}

    private
    fun newEncryptionSession(): EncryptionAlgorithm.Session =
        encryptionAlgorithm.newSession(secretKey)

    private
    fun secretKeySource(kind: EncryptionKind): SecretKeySource =
        when (kind) {
            EncryptionKind.KEYSTORE ->
                KeyStoreKeySource(
                    encryptionAlgorithm = encryptionAlgorithm.algorithm,

			Organization: spec.ClientCertAuth.Organizations,
			Usages:       []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
		},
		NotAfter:            spec.ClientCertNotAfter,
		EncryptionAlgorithm: spec.EncryptionAlgorithm,
	}
}

// validateKubeConfig check if the kubeconfig file exist and has the expected CA and server URL
func validateKubeConfig(outDir, filename string, config *clientcmdapi.Config) error {

				}

				// Assert EncryptionAlgorithm
				if spec.EncryptionAlgorithm != cfg.EncryptionAlgorithm {
					t.Errorf("getKubeConfigSpecs for %s EncryptionAlgorithm is %s, expected %s", assertion.kubeConfigFile, spec.EncryptionAlgorithm, cfg.EncryptionAlgorithm)
				}

				// Asserts InitConfiguration values injected into spec

	RSAPrivateKeyBlockType = "RSA PRIVATE KEY"
)

// CertConfig is a wrapper around certutil.Config extending it with EncryptionAlgorithm.
type CertConfig struct {
	certutil.Config
	NotAfter            time.Time
	EncryptionAlgorithm kubeadmapi.EncryptionAlgorithmType
}

// NewCertificateAuthority creates new certificate and private key for the certificate authority

					Networking: kubeadmapi.Networking{
						ServiceSubnet: "10.96.0.1/12",
						DNSDomain:     "cluster.local",
					},
					CertificatesDir:     "/some/cert/dir",
					EncryptionAlgorithm: kubeadmapi.EncryptionAlgorithmRSA2048,
				},
				NodeRegistration: kubeadmapi.NodeRegistrationOptions{Name: nodename, CRISocket: criPath},
			}, false},
		{"invalid missing token with IPv6 service subnet",

	for _, f := range handler.certConfigMutators {
		if err := f(&certConfig); err != nil {
			return false, err
		}
	}

	cfg := &pkiutil.CertConfig{
		Config:              certConfig,
		EncryptionAlgorithm: rm.cfg.EncryptionAlgorithmType(),
	}

	startTime := kubeadmutil.StartTimeUTC()

	// Backdate certificate to allow small time jumps.
	cfg.NotBefore = startTime.Add(-kubeadmconstants.CertificateBackdate)

	FeatureGates map[string]bool

	// The cluster name
	ClusterName string

	// EncryptionAlgorithm holds the type of asymmetric encryption algorithm used for keys and certificates.
	// Can be one of "RSA-2048" (default), "RSA-3072", "RSA-4096" or "ECDSA-P256".
	EncryptionAlgorithm EncryptionAlgorithmType

	// CertificateValidityPeriod specifies the validity period for a non-CA certificate generated by kubeadm.

	// +optional
	ClusterName string `json:"clusterName,omitempty"`

	// EncryptionAlgorithm holds the type of asymmetric encryption algorithm used for keys and certificates.
	// Can be one of "RSA-2048" (default), "RSA-3072", "RSA-4096" or "ECDSA-P256".
	// +optional
	EncryptionAlgorithm EncryptionAlgorithmType `json:"encryptionAlgorithm,omitempty"`

)

func TestMain(m *testing.M) {
	var err error

	rootCACert, rootCAKey, err = NewCertificateAuthority(&CertConfig{
		Config: certutil.Config{
			CommonName: "Root CA 1",
		},
		EncryptionAlgorithm: kubeadmapi.EncryptionAlgorithmRSA2048,
	})
	if err != nil {
		panic(fmt.Sprintf("Failed generating Root CA: %v", err))
	}
	if !rootCACert.IsCA {
		panic("rootCACert is not a valid CA")
	}

//     `Scheduler.ExtraArgs`, `Etcd.Local.ExtraArgs`. Also to `NodeRegistrationOptions.KubeletExtraArgs`.
//   - Add `ClusterConfiguration.EncryptionAlgorithm` that can be used to set the asymmetric encryption algorithm
//     used for this cluster's keys and certificates. Can be one of "RSA-2048" (default), "RSA-3072", "RSA-4096" or "ECDSA-P256".