code: func NewLockResolver(etcdAddrs []string, security config.Security) (*LockResolver, error) {
  	pdCli, err := pd.NewClient(etcdAddrs, pd.SecurityOption{
  		CAPath:   security.ClusterSSLCA,
  		CertPath: security.ClusterSSLCert,
  		KeyPath:  security.ClusterSSLKey,
  	})
  	if err != nil {
  		return nil, errors.Trace(err)
  	}
  	uuid := fmt.Sprintf("tikv-%v", pdCli.GetClusterID(context.TODO()))
  
  	tlsConfig, err := security.ToTLSConfig()
  	if err != nil {
  		return nil, errors.Trace(err)
  	}
  
  	spkv, err := NewEtcdSafePointKV(etcdAddrs, tlsConfig)
  	if err != nil {
  		return nil, errors.Trace(err)
  	}
  
  	s, err := newTikvStore(uuid, &codecPDClient{pdCli}, spkv, newRPCClient(security), false)
  	if err != nil {
  		return nil, errors.Trace(err)
  	}
  	return s.lockResolver, nil
  }
docs: // NewLockResolver creates a LockResolver.
  // It is exported for other pkg to use. For instance, binlog service needs
  // to determine a transaction's commit state.