### External credential providers

feature gate `DisableKubeletCloudCredentialProviders` which allows disabling the in-tree kubelet credential providers.
  
  The feature gate `DisableKubeletCloudCredentialProviders` is currently in Alpha, which means is currently disabled by default. Once this feature gate moves to beta, in-tree credential providers will be disabled by default, and users will need to migrate to use external credential providers. ([#102507](https://github.com/kubernetes/kubernetes/pull/102507), [@ostrain](ht...

natively within Kubernetes, without exposing an HTTP endpoint or
using an extra executable.

### Kubelet Credential Provider Graduates to Beta

Originally released as Alpha in Kubernetes 1.20, the kubelet's support for
[image credential providers](https://kubernetes.io/docs/tasks/kubelet-credential-provider/kubelet-credential-provider/)
has now graduated to Beta.

    authenticator has access to the full incoming response and can respond with
    whichever followup request is appropriate. The `Challenge` class is now a
    top-level class and `Credential` is replaced with a utility class called
    `Credentials`.

 *  **OkHttpClient.getFollowProtocolRedirects() renamed to
    getFollowSslRedirects()**. We reserve the word _protocol_ for the HTTP

pkg syscall (freebsd-arm64), type Cmsghdr struct, Type int32
pkg syscall (freebsd-arm64), type Credential struct
pkg syscall (freebsd-arm64), type Credential struct, Gid uint32
pkg syscall (freebsd-arm64), type Credential struct, Groups []uint32
pkg syscall (freebsd-arm64), type Credential struct, NoSetGroups bool
pkg syscall (freebsd-arm64), type Credential struct, Uid uint32
pkg syscall (freebsd-arm64), type Dirent struct

pkg syscall (darwin-arm64), type Cmsghdr struct, Type int32
pkg syscall (darwin-arm64), type Credential struct
pkg syscall (darwin-arm64), type Credential struct, Gid uint32
pkg syscall (darwin-arm64), type Credential struct, Groups []uint32
pkg syscall (darwin-arm64), type Credential struct, NoSetGroups bool
pkg syscall (darwin-arm64), type Credential struct, Uid uint32
pkg syscall (darwin-arm64), type Dirent struct

pkg syscall (netbsd-arm64-cgo), type Credential struct
pkg syscall (netbsd-arm64-cgo), type Credential struct, Gid uint32
pkg syscall (netbsd-arm64-cgo), type Credential struct, Groups []uint32
pkg syscall (netbsd-arm64-cgo), type Credential struct, NoSetGroups bool
pkg syscall (netbsd-arm64-cgo), type Credential struct, Uid uint32
pkg syscall (netbsd-arm64-cgo), type Dirent struct

- Expanded the on-disk kubelet credential provider configuration to allow an optional `tokenAttribute` field to be configured. When it is set, the kubelet will provision a token with the given audience bound to the current pod and its service account. This KSA token along with required annotations on the KSA defined in configuration will be sent to the credential provider plugin via its standard input (along with the image information that is already...

- The AWS credential provider can now obtain ECR credentials even without the AWS cloud provider or being on an EC2 instance. Additionally, AWS credential provider caching has been improved to honor the ECR credential timeout. ([#75587](https://github.com/kubernetes/kubernetes/pull/75587), [@tiffanyfay](https://github.com/tiffanyfay))

//
// Service accounts are replicated as long as they are not meant for the root
// user.
//
// STS accounts are replicated, but only if the session token is verifiable
// using the local cluster's root credential.
func (c *SiteReplicationSys) IAMChangeHook(ctx context.Context, item madmin.SRIAMItem) error {
	// The IAM item has already been applied to the local cluster at this