FeatureGates: map[string]bool{
					features.PublicKeysECDSA: true,
				},
				EncryptionAlgorithm: EncryptionAlgorithmRSA4096,
			},
			expectedResult: EncryptionAlgorithmECDSAP256,
		},
		{
			name: "feature gate is set to false, return the default RSA-2048",
			cfg: &ClusterConfiguration{
				FeatureGates: map[string]bool{
					features.PublicKeysECDSA: false,
				},
			},

	"strconv"
	"strings"

	"github.com/pkg/errors"

	"k8s.io/apimachinery/pkg/util/version"
	"k8s.io/component-base/featuregate"
	"k8s.io/klog/v2"
)

const (
	// PublicKeysECDSA is expected to be alpha in v1.19
	PublicKeysECDSA = "PublicKeysECDSA"
	// RootlessControlPlane is expected to be in alpha in v1.22
	RootlessControlPlane = "RootlessControlPlane"
	// EtcdLearnerMode is expected to be in alpha in v1.27, beta in v1.29

	initTest := []struct {
		name string
		args string
	}{
		{
			name: "no feature gates passed",
			args: "",
		},
		{
			name: "feature gate PublicKeysECDSA=true",
			args: "--feature-gates=PublicKeysECDSA=true",
		},
	}

	for _, rt := range initTest {
		t.Run(rt.name, func(t *testing.T) {
			_, _, exitcode, err := runKubeadmInit(t, rt.args)
			if exitcode == PanicExitcode {

		want        bool
	}{
		{
			name:        "the feature is not supported",
			featureName: "foo",
			want:        false,
		},
		{
			name:        "the feature is supported",
			featureName: PublicKeysECDSA,
			want:        true,
		},
	}
	for _, test := range tests {
		t.Run(test.name, func(t *testing.T) {
			if got := Supports(InitFeatureGates, test.featureName); got != test.want {

	// If the feature gate is not set, use the EncryptionAlgorithm field (v1beta4).
	// TODO: remove this function when the feature gate is removed.
	if enabled, ok := cfg.FeatureGates[features.PublicKeysECDSA]; ok {
		if enabled {
			return EncryptionAlgorithmECDSAP256
		}
		return EncryptionAlgorithmRSA2048
	}
	return cfg.EncryptionAlgorithm
}

- Kubeadm: fixed a bug where the PublicKeysECDSA feature gate was not respected when generating kubeconfig files. ([#125388](https://github.com/kubernetes/kubernetes/pull/125388), [@neolit123](https://github.com/neolit123)) [SIG Cluster Lifecycle]

- Kubeadm: add a upgrade health check that deploys a Job ([#81319](https://github.com/kubernetes/kubernetes/pull/81319), [@neolit123](https://github.com/neolit123)) [SIG Cluster Lifecycle]
- Kubeadm: add the experimental feature gate PublicKeysECDSA that can be used to create a

- Kubeadm: add the experimental feature gate PublicKeysECDSA that can be used to create a
  cluster with ECDSA certificates from "kubeadm init". Renewal of existing ECDSA certificates is
  also supported using "kubeadm alpha certs renew", but not switching between the RSA and