- [Other doc]: <link>
  --> ([#119517](https://github.com/kubernetes/kubernetes/pull/119517), [@sanposhiho](https://github.com/sanposhiho)) [SIG Node, Scheduling and Testing]
- '`kubeadm`: added validation to verify that the `CertificateKey` is a valid hex
  encoded AES key.' ([#120064](https://github.com/kubernetes/kubernetes/pull/120064), [@SataQiu](https://github.com/SataQiu))
- A customizable `OrderedScoreFuncs()` function was introduced. Out-of-tree plugins 

     * [certificatePem()][certificatePem] and [privateKeyPkcs8Pem()][privateKeyPkcs8Pem].
     *
     * [rfc_7468]: https://tools.ietf.org/html/rfc7468
     * [rfc_5208]: https://tools.ietf.org/html/rfc5208
     */
    @JvmStatic
    fun decode(certificateAndPrivateKeyPem: String): HeldCertificate {
      var certificatePem: String? = null
      var pkcs8Base64: String? = null

import java.security.cert.X509Certificate
import okio.Buffer
import okio.ByteString
import okio.ByteString.Companion.toByteString

/**
 * Decodes a multiline string that contains a [certificate][certificatePem] which is
 * [PEM-encoded][rfc_7468]. A typical input string looks like this:
 *
 * ```
 * -----BEGIN CERTIFICATE-----
 * MIIBYTCCAQegAwIBAgIBKjAKBggqhkjOPQQDAjApMRQwEgYDVQQLEwtlbmdpbmVl

      |lu/GJQZoU9lDrCPeUcQ28tzOW6AKBggqhkjOPQMBBw==
      |-----END PRIVATE KEY-----
      |
      """.trimMargin()
    val heldCertificate = decode(certificatePem + pkcs8Pem)
    assertThat(heldCertificate.certificatePem()).isEqualTo(certificatePem)

    // Slightly different encoding
    if (platform.isBouncyCastle()) {
      assertThat(heldCertificate.privateKeyPkcs8Pem()).isEqualTo(bcPkcs8Pem)
    } else {

public final class okhttp3/tls/Certificates {
	public static final fun certificatePem (Ljava/security/cert/X509Certificate;)Ljava/lang/String;
	public static final fun decodeCertificatePem (Ljava/lang/String;)Ljava/security/cert/X509Certificate;
}

public final class okhttp3/tls/HandshakeCertificates {
	public final fun -deprecated_keyManager ()Ljavax/net/ssl/X509KeyManager;
	public final fun -deprecated_trustManager ()Ljavax/net/ssl/X509TrustManager;

      |
      """.trimMargin()
    val certificateByteString = certificateBase64.decodeBase64()!!
    val certificatePem =
      """
      |-----BEGIN CERTIFICATE-----
      |$certificateBase64
      |-----END CERTIFICATE-----
      |
      """.trimMargin()

    val javaCertificate = certificatePem.decodeCertificatePem()
    val okHttpCertificate =
      CertificateAdapters.certificate

      jaA9VEhgdaVhxBsT2qzUNDsXlOzGsliznDfoqETb
      -----END CERTIFICATE-----
      
      """.trimIndent()
    val certificate = certificateString.decodeCertificatePem()
    assertEquals(certificateString, certificate.certificatePem())
  }

      + "-----END CERTIFICATE-----\n";

    X509Certificate certificate =
        Certificates.decodeCertificatePem(certificateString);

    assertEquals(certificateString, Certificates.certificatePem(certificate));
  }

* ACTION REQUIRED: kubeadm: the mixture of "--config" and "--certificate-key" is no longer allowed. The InitConfiguration and JoinConfiguration objects now support the "certificateKey" field and this field should be used instead of the command line argument in case a configuration file is already passed. ([#78542](https://github.com/kubernetes/kubernetes/pull/78542), [@neolit123](https://github.com/neolit123))

    val heldCertificate =
      HeldCertificate
        .Builder()
        .commonName("Foo Corp")
        .addSubjectAlternativeName("foo.com")
        .build()
    val session = session(heldCertificate.certificatePem())
    assertThat(verifier.verify("foo.com", session)).isTrue()
    assertThat(verifier.verify("bar.com", session)).isFalse()
  }

  @Test fun specialKInHostname() {