- Graduated the `LegacyServiceAccountTokenTracking` feature gate to GA. The usage of auto-generated secret-based service account token now produces warnings, and relevant Secrets are labeled with a last-used timestamp (label key `kubernetes.io/legacy-token-last-used`). ([#117591](https://github.com/kubernetes/kubernetes/pull/117591), [...

### Failing Test

- Fixes the `should receive events on concurrent watches in same order` conformance test to work properly on clusters that auto-create additional configmaps in namespaces ([#101950](https://github.com/kubernetes/kubernetes/pull/101950), [@liggitt](https://github.com/liggitt)) [SIG API Machinery and Testing]

### Bug or Regression

#### AWS

* Fix container hostPid settings when CRI is enabled. ([#44116](https://github.com/kubernetes/kubernetes/pull/44116), [@feiskyer](https://github.com/feiskyer))
* RBAC role and rolebinding auto-reconciliation is now performed only when the RBAC authorization mode is enabled. ([#43813](https://github.com/kubernetes/kubernetes/pull/43813), [@liggitt](https://github.com/liggitt))

* client-go: shortens refresh period for token files to 1 minute to ensure auto-rotated projected service account tokens are read frequently enough. ([#72437](https://github.com/kubernetes/kubernetes/pull/72437), [@liggitt](https://github.com/liggitt))

- Make sure auto-mounted subpath mount source is already mounted ([#112499](https://github.com/kubernetes/kubernetes/pull/112499), [@andyzhangx](https://github.com/andyzhangx)) [SIG Storage]

## Dependencies

### Added

- KMS: added validation for duplicate kms config name when auto reload is enabled. If you enabled automatic reload of encryption configuration with API server flag `--encryption-provider-config-automatic-reload`, ensure all the KMS provider names (v1 and v2) in the encryption configuration are unique. ([#11369...

1F6F7..1F6F8  ; valid                  ;      ; NV8    # 10.0 SLED..FLYING SAUCER
1F6F9         ; valid                  ;      ; NV8    # 11.0 SKATEBOARD
1F6FA         ; valid                  ;      ; NV8    # 12.0 AUTO RICKSHAW
1F6FB..1F6FC  ; valid                  ;      ; NV8    # 13.0 PICKUP TRUCK..ROLLER SKATE
1F6FD..1F6FF  ; disallowed                             # NA   <reserved-1F6FD>..<reserved-1F6FF>

   See the License for the specific language governing permissions and
   limitations under the License.
================================================================

go.opentelemetry.io/auto/sdk
https://go.opentelemetry.io/auto/sdk
----------------------------------------------------------------
                                 Apache License
                           Version 2.0, January 2004