- kube-apiserver: `--service-account-max-token-expiration` can now be used in combination with an external token signer `--service-account-signing-endpoint`, as long as the `--service-account-max-token-expiration` is not longer than the external token signer's max expiration. ([#129816](https://github.com/kubernetes/kubernetes/pull/129816), [@sambdavidson](https://github.com/sambdavidson)) [SIG...

        v.add(new DERTaggedObject(true, 2, new DERBitString(new byte[] { apOptions }))); // first byte read by impl
        return new DERSequence(v);
    }

    @Test
    @DisplayName("byte[] ctor: empty token throws PACDecodingException with clear message")
    void byteArrayConstructor_emptyToken_throws() {
        // Arrange
        byte[] empty = new byte[0];

        // Act + Assert

errors.failed_to_download_mapping_file = Failed to download a mapping file.
errors.failed_to_upload_mapping_file = Failed to upload a mapping file.
errors.invalid_kuromoji_token={0} is invalid as a token.
errors.invalid_kuromoji_segmentation=The number of segmentation for {0} and {1} is different.
errors.invalid_str_is_included = {1} is invalid for {0}.
errors.blank_password = Password is required.

errors.failed_to_download_mapping_file = Failed to download a mapping file.
errors.failed_to_upload_mapping_file = Failed to upload a mapping file.
errors.invalid_kuromoji_token={0} is invalid as a token.
errors.invalid_kuromoji_segmentation=The number of segmentation for {0} and {1} is different.
errors.invalid_str_is_included = {1} is invalid for {0}.
errors.blank_password = Password is required.

errors.failed_to_download_mapping_file = Kan mappingbestand niet downloaden.
errors.failed_to_upload_mapping_file = Kan mappingbestand niet uploaden.
errors.invalid_kuromoji_token={0} is geen geldig token.
errors.invalid_kuromoji_segmentation=Het aantal segmentaties van {0} komt niet overeen met het aantal segmentaties van {1}.
errors.invalid_str_is_included = {1} is ongeldig in {0}.
errors.blank_password = Wachtwoord is vereist.

- Fixes service account token admission error in clusters that do not run the service account token controller ([#87029](https://github.com/kubernetes/kubernetes/pull/87029), [@liggitt](https://github.com/liggitt)) [SIG Auth]

errors.failed_to_download_mapping_file = Impossibile scaricare il file di mappatura.
errors.failed_to_upload_mapping_file = Impossibile caricare il file di mappatura.
errors.invalid_kuromoji_token={0} non è un token valido.
errors.invalid_kuromoji_segmentation=Il numero di segmentazioni di {0} non corrisponde al numero di segmentazioni di {1}.
errors.invalid_str_is_included = {0} non è valido in {1}.

  * All communication is now over TLS
  * Authorization plugins can be installed by kubeadm, including the new default of RBAC
  * The bootstrap token system now allows token management and expiration
* The [`kubefed` federation bootstrap tool](https://kubernetes.io/docs/tutorials/federation/set-up-cluster-federation-kubefed/) has also graduated to beta.

- Kube-apiserver can now specify `--authentication-token-webhook-version=v1` or `--authorization-webhook-version=v1` to use `v1` TokenReview and SubjectAccessReview API objects when communicating with authentication and authorization webhooks. ([#84768](https://github.com/kubernetes/kubernetes/pull/84768), [@liggitt](https://github.com/liggitt))

                return appValue.get();
            }

            @Override
            public String getAppEncryptPropertyPattern() {
                return ".*password|.*key|.*token|.*secret";
            }
        });
        final String now = String.valueOf(System.currentTimeMillis());
        helper.updateSystemProperties();
        assertNull(System.getProperty("fess." + now));