- [aws] Fixed a bug which reduces the number of unnecessary calls to STS in the event of assume role failures in the legacy cloud provider ([#110706](https://github.com/kubernetes/kubernetes/pull/110706), [@prateekgogia](https://github.com/prateekgogia)) [SIG Cloud Provider]

## Dependencies

### Added
_Nothing has changed._

- `kube-controller-manager`: The `LegacyServiceAccountTokenCleanUp` feature gate
  is now available as alpha (off by default). When enabled, the `legacy-service-account-token-cleaner`
  controller loop removes service account token secrets that have not been used
  in the time specified by `--legacy-service-account-token-clean-up-period` (defaulting
  to one year), **and are** referenced from the `.secrets` list of a ServiceAccount

## Changelog since v1.8.0-alpha.3

### Action Required

* New GCE or GKE clusters created with `cluster/kube-up.sh` will not enable the legacy ABAC authorizer by default. If you would like to enable the legacy ABAC authorizer, export ENABLE_LEGACY_ABAC=true before running `cluster/kube-up.sh`. ([#51367](https://github.com/kubernetes/kubernetes/pull/51367), [@cjcullen](https://github.com/cjcullen))

D,EAA9CtD,YAA8CsD,EAAnCrG,QAAW4C,IAAAA,OAAQjG,IAAAA,UAChC+O,EAAgB3I,EAAUmB,KAAVnB,CAAgB,GAAhBA,EAAqB,CAArBA,WAGlBuG,EAAU,EAAVA,EACQ,CAAC,EAAD,CAAU,CAAV,EAEAqC,WAGU,MAAlBD,QACKvM,KAAOa,EAAQ,CAARA,IACPX,MAAQW,EAAQ,CAARA,GACY,OAAlB0L,QACFvM,KAAOa,EAAQ,CAARA,IACPX,MAAQW,EAAQ,CAARA,GACY,KAAlB0L,QACFrM,MAAQW,EAAQ,CAARA,IACRb,KAAOa,EAAQ,CAARA,GACa,QAAlB0L,SACFrM,MAAQW,EAAQ,CAARA,IACRb,KAAOa,EAAQ,CAARA,KAGX4C,iBChHgBhD,KAAKgM,ML1DDhM,KAAViM,QAAUjM,KAAjB8J,S5BlBD9J,KAAKkM,OkCHmB,WAAlB,QAAOrQ,OAAP,EAAqD,W...

* Add support for Azure internal load balancer. ([#45690](https://github.com/kubernetes/kubernetes/pull/45690), [@jdumars](https://github.com/jdumars))
* Fix `kubectl delete --cascade=false` for resources that don't have legacy overrides to orphan by default. ([#45713](https://github.com/kubernetes/kubernetes/pull/45713), [@kargakis](https://github.com/kargakis))

## Changelog since v1.8.0-beta.1

### Action Required

* New GCE or GKE clusters created with `cluster/kube-up.sh` will not enable the legacy ABAC authorizer by default. If you would like to enable the legacy ABAC authorizer, export ENABLE_LEGACY_ABAC=true before running `cluster/kube-up.sh`. ([#51367](https://github.com/kubernetes/kubernetes/pull/51367), [@cjcullen](https://github.com/cjcullen))

          <name>layout</name>
          <version>4.0.0+</version>
          <description>
            The type of layout this repository uses for locating and storing artifacts -
            can be {@code legacy} or {@code default}.
          </description>
          <type>String</type>
          <defaultValue>default</defaultValue>
        </field>
      </fields>
    </class>

    <class>

- Fix an issue with `kubectl` on certain older version of Windows or when legacy console mode is enabled on Windows 8 which causes `kubectl exec` to crash. ([#102825](https://github.com/kubernetes/kubernetes/pull/102825), [@n4j](https://github.com/n4j))

#### kubectl:

  * If you have to use the legacy in-tree cloud providers, you can rearrange your config like the example below. If you need the `cloud-config` file (located in `{cloud-config-path}`), you can mount it into the API Server and controller-manager containers using ExtraVolumes, as in:...