Fix renewalTime skew issue

Ensure the time returned by RenewalTime function is the same time as that which will be read from Certificate's status

Signed-off-by: irbekrm <irbekrm@gmail.com>

pkg/controller/certificates/util.go

@@ -307,6 +307,6 @@ func RenewalTime(notBefore, notAfter time.Time, renewBeforeOverride *metav1.Dura
 
 	// 2. Calculate when a cert should be renewed
 
-	rt := metav1.NewTime(notAfter.Add(-1 * renewBefore))
+	rt := metav1.NewTime(notAfter.Add(-1 * renewBefore).Truncate(time.Second))
 	return &rt
 }

pkg/controller/certificates/util_test.go

@@ -302,7 +302,7 @@ func TestRenewalTime(t *testing.T) {
 		renewBeforeOverride *metav1.Duration
 		expectedRenewalTime *metav1.Time
 	}
-	now := time.Now()
+	now := time.Now().Truncate(time.Second)
 	tests := map[string]scenario{
 		"short lived cert, spec.renewBefore is not set": {
 			notBefore:           now,