* OIDC authentication now allows tokens without an "email_verified" claim when using the "email" claim. If an "email_verified" claim is present when using the "email" claim, it must be `true`. ([#61508](https://github.com/kubernetes/kubernetes/pull/61508), [@rithujohn191](https://github.com/rithujohn191))

globo

// gmail : Charleston Road Registry Inc.
// https://www.iana.org/domains/root/db/gmail.html
gmail

// gmbh : Binky Moon, LLC
// https://www.iana.org/domains/root/db/gmbh.html
gmbh

// gmo : GMO Internet, Inc.
// https://www.iana.org/domains/root/db/gmo.html
gmo

// gmx : 1&1 Mail & Media GmbH
// https://www.iana.org/domains/root/db/gmx.html

- When configuring a JWT authenticator:
  
  If `username.expression` used 'claims.email', then 'claims.email_verified' must have been used in `username.expression` or `extra[*].valueExpression` or `claimValidationRules[*].expression`. An example claim validation rule expression that matches the validation automatically applied when `username.claim` is set to 'email' is 'claims.?email_verified.orValue(true) == true'.

  
  When configuring a JWT authenticator:
  
  If username.expression uses 'claims.email', then 'claims.email_verified' must be used in
  username.expression or extra[*].valueExpression or claimValidationRules[*].expression.
  An example claim validation rule expression that matches the validation automatically
  applied when username.claim is set to 'email' is 'claims.?email_verified.orValue(true) == true'. 

[@caesarxuchao](https://github.com/caesarxuchao))

* Using kubectl gcp auth plugin with a Google Service Account to authenticate to a cluster now additionally requests a token with the  "userinfo.email" scope. This way, users can write ClusterRoleBindings/RoleBindings with the email address of the service account directly. (This is a breaking change if the numeric uniqueIDs of the Google service accounts were being used in RBAC role bindings. The behavior can be overridden by explicitly...

* **When using OIDC authentication and specifying --oidc-username-claim=email, an `"email_verified":true` claim must be returned from the identity provider. ([#36087](https://github.com/kubernetes/kubernetes/pull/36087), [@ericchiang](https://github.com/ericchiang))**

    }

    public void setMail_Equal(String mail) {
        setMail_Term(mail, null);
    }

    public void setMail_Equal(String mail, ConditionOptionCall<TermQueryBuilder> opLambda) {
        setMail_Term(mail, opLambda);
    }

    public void setMail_Term(String mail) {
        setMail_Term(mail, null);
    }

    public void setMail_Term(String mail, ConditionOptionCall<TermQueryBuilder> opLambda) {

\u0007doomdns\u0006dopaas\u0008drayddns\u000cdreamhosters\u000edrive-platform\u0007dsmynas\u0007durumis\ndyn-o-saur\u0008dynalias\u000edyndns-at-home\u000edyndns-at-work\u000bdyndns-blog\u000bdyndns-free\u000bdyndns-home\u0009dyndns-ip\u000bdyndns-mail\rdyndns-office\u000bdyndns-pics\rdyndns-remote\rdyndns-server\ndyndns-web\u000bdyndns-wiki\u000bdyndns-work\u0005dynns\u0008dynuddns\u000bdynuhosting\u0010elasticbeanstalk\remergentagent\u0009encoreapi\u000fest-a-la-maison\u000fest-a-la-masion\res...