code: func NewManager(config *Config) (Manager, error) {
  	cert, forceRotation, err := getCurrentCertificateOrBootstrap(
  		config.CertificateStore,
  		config.BootstrapCertificatePEM,
  		config.BootstrapKeyPEM)
  	if err != nil {
  		return nil, err
  	}
  
  	getTemplate := config.GetTemplate
  	if getTemplate == nil {
  		getTemplate = func() *x509.CertificateRequest { return config.Template }
  	}
  
  	m := manager{
  		stopCh:                make(chan struct{}),
  		clientFn:              config.ClientFn,
  		getTemplate:           getTemplate,
  		dynamicTemplate:       config.GetTemplate != nil,
  		usages:                config.Usages,
  		certStore:             config.CertificateStore,
  		cert:                  cert,
  		forceRotation:         forceRotation,
  		certificateExpiration: config.CertificateExpiration,
  	}
  
  	return &m, nil
  }
docs: // NewManager returns a new certificate manager. A certificate manager is
  // responsible for being the authoritative source of certificates in the
  // Kubelet and handling updates due to rotation.