- Fixed in-tree to CSI migration for Portworx volumes, in clusters where Portworx security feature is enabled (it's a Portworx feature, not Kubernetes feature). It required secret data from the secret mentioned in-tree SC, to be passed in CSI requests which was not happening before this fix. ([#129675](https://github.com/kubernetes/kubernetes/pull/129675), [@gohilankit](https://github.com/gohilankit)) [SIG Storage]

#include "tensorflow/core/platform/path.h"
#include "tensorflow/core/platform/protobuf.h"
#include "tensorflow/core/platform/resource_loader.h"
#include "tensorflow/core/platform/str_util.h"
#include "tensorflow/core/platform/strcat.h"
#include "tensorflow/core/platform/test.h"
#include "tensorflow/core/protobuf/error_codes.pb.h"
#include "tensorflow/core/protobuf/meta_graph.pb.h"
#include "tensorflow/core/util/equal_graph_def.h"

## Changelog since v1.20.12

## Changes by Kind

### Feature

- Update debian-base, debian-iptables, setcap images to pick up CVE fixes
  - Debian-base to v1.9.0
  - Debian-iptables to v1.6.7 (#106148, @cpanato) [SIG Release and Testing]

### Failing Test

SACHC,EAAG,SACHC,EAAG,SACHC,EAAG,SACHC,EAAG,SACHC,EAAG,SACHC,EAAG,SACHC,EAAG,UAEPqM,GAAc,CACVjM,SAAK,IACLC,SAAK,IACLC,SAAK,IACLC,SAAK,IACLC,SAAK,IACLC,SAAK,IACLC,SAAK,IACLC,SAAK,IACLC,SAAK,IACLC,SAAK,KAETyL,GAAW,CACP,sEACA,iCACA,iCACA,iCACA,iCACA,mDACA,uCACA,qBACA,6CACA,sEACA,sEACA,uEAGRv/B,EAAM0X,aAAa,KAAM,CACrBhJ,OAAQ6wB,GACR9wB,YAAa8wB,GACbttB,SAAU,+YAA0ElD,MAChF,KAEJiD,cAAe,qTAA2DjD,MACtE,KAEJgD,YAAa,mDAAgBhD,MAAM,KACnCojB,oBAAoB,EACpB5oB,eAAgB,CACZ2L,GAAI,QACJD,IAAK,WACLE,EAAG,aACHC,GAAI,cA...

nx???a!.&gro?kcabdeef,lim?moc?rrd,smrof,ten?ude?vog??3a09--nx!.&ca1o--nx?gva1c--nx?h&ca1o--nx?za09--nx??ta1d--nx?ua08--nx????b&a?b?ci?f76a0c7ylqbgm--nx?sh??c!.&eugaelysatnaf,gnipparcs,liamwt,nwaps.secnatsni,revres-emag,s&nduolc,otohpym,pparevelc,seccaptf,?xsc,?0atf7b45--nx?a1l--nx??e!.&21k?apc?b&og?up??c&isp?od??dem?e&sab,uc?yg??f&ehc?orp??g&ba?ne?ro?tkm??hcet?jol?l&a&g?iciffo,s??im?ut??m&da?oc?se??n&gd?if?o&m?rga???o&csid?fni?i&r?u??rp??pprr?qisp?r&ab?bi?tn?ut??t&al?e&n?v??n&ed?o&c?do???of?qra?...

* kubelet: resolved hang/timeout issues when running large numbers of pods with unique configmap/secret references ([#74755](https://github.com/kubernetes/kubernetes/pull/74755), [@liggitt](https://github.com/liggitt))

   ([#123343](https://github.com/kubernetes/kubernetes/pull/123343), [@haircommander](https://github.com/haircommander))
- Updated `distroless-iptables` to `v0.5.0`, debian-base to `bookworm-v1.0.1`, and setcap to `bookworm-v1.0.1`.
   ([#123170](https://github.com/kubernetes/kubernetes/pull/123170), [@cpanato](https://github.com/cpanato))
- `NewVolumeManagerReconstruction` feature is now GA.

- This release added support for `NodeExpandSecret` for CSI driver client which enables the CSI drivers to make use of this secret while performing node expansion operation based on the user request. Previously there was no secret  provided as part of the `nodeexpansion` call, thus CSI drivers did not make use of the same while expanding the volume at the node side. ([#105963](https://github.com/kubernetes/kubernetes/pull/105963),...

### Bug or Regression

- Fixed in-tree to CSI migration for Portworx volumes, in clusters where Portworx security feature is enabled (it's a Portworx feature, not Kubernetes feature). It required secret data from the secret mentioned in-tree SC, to be passed in CSI requests which was not happening before this fix. ([#129674](https://github.com/kubernetes/kubernetes/pull/129674), [@gohilankit](https://github.com/gohilankit)) [SIG Storage]

    String APP_CIPHER_KEY = "app.cipher.key";

    /** The key of the configuration. e.g. sha256 */
    String APP_DIGEST_ALGORISM = "app.digest.algorism";

    /** The key of the configuration. e.g. .*password|.*key|.*token|.*secret */
    String APP_ENCRYPT_PROPERTY_PATTERN = "app.encrypt.property.pattern";

    /** The key of the configuration. e.g.  */
    String APP_EXTENSION_NAMES = "app.extension.names";