* kube-apiserver learned the '--anonymous-auth' flag, which defaults to true. When enabled, requests to the secure port that are not rejected by other configured authentication methods are treated as anonymous requests, and given a username of 'system:anonymous' and a group of 'system:unauthenticated'.
  * Authenticated users are decorated with a 'system:authenticated' group.

    /**
     * Creates an HTTP client for connecting to the search engine.
     *
     * @param fessConfig the Fess configuration
     * @param host       the search engine host address
     * @return the configured HTTP client
     */
    protected Client createHttpClient(final FessConfig fessConfig, final String host) {
        final String[] hosts =

    )
    executeSynchronously("/")
      .assertFailure(SSLHandshakeException::class.java)
  }

  @Test
  fun cleartextCallsFailWhenCleartextIsDisabled() {
    // Configure the client with only TLS configurations. No cleartext!
    client =
      client
        .newBuilder()
        .connectionSpecs(listOf(ConnectionSpec.MODERN_TLS, ConnectionSpec.COMPATIBLE_TLS))
        .build()

* Fix issue in converting AWS volume ID from mount paths ([#36840](https://github.com/kubernetes/kubernetes/pull/36840), [@jingxu97](https://github.com/jingxu97))
* Correct env var name in configure-helper ([#33848](https://github.com/kubernetes/kubernetes/pull/33848), [@mtaufen](https://github.com/mtaufen))

      MockResponse
        .Builder()
        .inTunnel()
        .body("bogus proxy connect response content")
        .build(),
    )
    server.enqueue(MockResponse(body = "response"))

    // Configure a single IP address for the host and a single configuration, so we only need one
    // failure to fail permanently.
    client =
      client
        .newBuilder()
        .sslSocketFactory(