- kube-apiserver: setting a `dryRun` query parameter on a CONNECT request will now cause the request to be rejected, consistent with behavior of other mutating API requests. Examples of CONNECT APIs are the `nodes/proxy`, `services/proxy`, `pods/proxy`, `pods/exec`, and `pods/attach` subresources. Note that this prevents sending a `dryRun` parameter to backends via `{nodes,...

* kube-apiserver: the OpenID Connect authenticator can now verify ID Tokens signed with JOSE algorithms other than RS256 through the --oidc-signing-algs flag. ([#58544](https://github.com/kubernetes/kubernetes/pull/58544), [@ericchiang](https://github.com/ericchiang))

    * A distributed claim allows the OIDC provider to delegate a claim to a
    * separate URL.  Distributed claims are of the form as seen below, and are
    * defined in the OIDC Connect Core 1.0, section 5.6.2.
    * For details, see:
    * http://openid.net/specs/openid-connect-core-1_0.html#AggregatedDistributedClaims

pkg syscall (freebsd-386-cgo), func CloseOnExec(int)
pkg syscall (freebsd-386-cgo), func CmsgLen(int) int
pkg syscall (freebsd-386-cgo), func CmsgSpace(int) int
pkg syscall (freebsd-386-cgo), func Connect(int, Sockaddr) error
pkg syscall (freebsd-386-cgo), func Dup(int) (int, error)
pkg syscall (freebsd-386-cgo), func Dup2(int, int) error
pkg syscall (freebsd-386-cgo), func Fchdir(int) error

* API server authentication now caches successful bearer token authentication results for a few seconds. ([#50258](https://github.com/kubernetes/kubernetes/pull/50258), [@liggitt](https://github.com/liggitt))

### Auth

- Fixed OpenID Connect (OIDC) token refresh when the client secret contains a special character. ([#76914](https://github.com/kubernetes/kubernetes/pull/76914), [@tsuna](https://github.com/tsuna))

          <version>4.0.0+</version>
          <description>
            <![CDATA[
            The source control management system URL
            that describes the repository and how to connect to the
            repository.
            This connection is read-only.
            <br><b>Default value is</b>: parent value [+ path adjustment] + (artifactId or project.directory property), or just parent value if

  To request this behavior, your client software must enable the `WatchListClient` client-go feature gate. Additionally, streaming is only available if supported by the cluster; the API server that you connect to must also support streaming.

* Support whitespace in command path for gcp auth plugin ([#41653](https://github.com/kubernetes/kubernetes/pull/41653), [@jlowdermilk](https://github.com/jlowdermilk))
* client-go no longer imports GCP OAuth2 and OpenID Connect packages by default. ([#41532](https://github.com/kubernetes/kubernetes/pull/41532), [@ericchiang](https://github.com/ericchiang))

pkg syscall (darwin-386), func Close(int) error
pkg syscall (darwin-386), func CloseOnExec(int)
pkg syscall (darwin-386), func CmsgLen(int) int
pkg syscall (darwin-386), func CmsgSpace(int) int
pkg syscall (darwin-386), func Connect(int, Sockaddr) error
pkg syscall (darwin-386), func Dup(int) (int, error)
pkg syscall (darwin-386), func Dup2(int, int) error
pkg syscall (darwin-386), func Exchangedata(string, string, int) error