pkg syscall (darwin-arm64), const SYS_CLOSE_NOCANCEL ideal-int
pkg syscall (darwin-arm64), const SYS_CONNECT = 98
pkg syscall (darwin-arm64), const SYS_CONNECT ideal-int
pkg syscall (darwin-arm64), const SYS_CONNECT_NOCANCEL = 409
pkg syscall (darwin-arm64), const SYS_CONNECT_NOCANCEL ideal-int
pkg syscall (darwin-arm64), const SYS_COPYFILE = 227
pkg syscall (darwin-arm64), const SYS_COPYFILE ideal-int

- kube-apiserver: setting a `dryRun` query parameter on a CONNECT request will now cause the request to be rejected, consistent with behavior of other mutating API requests. Examples of CONNECT APIs are the `nodes/proxy`, `services/proxy`, `pods/proxy`, `pods/exec`, and `pods/attach` subresources. Note that this prevents sending a `dryRun` parameter to backends via `{nodes,...

pkg syscall (netbsd-arm64-cgo), const SYS_CLOSE = 6
pkg syscall (netbsd-arm64-cgo), const SYS_CLOSE ideal-int
pkg syscall (netbsd-arm64-cgo), const SYS_CONNECT = 98
pkg syscall (netbsd-arm64-cgo), const SYS_CONNECT ideal-int
pkg syscall (netbsd-arm64-cgo), const SYSCTL_VERS_0 = 0
pkg syscall (netbsd-arm64-cgo), const SYSCTL_VERS_0 ideal-int
pkg syscall (netbsd-arm64-cgo), const SYSCTL_VERS_1 = 16777216

  // More info: https://examples.k8s.io/mysql-cinder-pd/README.md
  // +optional
  optional bool readOnly = 3;

  // secretRef is Optional: points to a secret object containing parameters used to connect
  // to OpenStack.
  // +optional
  optional SecretReference secretRef = 4;
}

// Represents a cinder volume resource in Openstack.
// A Cinder volume must exist before mounting to a container.

* kube-apiserver: the OpenID Connect authenticator can now verify ID Tokens signed with JOSE algorithms other than RS256 through the --oidc-signing-algs flag. ([#58544](https://github.com/kubernetes/kubernetes/pull/58544), [@ericchiang](https://github.com/ericchiang))

### Auth

- Fixed OpenID Connect (OIDC) token refresh when the client secret contains a special character. ([#76914](https://github.com/kubernetes/kubernetes/pull/76914), [@tsuna](https://github.com/tsuna))

* API server authentication now caches successful bearer token authentication results for a few seconds. ([#50258](https://github.com/kubernetes/kubernetes/pull/50258), [@liggitt](https://github.com/liggitt))

    * A distributed claim allows the OIDC provider to delegate a claim to a
    * separate URL.  Distributed claims are of the form as seen below, and are
    * defined in the OIDC Connect Core 1.0, section 5.6.2.
    * For details, see:
    * http://openid.net/specs/openid-connect-core-1_0.html#AggregatedDistributedClaims

* The OpenID Connect authenticator can now use a custom prefix, or omit the default prefix, for username and groups claims through the --oidc-username-prefix and --oidc-groups-prefix flags. For example, the authenticator can map a user with the username "jane" to "google:jane"...

* Support whitespace in command path for gcp auth plugin ([#41653](https://github.com/kubernetes/kubernetes/pull/41653), [@jlowdermilk](https://github.com/jlowdermilk))
* client-go no longer imports GCP OAuth2 and OpenID Connect packages by default. ([#41532](https://github.com/kubernetes/kubernetes/pull/41532), [@ericchiang](https://github.com/ericchiang))