This commit introduces support for using ECDSA P-384 as an encryption
algorithm for generating certificates and keys within kubeadm.
The following changes are included:
- Defined the `EncryptionAlgorithmECDSAP384` constant in the kubeadm API types.
- Updated API documentation to reflect the new algorithm option ("ECDSA-P384").
- Added validation for `ECDSA-P384` in the cluster configuration.
- Implemented key generation logic for ECDSA P-384 keys in `pkiutil`
(using `elliptic.P384()`).
- Added corresponding unit tests to verify the new algorithm's functionality
in `pkiutil`.
This allows users to choose ECDSA P-384 for
kubeadm-managed clusters.
When expectation is that something does *not* happen, the test has to check for
a certain time. Checking just once is not sufficient because it might not have
happened immediately.
As can be seen in the output of a test failure in the CI, the test waits for
"quota-not-terminating" to be updated, but then fails because creating the pod
exceeds the "quota-terminating" quota which has not been updated yet. As both
ResourceQuotas apply, it needs to wait for both of them to be updated.
STEP: Deleting the pod - k8s.io/kubernetes/test/e2e/apimachinery/resource_quota.go:1597 @ 05/18/25 07:50:46.531
STEP: Ensuring resource quota status released the pod usage - k8s.io/kubernetes/test/e2e/apimachinery/resource_quota.go:1601 @ 05/18/25 07:50:46.547
I0518 07:50:46.551520 75078 resource_quota.go:2508] Got expected ResourceQuota:
...
name: quota-not-terminating
namespace: scope-selectors-1836
resourceVersion: "15914"
uid: db72668e-2fe0-4543-ada2-a3ff0ac77dd5
spec:
hard:
limits.cpu: "2"
limits.memory: 1Gi
pods: "1"
requests.cpu: "1"
requests.memory: 500Mi
scopeSelector:
matchExpressions:
- operator: Exists
scopeName: NotTerminating
status:
hard:
limits.cpu: "2"
limits.memory: 1Gi
pods: "1"
requests.cpu: "1"
requests.memory: 500Mi
used:
limits.cpu: "0"
limits.memory: "0"
pods: "0"
requests.cpu: "0"
requests.memory: "0"
STEP: Creating a terminating pod - k8s.io/kubernetes/test/e2e/apimachinery/resource_quota.go:1610 @ 05/18/25 07:50:46.551
I0518 07:50:46.560944 75078 resource_quota.go:1612] Unexpected error:
<*errors.StatusError | 0xc002dba500>:
pods "terminating-pod" is forbidden: exceeded quota: quota-terminating, requested: pods=1, used: pods=1, limited: pods=1
{
ErrStatus:
code: 403
details:
kind: pods
name: terminating-pod
message: 'pods "terminating-pod" is forbidden: exceeded quota: quota-terminating,
requested: pods=1, used: pods=1, limited: pods=1'
metadata: {}
reason: Forbidden
status: Failure,
}
[FAILED] pods "terminating-pod" is forbidden: exceeded quota: quota-terminating, requested: pods=1, used: pods=1, limited: pods=1
This is meant to help debug this flake:
[It] [sig-api-machinery] ResourceQuota should verify ResourceQuota with terminating scopes through scope selectors.
[FAILED] pods "test-pod" is forbidden: exceeded quota: quota-terminating, requested: pods=1, used: pods=1, limited: pods=1
In [It] at: k8s.io/kubernetes/test/e2e/apimachinery/resource_quota.go:1572 @ 05/14/25 08:49:07.456
Dumping the ResourceQuota object each time the test progresses will
help with understanding the test and the actual behavior.
Adds a DRA e2e_node test to verify that the kubelet plugin manager
retries plugin registration when the GetInfo call fails, and
successfully registers the plugin once GetInfo succeeds.
This ensures correct recovery and registration behavior for
DRA plugins in failure scenarios.
