* kubectl port-forward now allows using resource name (e.g., deployment/www) to select a matching pod, as well as the use of --pod-running-timeout to wait until at least one pod is running. ([#59705](https://github.com/kubernetes/kubernetes/pull/59705), [@phsiao](https://github.com/phsiao))

s3-object-lambda.sa-east-1.amazonaws.com
s3-object-lambda.us-east-1.amazonaws.com
s3-object-lambda.us-east-2.amazonaws.com
s3-object-lambda.us-gov-east-1.amazonaws.com
s3-object-lambda.us-gov-west-1.amazonaws.com
s3-object-lambda.us-west-1.amazonaws.com
s3-object-lambda.us-west-2.amazonaws.com
s3-sa-east-1.amazonaws.com
s3-us-east-2.amazonaws.com
s3-us-gov-east-1.amazonaws.com

s3-object-lambda.sa-east-1.amazonaws.com
s3-object-lambda.us-east-1.amazonaws.com
s3-object-lambda.us-east-2.amazonaws.com
s3-object-lambda.us-gov-east-1.amazonaws.com
s3-object-lambda.us-gov-west-1.amazonaws.com
s3-object-lambda.us-west-1.amazonaws.com
s3-object-lambda.us-west-2.amazonaws.com
s3-sa-east-1.amazonaws.com
s3-us-east-2.amazonaws.com
s3-us-gov-east-1.amazonaws.com

- Graduated the `LegacyServiceAccountTokenTracking` feature gate to GA. The usage of auto-generated secret-based service account token now produces warnings, and relevant Secrets are labeled with a last-used timestamp (label key `kubernetes.io/legacy-token-last-used`). ([#117591](https://github.com/kubernetes/kubernetes/pull/117591), [@zshihang](https://github.com/zshihang)) [SIG API Machinery, Auth and Testing]

### kubectl

#### New Commands
- `apply set-last-applied` *updates the applied-applied-configuration annotation* ([#41694](https://github.com/kubernetes/kubernetes/pull/41694), [@shiywang](https://github.com/shiywang))

s3-fips.us-east-1.amazonaws.com
s3-object-lambda.us-east-1.amazonaws.com
s3-website.us-east-1.amazonaws.com
s3.dualstack.us-east-2.amazonaws.com
s3-accesspoint.dualstack.us-east-2.amazonaws.com
s3-accesspoint-fips.dualstack.us-east-2.amazonaws.com
s3-fips.dualstack.us-east-2.amazonaws.com
s3-website.dualstack.us-east-2.amazonaws.com
s3.us-east-2.amazonaws.com
s3-accesspoint.us-east-2.amazonaws.com

    @Size(max = 1000)
    public String id;

    /**
     * The username of the user who last updated this elevate word configuration.
     * Used for audit trail purposes to track who made changes.
     */
    @Size(max = 1000)
    public String updatedBy;

    /**
     * The timestamp when this elevate word configuration was last updated.
     * Stored as a long value representing milliseconds since epoch.

    @Size(max = 1000)
    public String id;

    /**
     * The username of the user who last updated this request header configuration.
     * Used for audit trail purposes to track who made changes.
     */
    @Size(max = 1000)
    public String updatedBy;

    /**
     * The timestamp when this request header configuration was last updated.
     * Stored as a long value representing milliseconds since epoch.

   * The response headers corresponding to a pushed request.  When [last] is true, there are
   * no data frames to follow.
   *
   * @param streamId server-initiated stream ID: an even number.
   * @param responseHeaders minimally includes `:status`.
   * @param last when true, there is no response data.
   */
  fun onHeaders(
    streamId: Int,
    responseHeaders: List<Header>,
    last: Boolean,
  ): Boolean

  /**

        return first;
    }

    /**
     * Removes the last element.
     *
     * @return the last element
     */
    public E removeLast() {
        if (isEmpty()) {
            throw new NoSuchElementException();
        }
        final E last = header.previous.element;
        header.previous.remove();
        return last;
    }

    /**
     * Adds an element at the beginning.