// also remove the "enableClientCertRotationRun" variable.
			// https://github.com/kubernetes/kubeadm/issues/3046
			{
				Name:         "experimental-cert-rotation",
				Short:        "Enable kubelet client certificate rotation (DEPRECATED: use 'enable-client-cert-rotation' instead)",
				InheritFlags: []string{options.CfgPath, options.CertificatesDir, options.DryRun},
				Run:          runKubeletFinalizeEnableClientCertRotationWrapped,
			},
		},
	}

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: gce:beta:kubelet-certificate-rotation
  labels:
    addonmanager.kubernetes.io/mode: Reconcile
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: gce:beta:kubelet-certificate-rotation
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: Group
  name: system:nodes
---

// input left by. Note that this rotation is performed
// before the masked region is used.
type RotateParams struct {
	Start  uint8 // big-endian start bit index [0..63]
	End    uint8 // big-endian end bit index [0..63]
	Amount uint8 // amount to rotate left
}

// NewRotateParams creates a set of parameters representing a
// rotation left by the amount provided and a selection of the bits

		// to fetch new token during each rotation.
		"invalid token needs rotation": {
			jwt:           "invalid-token-section-1.invalid-token-section-2",
			jwtPath:       fmt.Sprintf("/tmp/security-pkg-credentialfetcher-plugin-gcetest-%s", uuid.New().String()),
			expectedCall:  3,
			expectedToken: "invalid-token-section-1.invalid-token-section-2",
		},
	}

	// starts rotation job every 0.5 second.

	klog.V(4).InfoS("Starting container log rotation worker", "workerID", worker)
	for c.processContainer(ctx, worker) {
	}
	klog.V(4).InfoS("Terminating container log rotation worker", "workerID", worker)
}

func (c *containerLogManager) rotateLogs(ctx context.Context) error {
	c.mutex.Lock()
	defer c.mutex.Unlock()
	klog.V(4).InfoS("Starting container log rotation sequence")
	// TODO(#59998): Use kubelet pod cache.

	}{
		// start before end, no rotation
		{start: 0, end: 63, amount: 0, inMask: ^uint64(0), outMask: ^uint64(0)},
		{start: 1, end: 63, amount: 0, inMask: ^uint64(0) >> 1, outMask: ^uint64(0) >> 1},
		{start: 0, end: 62, amount: 0, inMask: ^uint64(1), outMask: ^uint64(1)},
		{start: 1, end: 62, amount: 0, inMask: ^uint64(3) >> 1, outMask: ^uint64(3) >> 1},

		// end before start, no rotation

// root cert for self-signed Citadel.
func (rotator *SelfSignedCARootCertRotator) checkAndRotateRootCert() {
	caSecret, scrtErr := rotator.caSecretController.LoadCASecretWithRetry(rotator.config.secretName,
		rotator.config.caStorageNamespace, rotator.config.retryInterval, rotator.config.retryMax)

	if scrtErr != nil {
		rootCertRotatorLog.Errorf("Fail to load CA secret %s:%s (error: %s), skip cert rotation job",

	"istio.io/istio/security/pkg/k8s/chiron"
	"istio.io/istio/security/pkg/pki/ca"
	certutil "istio.io/istio/security/pkg/util"
)

const (
	// defaultCertGracePeriodRatio is the default length of certificate rotation grace period,
	// configured as the ratio of the certificate TTL.
	defaultCertGracePeriodRatio = 0.5

	// the interval polling root cert and resign istiod cert when it changes.
	rootCertPollingInterval = 60 * time.Second

	rotator.config.CheckInterval = 500 * time.Millisecond
	rootCertRotatorChan := make(chan struct{})
	go rotator.Run(rootCertRotatorChan)
	defer close(rootCertRotatorChan)

	// Wait until root cert rotation is done.
	time.Sleep(600 * time.Millisecond)
	certItem1 := loadCert(rotator)
	verifyRootCertAndPrivateKey(t, false, certItem0, certItem1)

	time.Sleep(600 * time.Millisecond)
	certItem2 := loadCert(rotator)

    throw "Failed to set end of file for handle ${handle}, system error code: ${err}"
  }
  Close-Handle -Handle $handle
}

# FileRotationConfig defines the common options for file rotation.
class FileRotationConfig {
  # Force rotation, ignoring $MaxBackupInterval and $MaxSize criteria.
  [bool]$Force
  # Maximum time since last backup, after which file will be rotated.