- Fixed a regression preventing garbage collection of RBAC role and binding objects ([#90534](https://github.com/kubernetes/kubernetes/pull/90534), [@apelisse](https://github.com/apelisse)) [SIG Auth]

- Kubeadm: removed the toleration for the `node-role.kubernetes.io/master` taint from the CoreDNS deployment of `kubeadm`. With the 1.25 release of kubeadm the taint `node-role.kubernetes.io/master` is no longer applied to control plane nodes and the toleration for it can be removed with the release of 1.26. You can also perform the same toleration removal from...

- E2e framework: the `node-role.kubernetes.io/master` taint has been removed from the default value of `--non-blocking-taints` flag. You may need to set `--non-blocking-taints` explicitly if the cluster to be tested has nodes with the deprecated `node-role.kubernetes.io/master` taint. ([#118510](https://github.com/kubernetes/kubernetes/pull/118510), [@SataQiu](https://github.com/SataQiu)) [SIG...

  - The built-in `system:aws-cloud-provider` cluster role is deprecated and will not be auto-created in a future release. Deployments using the AWS...

Joe Tsai <******@****.***> 1503105518 -0700

    private User createTestUser(String username, String password) {
        User user = new User();
        user.setName(username);
        user.setPassword(password);
        user.setRoles(new String[] { "role1", "role2" });
        user.setGroups(new String[] { "group1", "group2" });
        return user;
    }

    // Test LdapManager implementation
    private static class TestLdapManager extends LdapManager {

- **Auth**
  - [alpha] Further polishing of the Role-based access control alpha API including a default set of cluster roles. ([docs](http://kubernetes.io/docs/admin/authorization/)) ([kubernetes/features#2](https://github.com/kubernetes/enhancements/issues/2))

        LabelType labelType2 = new LabelType();
        labelType2.setName("Test Label 2");
        labelType2.setValue("test2");
        labelType2.setPermissions(new String[] { "role1", "role2" });
        labelType2.setVirtualHost("example.com");
        // Locale is derived from value, not set directly
        labelType2.setIncludedPaths("/admin.*");
        labelType2.setExcludedPaths("");

Joe Tsai <******@****.***> 1503105518 -0700

- Fixed the example validation rule in godoc:
  
  When configuring a JWT authenticator:
  
  If username.expression uses 'claims.email', then 'claims.email_verified' must be used in
  username.expression or extra[*].valueExpression or claimValidationRules[*].expression.
  An example claim validation rule expression that matches the validation automatically