Kubernetes 1.36 stopped putting the subject key in spec.pkixPublicKey
for PodCertificateRequest and now sends a stub PKCS#10 request instead.
The old controller parsed the deprecated field unconditionally, so new
PCRs had pkixPublicKey=null and failed with an ASN.1 'sequence
truncated' error before any certificate could be issued.
Add a shared helper that extracts the public key from
spec.stubPKCS10Request first and falls back to spec.pkixPublicKey for
older clusters. Both pod identity and service DNS signers use that path,
so their behavior stays consistent across Kubernetes versions. Bump the
Kubernetes dependencies to expose the new field and update
controller-runtime to the matching generation.
Without this, the `ate-system` pod all fail to start due to missing
certificates.
- [x] Tests pass
- [x] Appropriate changes to documentation are included in the PR
John Howard
e1ff0ad5ff