",
"*.a1.t1.aws-us-east-1c.staging.z.vespa-app.cloud"
);
Optional<EndpointCertificateMetadata> endpointCertificateMetadata = endpointCertificates.getMetadata(instance, zone1, applicationPackage.deploymentSpec());
assertTrue(endpointCertificateMetadata.isPresent());
assertTrue(endpointCertificateMetadata.get().keyName().matches("vespa.tls.t1.a1.*-key"));
assertTrue(endpointCertificateMetadata.get().certName().matches("vespa.tls.t1.a1.*-cert"));
assertEquals(0, endpointCertificateMetadata.get().version());
assertEquals(expectedSans, endpointCertificateMetadata.get().requestedDnsSans());
}