err := boshClient.DeleteDeployment(manifest.Name)
			Expect(err).NotTo(HaveOccurred())
		}
	})

	It("successfully rolls with new tls keys and certs", func() {
		By("spamming the kv store", func() {
			spammer.Spam()
		})

		By("adding a new ca cert", func() {
			manifest.Properties.Consul.CACert = fmt.Sprintf("%s\n%s", manifest.Properties.Consul.CACert, newCACert)
		})

		By("deploying with the new ca cert", func() {
			yaml, err := manifest.ToYAML()
			Expect(err).NotTo(HaveOccurred())

			yaml, err = boshClient.ResolveManifestVersions(yaml)
			Expect(err).NotTo(HaveOccurred())

			_, err = boshClient.Deploy(yaml)
			Expect(err).NotTo(HaveOccurred())

			Eventually(func() ([]bosh.VM, error) {
				return helpers.DeploymentVMs(boshClient, manifest.Name)
			}, "1m", "10s").Should(ConsistOf(helpers.GetVMsFromManifest(manifest)))
		})

		By("replace agent and server keys and certs", func() {
			manifest.Properties.Consul.AgentCert = newAgentCert
			Eventually(func() ([]bosh.VM, error) {
				return helpers.DeploymentVMs(boshClient, consulManifest.Name)
			}, "1m", "10s").Should(ConsistOf(helpers.GetVMsFromManifest(consulManifest)))
		})
	})

	AfterEach(func() {
		By("deleting the deployment", func() {
			if !CurrentGinkgoTestDescription().Failed {
				for i := 0; i < 5; i++ {
					err := boshClient.SetVMResurrection(consulManifest.Name, "consul", i, true)
					Expect(err).NotTo(HaveOccurred())
				}

				yaml, err := consulManifest.ToYAML()
				Expect(err).NotTo(HaveOccurred())

				Eventually(func() error {
					return boshClient.ScanAndFixAll(yaml)
				}, "10m", "30s").ShouldNot(HaveOccurred())

				Eventually(func() ([]bosh.VM, error) {
					return helpers.DeploymentVMs(boshClient, consulManifest.Name)
				}, "10m", "10s").Should(ConsistOf(helpers.GetVMsFromManifest(consulManifest)))

				Eventually(func() ([]string, error) {
					return lockedDeployments()
				}, "1m", "10s").ShouldNot(ContainElement(consulManifest.Name))

				err = boshClient.DeleteDeployment(consulManifest.Name)