@Override
    public void upgrade() {
        if (clusterConfigService.get(V202406260800_MigrateCertificateAuthority.MigrationCompleted.class) != null) {
            LOG.debug("Migration already completed.");
            return;
        }
        readExistingKeystore().ifPresent(keystore -> clusterConfigService.write(new EncryptedCaKeystore(keystore)));
        mongoConnection.getMongoDatabase().getCollection(LEGACY_COLLECTION_NAME).drop();
    }
@Test
    void testMigration() {
        mongodb.importFixture("V202406260800_MigrateCertificateAuthorityTest.json", V202406260800_MigrateCertificateAuthorityTest.class);
        final ClusterConfigService clusterConfigService = Mockito.mock(ClusterConfigService.class);
        final V202406260800_MigrateCertificateAuthority migration = new V202406260800_MigrateCertificateAuthority(clusterConfigService, mongodb.mongoConnection());


        final long documentsCount = mongodb.mongoConnection().getMongoDatabase().getCollection(V202406260800_MigrateCertificateAuthority.LEGACY_COLLECTION_NAME).countDocuments();
        // there should be one entry with the encoded CA keystore
        Assertions.assertThat(documentsCount).isEqualTo(1);

        migration.upgrade();
        final ArgumentCaptor<EncryptedCaKeystore> captor = ArgumentCaptor.forClass(EncryptedCaKeystore.class);
        Mockito.verify(clusterConfigService, Mockito.times(1)).write(captor.capture());

        // verify that migration extracted the correct data
        Assertions.assertThat(captor.getValue().keystore().value()).startsWith("b97f382e52e0cf");
        Assertions.assertThat(captor.getValue().keystore().salt()).isEqualTo("753bacc1ae1df5e3");

        final Set<String> existingCollections = mongodb.mongoConnection().getMongoDatabase().listCollectionNames().into(new HashSet<>());
        Assertions.assertThat(existingCollections).doesNotContain(V202406260800_MigrateCertificateAuthority.LEGACY_COLLECTION_NAME);
    }