## Known Issues

- If kubelet plugin registration for a driver fails, kubelet will not retry. The driver must delete and recreate the driver registration socket in order to force kubelet to attempt registration again. Restarting only the driver container may not be sufficient to trigger recreation of the socket, instead a pod restart may be required. ([#71487](https://github.com/kubernetes/kubernetes/issues/71487))

### SIG CLI

* You can now use the `base64decode` function in kubectl go templates to decode base64-encoded data, such as `kubectl get secret SECRET -o go-template='{{ .data.KEY | base64decode }}'`. ([#60755](https://github.com/kubernetes/kubernetes/pull/60755), [@glb](https://github.com/glb))

### CVE-2023-2728: Bypassing enforce mountable secrets policy imposed by the ServiceAccount admission plugin

pkg syscall (darwin-arm64), const SYS_SIGSUSPEND_NOCANCEL = 410
pkg syscall (darwin-arm64), const SYS_SIGSUSPEND_NOCANCEL ideal-int
pkg syscall (darwin-arm64), const SYS_SOCKET = 97
pkg syscall (darwin-arm64), const SYS_SOCKET ideal-int
pkg syscall (darwin-arm64), const SYS_SOCKETPAIR = 135
pkg syscall (darwin-arm64), const SYS_SOCKETPAIR ideal-int
pkg syscall (darwin-arm64), const SYS_STACK_SNAPSHOT = 365

### Promoted CRD Validation Expression Language to Beta

improves the security posture in the mounting process where the volumes are ACL’ed on the pods’ service account without handing out unnecessary permissions to the CSI drivers’ service account. This feature is especially important for secret-handling CSI drivers, such as the secrets-store-csi-driver. Since these tokens can be rotated and short-lived, this feature also provides a knob for CSI drivers to receive `NodePublishVolume` RPC calls periodically with the new token. This knob is also useful when volumes...

- Existing InTree AzureFile PVs which don't have a secret namespace defined will now work properly after enabling CSI migration - the namespace will be obtained from ClaimRef. ([#108000](https://github.com/kubernetes/kubernetes/pull/108000), [@RomanBednar](https://github.com/RomanBednar)) [SIG Cloud Provider...

 - Kubeadm: the flag `--cri-socket` is no longer allowed in a mixture with the flag `--config`. Please use the kubeadm configuration for setting the CRI socket for a node using `{Init|Join}Configuration.nodeRegistration.criSocket`. ([#101600](https://github.com/kubernetes/kubernetes/pull/101600), [@KofClubs](https://github.com/KofClubs))

  // sensitive information to pass to the CSI driver to complete the CSI
  // ControllerExpandVolume call.
  // This field is optional, and may be empty if no secret is required. If the
  // secret object contains more than one secret, all secrets are passed.
  // +optional
  optional SecretReference controllerExpandSecretRef = 9;

  // nodeExpandSecretRef is a reference to the secret object containing

pkg syscall (netbsd-arm64-cgo), const SYS___SIGTIMEDWAIT = 431
pkg syscall (netbsd-arm64-cgo), const SYS___SIGTIMEDWAIT ideal-int
pkg syscall (netbsd-arm64-cgo), const SYS_SOCKET = 394
pkg syscall (netbsd-arm64-cgo), const SYS_SOCKET ideal-int
pkg syscall (netbsd-arm64-cgo), const SYS_SOCKETPAIR = 135
pkg syscall (netbsd-arm64-cgo), const SYS_SOCKETPAIR ideal-int
pkg syscall (netbsd-arm64-cgo), const SYS_SSTK = 70