* of reads may not be immediately reflected on the algorithm's data structures. These structures
   * are guarded by a lock and operations are applied in batches to avoid lock contention. The
   * penalty of applying the batches is spread across threads so that the amortized cost is slightly
   * higher than performing just the operation without enforcing the capacity constraint.
   *

* Audit policy supports matching subresources and resource names, but the top level resource no longer matches the subresouce. For example "pods" no longer matches requests to the logs subresource of pods. Use "pods/logs" to match subresources. ([#48836](https://github.com/kubernetes/kubernetes/pull/48836), [@ericchiang](https://github.com/ericchiang))

- Fixed a bug in kube-proxy nftables mode (GA as of 1.33) that fails to determine if traffic originates from a local source on the node. The issue was caused by using the wrong meta `iif` instead of `iifname` for name based matches. ([#134117](https://github.com/kubernetes/kubernetes/pull/134117),...

                logger.debug("Silent token acquisition failed: {}", e.getMessage());
            }
            return null;
        }
    }

    /**
     * Validates that the authentication response matches the authorization code flow.
     * @param oidcResponse The OpenID Connect authentication success response.
     */
    protected void validateAuthRespMatchesCodeFlow(final AuthenticationSuccessResponse oidcResponse) {

	public fun equals (Ljava/lang/Object;)Z
	public final fun expiresAt ()J
	public fun hashCode ()I
	public final fun hostOnly ()Z
	public final fun httpOnly ()Z
	public final fun matches (Lokhttp3/HttpUrl;)Z
	public final fun name ()Ljava/lang/String;
	public final fun newBuilder ()Lokhttp3/Cookie$Builder;
	public static final fun parse (Lokhttp3/HttpUrl;Ljava/lang/String;)Lokhttp3/Cookie;

// is more efficient than decrypting ETags sequentially.
func DecryptETags(ctx context.Context, k *kms.KMS, objects []ObjectInfo) error {
	const BatchSize = 250 // We process the objects in batches - 250 is a reasonable default.
	var (
		metadata = make([]map[string]string, 0, BatchSize)
		buckets  = make([]string, 0, BatchSize)
		names    = make([]string, 0, BatchSize)
	)
	for len(objects) > 0 {

- Fixed a bug in `kube-proxy` `nftables` mode (GA as of `v1.33`) which fails to determine if traffic originates from a local source on the node. The issue was caused by using the wrong meta `iif` instead of `iifname` for name based matches. ([#134024](https://github.com/kubernetes/kubernetes/pull/134024), [@jack4it](https://github.com/jack4it))

- Fixed a bug in kube-proxy nftables mode (GA as of 1.33) that fails to determine if traffic originates from a local source on the node. The issue was caused by using the wrong meta `iif` instead of `iifname` for name based matches. ([#134118](https://github.com/kubernetes/kubernetes/pull/134118), [@jack4it](https://github.com/jack4it)) [SIG Network]

const (
	replicateMetadata replicationAction = "metadata"
	replicateNone     replicationAction = "none"
	replicateAll      replicationAction = "all"
)

// matches k1 with all keys, returns 'true' if one of them matches
func equals(k1 string, keys ...string) bool {
	for _, k2 := range keys {
		if strings.EqualFold(k1, k2) {
			return true
		}
	}
	return false
}

// actions. The permission of the parent user is checked first
func (sys *IAMSys) IsAllowedServiceAccount(args policy.Args, parentUser string) bool {
	// Verify if the parent claim matches the parentUser.
	p, ok := args.Claims[parentClaim]
	if ok {
		parentInClaim, ok := p.(string)
		if !ok {
			// Reject malformed/malicious requests.
			return false
		}