* The AWS credential provider can now obtain ECR credentials even without the AWS cloud provider or being on an EC2 instance. Additionally, AWS credential provider caching has been improved to honor the ECR credential timeout. ([#75587](https://github.com/kubernetes/kubernetes/pull/75587), [@tiffanyfay](https://github.com/tiffanyfay))

- Updated cri-tools to v1.32.0. ([#129116](https://github.com/kubernetes/kubernetes/pull/129116), [@saschagrunert](https://github.com/saschagrunert)) [SIG Cloud Provider]
- Upgrade CoreDNS to v1.12.0 ([#128926](https://github.com/kubernetes/kubernetes/pull/128926), [@bzsuni](https://github.com/bzsuni)) [SIG Cloud Provider and Cluster Lifecycle]

## Dependencies

### Added

- Fix: do not delete the lb that does not exist (#105777, @nilo19) [SIG Cloud Provider]
- Fix: ignore not a VMSS error for VMAS nodes in EnsureBackendPoolDeleted. (#105185, @ialidzhikov) [SIG Cloud Provider]
- Fix: leave the probe path empty for TCP probes (#105253, @nilo19) [SIG Cloud Provider]

- Fix: ignore the case when updating Azure tags (#104686, @nilo19) [SIG Cloud Provider]
- Revert PR #102925 which introduced unexpected scheduling behavior based on balanced resource allocation (#105238, @damemi) [SIG Scheduling]
- Updates golang.org/x/text to v0.3.6 to fix CVE-2020-28852 (#102601, @jonesbr17) [SIG API Machinery, CLI, Cloud Provider, Cluster Lifecycle, Instrumentation, Node and Storage]

*   The default `auto-detect` behavior of the kubelet's `--cloud-provider` flag is removed.
    *   You can manually set `--cloud-provider=auto-detect`, but be aware that this behavior will be removed completely in a future version.
    *   Best practice for version 1.9 and future versions is to explicitly set a cloud-provider. See [the documentation](https://kubernetes.io/docs/getting-started-guides/scratch/#cloud-providers)

SIG-VMware development was primarily focused on fixing bugs for the in-tree cloud provider, starting the development of the external cloud provider and taking ownership of the cluster-api provider for vSphere.

In-tree cloud provider bug fixes and improvements included:
- Adding initial Zones support to the provider using vSphere Tags
- Improving the testing harness for the cloud provider by introducing vcsim for automated testing

 * <p>
 * A type can be marked {@link Consumer} or {@link Provider} but not both. A type is assumed to be
 * {@link Consumer} if it is not marked either {@link Consumer} or {@link Provider}.
 * <p>
 * A package can be marked {@link Provider}. In this case, all types in the package are considered
 * to be a provider type regardless of whether they are marked {@link Consumer} or {@link Provider}.
 *
 * @see Consumer
 * @since 4.0.0
 */

var (
	ErrNotImplemented     = errors.New("function not implemented")
	ErrAccessTokenExpired = errors.New("access_token expired or unauthorized")
)

// Provider implements identity provider specific admin operations, such as
// looking up users, fetching additional attributes etc.
type Provider interface {
	LoginWithUser(username, password string) error
	LoginWithClientID(clientID, clientSecret string) error
	LookupUser(userid string) (User, error)

- The Kubelet's `--cloud-provider` and `--cloud-config` options are now marked as deprecated. ([#90408](https://github.com/kubernetes/kubernetes/pull/90408), [@knabben](https://github.com/knabben)) [SIG Cloud Provider and Node]

	}

	return madmin.BuiltinProvider // default to internal
}

// getProviderInfoFromClaims - returns the provider info from the claims.
func populateProviderInfoFromClaims(claims map[string]any, provider string, resp *madmin.InfoAccessKeyResp) {
	resp.UserProvider = provider
	switch provider {
	case madmin.LDAPProvider:
		resp.LDAPSpecificInfo = getLDAPInfoFromClaims(claims)
	case madmin.OpenIDProvider: