kube-controller-manager has dropped support for the `--insecure-experimental-approve-all-kubelet-csrs-for-group` flag. It is accepted in 1.7, but ignored. Instead, the csrapproving controller uses authorization checks to determine whether to approve certificate signing requests: ([#45619](https://github.com/kubernetes/kubernetes/pull/45619), [@mikedanese](https://github.com/mikedanese))

    * Before upgrading, users must ensure their controller manager will enable the csrapproving controller, create...

- Added support to the kube-apiserver for an alpha feature enabling external signing of service account tokens and fetching of public verifying keys, by enabling the Alpha `ExternalServiceAccountTokenSigner` feature gate and specifying `--service-account-signing-endpoint`. The flag value can either be the location of a Unix domain socket on a filesystem, or be prefixed with an @ symbol and name a Unix domain socket in...

- The kube-controller-manager's deprecated `--experimental-cluster-signing-duration` flag is now removed. Adapt your machinery to use the `--cluster-signing-duration` flag that is available since v1.19. ([#108476](https://github.com/kubernetes/kubernetes/pull/108476), [@ialidzhikov](https://github.com/ialidzhikov))

* kube-apiserver: the OpenID Connect authenticator can now verify ID Tokens signed with JOSE algorithms other than RS256 through the --oidc-signing-algs flag. ([#58544](https://github.com/kubernetes/kubernetes/pull/58544), [@ericchiang](https://github.com/ericchiang))

* Removed alpha functionality that allowed the controller manager to approve kubelet server certificates. This functionality should be replaced by automating validation and approval of node server certificate signing requests. ([#62471](https://github.com/kubernetes/kubernetes/pull/62471), [@mikedanese](https://github.com/mikedanese))

#### Graduated to Stable/GA

pkg syscall (freebsd-386-cgo), const SIGCHLD Signal
pkg syscall (freebsd-386-cgo), const SIGCONT Signal
pkg syscall (freebsd-386-cgo), const SIGEMT Signal
pkg syscall (freebsd-386-cgo), const SIGINFO Signal
pkg syscall (freebsd-386-cgo), const SIGIO Signal
pkg syscall (freebsd-386-cgo), const SIGIOT Signal
pkg syscall (freebsd-386-cgo), const SIGLWP Signal
pkg syscall (freebsd-386-cgo), const SIGPROF Signal

  - [Major Themes](#major-themes)
    - [Dockershim Removed from kubelet](#dockershim-removed-from-kubelet)
    - [Beta APIs Off by Default](#beta-apis-off-by-default)
    - [Signing Release Artifacts](#signing-release-artifacts)
    - [OpenAPI v3](#openapi-v3)
    - [Storage Capacity and Volume Expansion Are Generally Available](#storage-capacity-and-volume-expansion-are-generally-available)

pkg syscall (netbsd-arm64-cgo), const SIGCONT Signal
pkg syscall (netbsd-arm64-cgo), const SIGEMT = 7
pkg syscall (netbsd-arm64-cgo), const SIGEMT Signal
pkg syscall (netbsd-arm64-cgo), const SIGINFO = 29
pkg syscall (netbsd-arm64-cgo), const SIGINFO Signal
pkg syscall (netbsd-arm64-cgo), const SIGIO = 23
pkg syscall (netbsd-arm64-cgo), const SIGIO Signal
pkg syscall (netbsd-arm64-cgo), const SIGIOT = 6

pkg syscall (freebsd-arm64), const SIGCONT Signal
pkg syscall (freebsd-arm64), const SIGEMT = 7
pkg syscall (freebsd-arm64), const SIGEMT Signal
pkg syscall (freebsd-arm64), const SIGINFO = 29
pkg syscall (freebsd-arm64), const SIGINFO Signal
pkg syscall (freebsd-arm64), const SIGIO = 23
pkg syscall (freebsd-arm64), const SIGIO Signal
pkg syscall (freebsd-arm64), const SIGIOT = 6

pkg syscall (darwin-arm64), const SIGCONT Signal
pkg syscall (darwin-arm64), const SIGEMT = 7
pkg syscall (darwin-arm64), const SIGEMT Signal
pkg syscall (darwin-arm64), const SIGINFO = 29
pkg syscall (darwin-arm64), const SIGINFO Signal
pkg syscall (darwin-arm64), const SIGIO = 23
pkg syscall (darwin-arm64), const SIGIO Signal
pkg syscall (darwin-arm64), const SIGIOT = 6
pkg syscall (darwin-arm64), const SIGIOT Signal