* Fixed encryption key and encryption provider rotation ([#58375](https://github.com/kubernetes/kubernetes/pull/58375), [@liggitt](https://github.com/liggitt))

- Fixes an issue affecting log rotation with CRI runtimes where kubelet tries to compress Windows logs before closing file handles ([#112483](https://github.com/kubernetes/kubernetes/pull/112483), [@ibabou](https://github.com/ibabou)) [SIG Node and Windows]

2758..275E    ; valid                  ;      ; NV8    # 1.1  LIGHT VERTICAL BAR..HEAVY DOUBLE COMMA QUOTATION MARK ORNAMENT
275F..2760    ; valid                  ;      ; NV8    # 6.0  HEAVY LOW SINGLE COMMA QUOTATION MARK ORNAMENT..HEAVY LOW DOUBLE COMMA QUOTATION MARK ORNAMENT
2761..2767    ; valid                  ;      ; NV8    # 1.1  CURVED STEM PARAGRAPH SIGN ORNAMENT..ROTATED FLORAL HEART BULLET

//go:generate msgp -file $GOFILE -unexported

// BatchKeyRotationType defines key rotation type
type BatchKeyRotationType string

const (
	sses3  BatchKeyRotationType = "sse-s3"
	ssekms BatchKeyRotationType = "sse-kms"
)

// BatchJobKeyRotateEncryption defines key rotation encryption options passed
type BatchJobKeyRotateEncryption struct {
	Type       BatchKeyRotationType `yaml:"type" json:"type"`

    }

    @Test
    public void testMultipleKeyRotations() throws GeneralSecurityException {
        String sessionId = "multi-rotation";
        keyManager.storeSessionKey(sessionId, testKey, "AES");

        // Perform multiple rotations
        for (int i = 1; i <= 5; i++) {
            int version = keyManager.rotateSessionKey(sessionId);
            assertEquals(i, version, "Version should be " + i);

* Kubelets using TLS bootstrapping (`--bootstrap-kubeconfig`) or certificate rotation (`--rotate-certificates`) store certificates in the directory specified by `--cert-dir`. The default location (`/var/run/kubernetes`) is automatically erased on reboot on some platforms, which can prevent the kubelet from authenticating to the API server after a reboot. Specifying a non-transient location, such as `--cert-dir=/var/lib/kubelet/pki`, is recommended.

    // Store session key and preauth hash for key rotation
    private byte[] sessionKey;
    private byte[] preauthIntegrityHash;
    private int rotationCount = 0;

    // Key rotation tracking - use atomic for lock-free operations
    private final AtomicLong bytesEncrypted = new AtomicLong(0);
    private long encryptionStartTime = System.currentTimeMillis();

    // Configurable key rotation limits with defaults

                Thread t = new Thread(r, "SecureKeyManager-Rotation");
                t.setDaemon(true);
                return t;
            });
    private java.util.concurrent.ScheduledFuture<?> rotationTask;

    /**
     * Configure key rotation interval
     *
     * @param intervalMillis rotation interval in milliseconds
     */
    public void configureKeyRotation(long intervalMillis) {

        assertNotNull(encrypted2);

        // Verify rotation occurred by checking metrics
        assertTrue(context.getKeyRotationCount() > 0, "Key rotation should have occurred");

        // Can still encrypt after rotation
        byte[] plaintext3 = "Message after rotation".getBytes();
        byte[] encrypted3 = assertDoesNotThrow(() -> context.encryptMessage(plaintext3, 3L));

     *
     * @param location the API model InputLocation to convert from
     */
    public InputLocation(org.apache.maven.api.model.InputLocation location) {
        this.lineNumber = location.getLineNumber();
        this.columnNumber = location.getColumnNumber();
        this.source = location.getSource() != null ? new InputSource(location.getSource()) : null;