/pilot/pkg/security/                                             @istio/wg-security-maintainers
/pilot/pkg/config/                                               @istio/wg-networking-maintainers
/pilot/pkg/networking/plugin/authn/                              @istio/wg-security-maintainers
/pilot/pkg/networking/plugin/authz/                              @istio/wg-security-maintainers

the room.  The cook threw a frying-pan after her as she went out,
but it just missed her.

  Alice caught the baby with some difficulty, as it was a queer-
shaped little creature, and held out its arms and legs in all
directions, `just like a star-fish,' thought Alice.  The poor
little thing was snorting like a steam-engine when she caught it,
and kept doubling itself up and straightening itself out again,

* delegated authn/z: optionally opt-out of mandatory authn/authz kubeconfig ([#67545](https://github.com/kubernetes/kubernetes/pull/67545), [@sttts](https://github.com/sttts))

- Apiservers based on k8s.io/apiserver with delegated authn based on cluster authentication will automatically update to new authentication information when the authoritative configmap is updated. ([#85004](https://github.com/kubernetes/kubernetes/pull/85004), [@deads2k](https://github.com/deads2k))

   ([#122612](https://github.com/kubernetes/kubernetes/pull/122612), [@mtardy](https://github.com/mtardy))

### API Change

- The following features are unconditionally...

Cancellation if implemented sensibly in both directions.
Cancelling a coroutine scope, will cancel the call.
Cancelling a call, will throw a CancellationException

AAe1oB,EAAO+C,SAC5B2lB,EACA,IAAI1oB,EAAOsmB,MAAOoC,IAGpBpM,QAAS,CACRsM,KAAM,CAGLC,UAAU,GAEXC,MAAO,CAGNxB,MAAO,SAAU1H,GAIhB,IAAIjU,EAAK3O,MAAQ4iB,EAWjB,OARKoD,GAAevY,KAAMkB,EAAGhN,OAC5BgN,EAAGmd,OAASzf,EAAUsC,EAAI,UAG1Bka,GAAgBla,EAAI,QAASuZ,KAIvB,GAERmB,QAAS,SAAUzG,GAIlB,IAAIjU,EAAK3O,MAAQ4iB,EAUjB,OAPKoD,GAAevY,KAAMkB,EAAGhN,OAC5BgN,EAAGmd,OAASzf,EAAUsC,EAAI,UAE1Bka,GAAgBla,EAAI,UAId,GAKRkY,SAAU,SAAU8B,GACnB,IAAIljB,EAASkjB,EAAMljB,OACnB,OAAOugB,GAAevY,KAAMhI,EAAO9D,OAClC8D,EAAOqmB,OAASzf,EAAU5...

  //
  // More details are available at https://k8s.io/docs/reference/access-authn-authz/certificate-signing-requests/#kubernetes-signers
  //
  // Custom signerNames can also be specified. The signer defines:
  //  1. Trust distribution: how trust (CA bundles) are distributed.

**Note**: This only impacts the cluster if the ServiceAccount admission plugin is used (most cluster should have this on by default as recommended in https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#serviceaccount), the `kubernetes.io/enforce-mountable-secrets` annotation is used by a service account (this annotation is not added by default), and Pods are using ephemeral containers.