func (s *clientTLSTestSuite) TestTLSReloadAtomicReplace(c *C) {
	tmpDir, err := os.MkdirTemp(os.TempDir(), "cert-tmp")
	c.Assert(err, IsNil)
	os.RemoveAll(tmpDir)
	defer os.RemoveAll(tmpDir)
	certsDir, err := os.MkdirTemp(os.TempDir(), "cert-to-load")
	c.Assert(err, IsNil)
	defer os.RemoveAll(certsDir)
	certsDirExp, err := os.MkdirTemp(os.TempDir(), "cert-expired")
	c.Assert(err, IsNil)
	defer os.RemoveAll(certsDirExp)
	cloneFunc := func() transport.TLSInfo {
		tlsInfo, terr := copyTLSFiles(testTLSInfo, certsDir)
		c.Assert(terr, IsNil)
		_, err = copyTLSFiles(testTLSInfoExpired, certsDirExp)
		c.Assert(err, IsNil)
		return tlsInfo
	}
	replaceFunc := func() {
		err = os.Rename(certsDir, tmpDir)
		c.Assert(err, IsNil)
		err = os.Rename(certsDirExp, certsDir)
		c.Assert(err, IsNil)
	}
	revertFunc := func() {
		err = os.Rename(tmpDir, certsDirExp)
		c.Assert(err, IsNil)
		err = os.Rename(certsDir, tmpDir)
		c.Assert(err, IsNil)
		err = os.Rename(certsDirExp, certsDir)
		c.Assert(err, IsNil)
	}
	s.testTLSReload(c, cloneFunc, replaceFunc, revertFunc)
}
TestTLSReloadAtomicReplace ensures server reloads expired/valid certs
when all certs are atomically replaced by directory renaming.
And expects server to reject client requests, and vice versa.
package client_test
import (
	"context"
	"io"
	"os"
	"path/filepath"
	"strings"
	"time"
	. "github.com/pingcap/check"
	pd "github.com/tikv/pd/client"
	"github.com/tikv/pd/pkg/grpcutil"
	"github.com/tikv/pd/server"
	"github.com/tikv/pd/server/config"
	"github.com/tikv/pd/tests"
	"go.etcd.io/etcd/pkg/transport"
	"google.golang.org/grpc"
)
var _ = Suite(&clientTLSTestSuite{})
var (
	testTLSInfo = transport.TLSInfo{
		KeyFile:       "./cert/pd-server-key.pem",
		CertFile:      "./cert/pd-server.pem",
		TrustedCAFile: "./cert/ca.pem",
	}
	testClientTLSInfo = transport.TLSInfo{
		KeyFile:       "./cert/client-key.pem",
		CertFile:      "./cert/client.pem",
		TrustedCAFile: "./cert/ca.pem",
	}
	testTLSInfoExpired = transport.TLSInfo{
		KeyFile:       "./cert-expired/pd-server-key.pem",
		CertFile:      "./cert-expired/pd-server.pem",
		TrustedCAFile: "./cert-expired/ca.pem",
	}
)
type clientTLSTestSuite struct {
	ctx    context.Context
	cancel context.CancelFunc
}
func (s *clientTLSTestSuite) SetUpSuite(c *C) {
	s.ctx, s.cancel = context.WithCancel(context.Background())
	server.EnableZap = true
}
func (s *clientTLSTestSuite) TearDownSuite(c *C) {
	s.cancel()
}