Client:      s.TestSuiteCommon.client,
		STSEndpoint: s.endPoint,
		GetWebIDTokenExpiry: func() (*cr.WebIdentityToken, error) {
			return &cr.WebIdentityToken{
				Token:  token,
				Expiry: 900,
			}, nil
		},
	}

	// Create policy - with name as one of the groups in OpenID the user is
	// a member of.
	policy := "projecta"
	policyTmpl := `{
 "Version": "2012-10-17",

		"Content-Encoding",
		"Content-Length",
		"Content-Type",
		"Content-Disposition",
		"Last-Modified",
		"Content-Language",
		"Cache-Control",
		"Retry-After",
		"X-Amz-Bucket-Region",
		"Expires",
		"X-Amz*",
		"X-Amz*",
		"*",
	}
	expectedMap.Set("Vary", "Origin")

	req, _ := http.NewRequest(http.MethodOptions, s.endPoint, nil)
	req.Header.Set("Origin", "http://foobar.com")

- Apiserver liveness probes will now fail when the loopback client certificate expires. ([#136477](https://github.com/kubernetes/kubernetes/pull/136477), [@everettraven](https://github.com/everettraven)) [SIG API Machinery and Testing]

pkg syscall (freebsd-386-cgo), type RoutingMessage interface, unexported methods
pkg syscall (freebsd-386-cgo), type RtMetrics struct
pkg syscall (freebsd-386-cgo), type RtMetrics struct, Expire uint32
pkg syscall (freebsd-386-cgo), type RtMetrics struct, Filler [3]uint32
pkg syscall (freebsd-386-cgo), type RtMetrics struct, Hopcount uint32
pkg syscall (freebsd-386-cgo), type RtMetrics struct, Locks uint32

- Added two client certificate metrics for exec auth:
    - `rest_client_certificate_expiration_seconds` a gauge reporting the lifetime of the current client certificate. Reports the time of expiry in seconds since January 1, 1970 UTC.

* Native support for token based bootstrap flow.  This includes signing a well known ConfigMap in the `kube-public` namespace and cleaning out expired tokens. ([#36101](https://github.com/kubernetes/kubernetes/pull/36101), [@jbeda](https://github.com/jbeda))

### ConfigMap

- Allow ImageReview backend to return annotations to be added to the created pod. ([#64597](https://github.com/kubernetes/kubernetes/pull/64597), [@wteiken](https://github.com/wteiken))

- Fixed an issue blocking azure auth to prompt to device code authentication flow when refresh token expires. ([#102063](https://github.com/kubernetes/kubernetes/pull/102063), [@tdihp](https://github.com/tdihp))

pkg syscall (netbsd-arm64-cgo), type RoutingMessage interface, unexported methods
pkg syscall (netbsd-arm64-cgo), type RtMetrics struct
pkg syscall (netbsd-arm64-cgo), type RtMetrics struct, Expire int64
pkg syscall (netbsd-arm64-cgo), type RtMetrics struct, Hopcount uint64
pkg syscall (netbsd-arm64-cgo), type RtMetrics struct, Locks uint64
pkg syscall (netbsd-arm64-cgo), type RtMetrics struct, Mtu uint64

- Kube-apiserver now deletes expired kube-apiserver Lease objects:
  - The feature is under feature gate `APIServerIdentity`.