🤖 Serving CA NotAfter ignores the injected clock #224

Problem

servingcert.Generate(namespace, now) sets the CA's NotBefore from the injected clock (since #223). The CA's NotAfter still comes from certutil's wall clock (vendor/k8s.io/client-go/util/cert/cert.go, time.Now() + 10 years). The serving certificate is clamped to the CA's NotAfter (internal/aggregated/servingcert/servingcert.go, around lines 160-161).

Today this has no correctness effect, because the mismatch only moves a 10-year boundary. But the CA does not fully follow the injected clock, which makes long-horizon tests and clock-skewed replicas harder to reason about.

Proposal

Build the CA template directly, or pass a lifetime, so that both NotBefore and NotAfter derive from now. Add a test with a far-past now.

Revisit when

Someone changes certificate lifetimes or rotation, or a test needs a far-future clock.

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: medium