```

It is not encrypted, so, anyone could recover the information from the contents.

But it's signed. So, when you receive a token that you emitted, you can verify that you actually emitted it.

That way, you can create a token with an expiration of, let's say, 1 week. And then when the user comes back the next day with the token, you know that user is still logged in to your system.

- Updated the HPA controller so that it no longer emitted a `FailedRescale` event if a scale operation initially failed due to a conflict but succeeded after a retry; it now emitted a `SuccessfulRescale` event in this case. A `FailedRescale` event was still emitted if all retries were exhausted. ([#132007](https://github.com/kubernetes/kubernetes/pull/132007), [@AumPatel1](https://github.com/AumPatel1)) [SIG...

				// Truncate non-empty version and type matches
				if latest.header.VersionID == ver.header.VersionID {
					versions[i] = versions[i][1:]
					continue
				}
				// Skip versions with version id we already emitted.
				for _, mergedV := range merged {
					if ver.header.VersionID == mergedV.header.VersionID {
						versions[i] = versions[i][1:]
						continue
					}
				}
				// Keep top entry (and remaining)...

- Fixed a bug where kube-apiserver could emit a subsequent watch event even if the previous event failed to decrypt and was not emitted. ([#131020](https://github.com/kubernetes/kubernetes/pull/131020), [@wojtek-t](https://github.com/wojtek-t)) [SIG API Machinery and Etcd]

          logger.log("--> END ${request.method} (encoded body omitted)")
        } else if (requestBody.isDuplex()) {
          logger.log("--> END ${request.method} (duplex request body omitted)")
        } else if (requestBody.isOneShot()) {
          logger.log("--> END ${request.method} (one-shot body omitted)")
        } else {
          var buffer = Buffer()
          requestBody.writeTo(buffer)

        assertNull(parsed.getMechanism(), "mechanism should be null when omitted");
        assertNull(parsed.getMechanismToken(), "mechanism token should be null when omitted");
        assertNull(parsed.getMechanismListMIC(), "MIC should be null when omitted");
    }

    @Test
    @DisplayName("parsing malformed token throws IOException")
    void testMalformedToken() {

    // Running at time 50, the pool returns that nothing can be evicted until time 150.
    assertThat(pool.closeConnections(50L)).isEqualTo(100L)
    assertThat(pool.connectionCount()).isEqualTo(1)
    assertThat(c1.socket().isClosed).isFalse()

    // Running at time 60, the pool returns that nothing can be evicted until time 150.
    assertThat(pool.closeConnections(60L)).isEqualTo(90L)

## Changelog since v1.32.3

## Changes by Kind

### Bug or Regression

- Fix a bug where kube-apiserver could emit an further watch even even if decryption failed for earlier event and it was not emitted. ([#131159](https://github.com/kubernetes/kubernetes/pull/131159), [@wojtek-t](https://github.com/wojtek-t)) [SIG API Machinery and Etcd]

   * assume that using setCount() to increase the count is permitted iff add()
   * is permitted and similarly for decrease/remove(). We assume that a
   * setCount() no-op is permitted if either add() or remove() is permitted,
   * though we also allow it to "succeed" if neither is permitted.
   */

  private void assertSetCount(E element, int count) {
    setCountCheckReturnValue(element, count);

      .assertLogEqual("Content-Encoding: br")
      .assertLogEqual("Content-Type: text/plain; charset=utf-8")
      .assertLogMatch(Regex("""Content-Length: \d+"""))
      .assertLogEqual("<-- END HTTP (encoded body omitted)")
      .assertNoMoreLogs()
    applicationLogs
      .assertLogEqual("--> GET $url")
      .assertLogEqual("--> END GET")
      .assertLogMatch(Regex("""<-- 200 OK $url \(\d+ms\)"""))