- [alpha] Simplifies bootstrapping of TLS secured communication between the API server and kubelet. ([docs](http://kubernetes.io/docs/admin/master-node-communication/#kubelet-tls-bootstrap)) ([kubernetes/features#43](https://github.com/kubernetes/enhancements/issues/43))

- Kubeadm: Added the `HTTPEndpoints` field to `ClusterConfiguration.Etcd.ExternalEtcd` to configure HTTP endpoints for etcd communication in v1beta4. This separates HTTP traffic (e.g., `/metrics`, `/health`) from gRPC traffic, improving access control. Mirrors etcd’s `--listen-client-http-urls` behavior; if not set, the `Endpoints` field handles both traffic types. ([#134890](ht...

    assertFailsWith<UnknownServiceException> {
      client.newCall(request).execute()
    }.also { expected ->
      assertThat(expected.message).isEqualTo(
        "CLEARTEXT communication not enabled for client",
      )
    }
  }

  @Test
  fun httpsCallsFailWhenProtocolIsH2PriorKnowledge() {
    client =
      client
        .newBuilder()