- Node information is now embedded into Pod-bound service account tokens as additional metadata. The 'JTI' field is set in issued service account tokens, and this information is embedded as `authentication.kubernetes.io/credential-id` in the user's ExtraInfo. ([#123135](https://github.com/kubernetes/kubernetes/pull/123135), [@munnerz](https://github.com/munnerz))...

                        .toList()
                        .listIterator(index);
            }

            @Override
            public int size() {
                return Math.toIntExact(sources().count());
            }

            @Override
            public boolean isEmpty() {
                return sources().findAny().isEmpty();
            }

            @Override

- `kube-controller-manager`: The `LegacyServiceAccountTokenCleanUp` feature gate
  is now available as alpha (off by default). When enabled, the `legacy-service-account-token-cleaner`
  controller loop removes service account token secrets that have not been used
  in the time specified by `--legacy-service-account-token-clean-up-period` (defaulting
  to one year), **and are** referenced from the `.secrets` list of a ServiceAccount

	}
	x.versions, buf, err = msgp.ReadIntBytes(buf)
	if err != nil {
		return x, buf, err
	}
	if x.versions < 0 {
		return x, buf, fmt.Errorf("decodeXLHeaders: Negative version count %d", x.versions)
	}
	return x, buf, nil
}

// decodeVersions will decode a number of versions from a buffer
// and perform a callback for each version in order, newest first.
// Any non-nil error is returned.

- Do not unmount and mount subpath bind mounts during container creation unless bind mount changes ([#105512](https://github.com/kubernetes/kubernetes/pull/105512), [@gnufied](https://github.com/gnufied)) [SIG Storage]

unprivileged pods, using the proxy to perform privileged storage operations on the node.

Another feature moving to GA in v1.22 is CSI Service Account Token support. This feature allows CSI drivers to use pods' [bound service account tokens](https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/#bound-service-account-token-volume) instead of a more privileged identity. It also provides control over to re-publishing these volumes, so that short-lived tokens can be refreshed....

				"application/vnd.gmx",
				"application/vnd.google-earth.kml+xml",
				"application/vnd.google-earth.kmz",
				"application/vnd.grafeq",
				"application/vnd.gridmp",
				"application/vnd.groove-account",
				"application/vnd.groove-help",
				"application/vnd.groove-identity-message",
				"application/vnd.groove-injector",
				"application/vnd.groove-tool-message",
				"application/vnd.groove-tool-template",

		writeErrorResponse(ctx, w, errorCodes.ToAPIErr(s3Error), r.URL)
		return
	}

	// check if client is attempting to create more buckets, complain about it.
	if currBuckets := globalBucketMetadataSys.Count(); currBuckets+1 > maxBuckets {
		internalLogIf(ctx, fmt.Errorf("Please avoid creating more buckets %d beyond recommended %d", currBuckets+1, maxBuckets), logger.WarningKind)
	}

	opts := MakeBucketOptions{

.card-img-bottom,\n  .card-group > .card:not(:first-child) .card-footer {\n    border-bottom-left-radius: 0;\n  }\n}\n\n.card-columns .card {\n  margin-bottom: 0.75rem;\n}\n\n@media (min-width: 576px) {\n  .card-columns {\n    -webkit-column-count: 3;\n    -moz-column-count: 3;\n    column-count: 3;\n    -webkit-column-gap: 1.25rem;\n    -moz-column-gap: 1.25rem;\n    column-gap: 1.25rem;\n    orphans: 1;\n    widows: 1;\n  }\n  .card-columns .card {\n    display: inline-block;\n    width: 100%;\n  }\n}\n\n.accordion...

t0[i])) // Reject if ||ct0||∞ ≥ γ2 if coefficientsExceedBo(ct0[i], γ2) { if testingOnlyRejection != nil { testingOnlyRejection("ct0") } continue sign } } count1s := 0 h := make([][n]byte, k, maxK) for i := range w { var count int h[i], count = makeHint(ct0[i], w[i], cs2[i], p) count1s += count } // Reject if number of hints > ω if count1s > p.ω { if testingOnlyRejection != nil { testingOnlyRejection("h") } continue sign } return sigEncode(ch, z, h, p) } } // testingOnlyRejection is set in tests, to ensure...