* kube-apiserver: the OpenID Connect authenticator can now verify ID Tokens signed with JOSE algorithms other than RS256 through the --oidc-signing-algs flag. ([#58544](https://github.com/kubernetes/kubernetes/pull/58544), [@ericchiang](https://github.com/ericchiang))

### Auth

- Fixed OpenID Connect (OIDC) token refresh when the client secret contains a special character. ([#76914](https://github.com/kubernetes/kubernetes/pull/76914), [@tsuna](https://github.com/tsuna))

* API server authentication now caches successful bearer token authentication results for a few seconds. ([#50258](https://github.com/kubernetes/kubernetes/pull/50258), [@liggitt](https://github.com/liggitt))

    <glob pattern="*.gmx"/>
  </mime-type>

  <mime-type type="application/vnd.google-earth.kml+xml">
    <root-XML localName="kml"/>
    <root-XML namespaceURI="http://www.opengis.net/kml/2.2" localName="kml"/>
    <root-XML namespaceURI="http://earth.google.com/kml/2.0" localName="kml"/>
    <root-XML namespaceURI="http://earth.google.com/kml/2.1" localName="kml"/>

* The OpenID Connect authenticator can now use a custom prefix, or omit the default prefix, for username and groups claims through the --oidc-username-prefix and --oidc-groups-prefix flags. For example, the authenticator can map a user with the username "jane"...