* kube-apiserver: the OpenID Connect authenticator can now verify ID Tokens signed with JOSE algorithms other than RS256 through the --oidc-signing-algs flag. ([#58544](https://github.com/kubernetes/kubernetes/pull/58544), [@ericchiang](https://github.com/ericchiang))

			exit(stopProcess())
		case osSignal := <-globalOSSignalCh:
			logger.Info("Exiting on signal: %s", strings.ToUpper(osSignal.String()))
			daemon.SdNotify(false, daemon.SdNotifyStopping)
			exit(stopProcess())
		case signal := <-globalServiceSignalCh:
			switch signal {
			case serviceRestart:
				logger.Info("Restarting on service signal")
				daemon.SdNotify(false, daemon.SdNotifyReloading)
				stop := stopProcess()

    private set
  private var timeoutEarlyExit = false

  /**
   * This is the same value as [exchange], but scoped to the execution of the network interceptors.
   * The [exchange] field is assigned to null when its streams end, which may be before or after the
   * network interceptors return.
   */
  internal var interceptorScopedExchange: Exchange? = null
    private set

 * ⬜️ [Moshi](https://github.com/square/moshi): A modern JSON library for Android and Java.
 * [Ok2Curl](https://github.com/mrmike/Ok2Curl): Convert OkHttp requests into curl logs.
 * [OkHttp AWS Signer](https://github.com/babbel/okhttp-aws-signer): AWS V4 signing algorithm for OkHttp requests
 * [okhttp-digest](https://github.com/rburgst/okhttp-digest): A digest authenticator for OkHttp.

- Kubeadm: during execution of the "check expiration" command, treat the etcd CA as external if there is a missing etcd CA key file (etcd/ca.key) and perform the proper validation on certificates signed by the etcd CA. Additionally, make sure that the CA for all entries in the output table is included - for both certificates on disk and in kubeconfig files. ([#106925](https://github.com/kubernetes/kubernetes/pull/106925), [@neolit123](https://gi...

pkg syscall (freebsd-386-cgo), type SysProcAttr struct, Pdeathsig Signal
pkg syscall (freebsd-amd64), type SysProcAttr struct, Pdeathsig Signal
pkg syscall (freebsd-amd64-cgo), type SysProcAttr struct, Pdeathsig Signal
pkg syscall (freebsd-arm), type SysProcAttr struct, Pdeathsig Signal
pkg syscall (freebsd-arm-cgo), type SysProcAttr struct, Pdeathsig Signal

        String aligned = new DefaultPathTranslator().alignToBaseDirectory("${basedir}", basedir);

        assertEquals(basedir.getAbsolutePath(), aligned);
    }

    @Test
    void testAlignToBasedirWhereBasedirExpressionIsTheValuePrefix() {
        File basedir = new File(System.getProperty("java.io.tmpdir"), "test").getAbsoluteFile();

        uses: actions/stale@28ca1036281a5e5922ead5184a1bbf96e5fc984e # v9.0.0
        with:
          #Comma separated list of labels that can be assigned to issues to exclude them from being marked as stale
          exempt-issue-labels: 'override-stale'
          #Comma separated list of labels that can be assigned to PRs to exclude them from being marked as stale
          exempt-pr-labels: "override-stale"

        .certificateAuthority(1)
        .build()
    val clientIntermediate =
      HeldCertificate.Builder()
        .certificateAuthority(0)
        .signedBy(clientRoot)
        .build()
    val clientCertificate =
      HeldCertificate.Builder()
        .signedBy(clientIntermediate)
        .build()
    val serverRoot =
      HeldCertificate.Builder()
        .certificateAuthority(1)
        .build()

- The kube-controller-manager managed signers can now have distinct signing certificates and keys.  See the help about `--cluster-signing-[signer-name]-{cert,key}-file`.  `--cluster-signing-{cert,key}-file` is still the default. ([#90822](https://github.com/kubernetes/kubernetes/pull/90822), [@deads2k](https://github.com/deads2k)) [SIG API Machinery,...