- Secure serving on port 10258 to cloud-controller-manager (configurable via `--secure-port`) is now enabled. Delegated authentication and authorization are to be configured using the same flags as for aggregated API servers. Without configuration, the secure port will only allow access to `/healthz`. ([#67069](https://github.com/kubernetes/kubernetes/pull/67069),...

        return super.configureSocket(sslSocket)
      }
    }
  }

  private class RecordingSSLSocketFactory(
    delegate: SSLSocketFactory,
  ) : DelegatingSSLSocketFactory(delegate) {
    val socketsCreated = mutableListOf<SSLSocket>()

    override fun configureSocket(sslSocket: SSLSocket): SSLSocket {
      socketsCreated.add(sslSocket)

    shared a single HTTP engine between two frontend APIs: `HttpURLConnection`
    and `Call`. With this release we’ve rearranged things so that the
    `HttpURLConnection` frontend now delegates to the `Call` APIs internally.
    This has enabled substantial simplifications and optimizations in the OkHttp
    core for both frontends.

    For most HTTP requests the consequences of this change will be negligible.

- `system:kube-controller-manager` and `system:kube-scheduler` users are now permitted to perform delegated authentication/authorization checks by default RBAC policy ([#72491](https://github.com/kubernetes/kubernetes/pull/72491), [@liggitt](https://github.com/liggitt))

    createNewCache()
  }

  @AfterEach fun tearDown() {
    while (!toClose.isEmpty()) {
      toClose.pop().close()
    }
    taskFaker.close()

    (filesystem.delegate as? FakeFileSystem)?.checkNoOpenFiles()
  }

  @ParameterizedTest
  @ArgumentsSource(FileSystemParamProvider::class)
  fun emptyCache(parameters: Pair<FileSystem, Boolean>) {

- Fix the overestimated cost of delegated API requests in kube-apiserver API priority&fairness ([#109216](https://github.com/kubernetes/kubernetes/pull/109216), [@wojtek-t](https://github.com/wojtek-t)) [SIG API Machinery]

* Authors of aggregated API servers must not rely on authorization being done by the kube-apiserver, and must do delegated authorization in addition. ([#61349](https://github.com/kubernetes/kubernetes/pull/61349), [@sttts](https://github.com/sttts))

	// it is denied by the plugin.
	c.mustNotUpload(ctx, s.getUserClient(c, cr.AccessKey, cr.SecretKey, ""), bucket)

	// Check that session policies do not apply - as policy enforcement is
	// delegated to plugin.
	{
		svcAK, svcSK := mustGenerateCredentials(c)

		// This policy does not allow listing objects.
		policyBytes := []byte(fmt.Sprintf(`{
 "Version": "2012-10-17",
 "Statement": [
  {

        return getDelegate().isChildProjectUrlInheritAppendPath();
    }

    public void setChildProjectUrlInheritAppendPath(boolean childProjectUrlInheritAppendPath) {
        delegate = getDelegate().withChildProjectUrlInheritAppendPath(String.valueOf(childProjectUrlInheritAppendPath));
    }

            ]]>
          </code>
        </codeSegment>
        <codeSegment>

- New addon in addon manager that automatically installs CSI CRDs if CSIDriverRegistry or CSINodeInfo feature gates are true. ([#70193](https://github.com/kubernetes/kubernetes/pull/70193), [@saad-ali](https://github.com/saad-ali))
- Delegated authorization can now allow unrestricted access for `system:masters` like the main kube-apiserver ([#70671](https://github.com/kubernetes/kubernetes/pull/70671), [@deads2k](https://github.com/deads2k))