* Fixes issue where AAD token obtained by kubectl is incompatible with on-behalf-of flow and oidc. ([#86412](https://github.com/kubernetes/kubernetes/pull/86412), [@weinong](https://github.com/weinong))
    * The audience claim before this fix has "spn:" prefix. After this fix, "spn:" prefix is omitted.

**Fixed Versions**:
  - kube-apiserver v1.29.4
  - kube-apiserver v1.28.9
  - kube-apiserver v1.27.13

This vulnerability was reported by tha3e1vl.


**CVSS Rating:** Low (2.7) [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N)

## Changes by Kind

### Feature

* Fixes issue where AAD token obtained by kubectl is incompatible with on-behalf-of flow and oidc. ([#86412](https://github.com/kubernetes/kubernetes/pull/86412), [@weinong](https://github.com/weinong))
    * The audience claim before this fix has "spn:" prefix. After this fix, "spn:" prefix is omitted.

	quarkus/extensions/kotlin/runtime/pom.xml
	quarkus/extensions/arc/runtime/pom.xml
	quarkus/test-framework/junit5-internal/pom.xml
quarkus/integration-tests/oidc-code-flow/pom.xml
	quarkus/extensions/oidc/runtime/pom.xml
	quarkus/extensions/smallrye-jwt-build/runtime/pom.xml
	quarkus/extensions/resteasy-classic/resteasy-jackson/runtime/pom.xml
	quarkus/extensions/micrometer/runtime/pom.xml

    end
    Note over dep: After yield
    opt Handle other exception
        dep -->> dep: Handle exception, can't change response. E.g. close DB session.
    end
```

The new execution flow can be found in the docs: [Execution of dependencies with `yield`](https://fastapi.tiangolo.com/tutorial/dependencies/dependencies-with-yield/#execution-of-dependencies-with-yield).

### Features

the work, and the source code for shared libraries and dynamically
linked subprograms that the work is specifically designed to require,
such as by intimate data communication or control flow between those
subprograms and other parts of the work.

  The Corresponding Source need not include anything that users
can regenerate automatically from other parts of the Corresponding
Source.

    /**
     * Get the value for the key 'rag.chat.content.fields'. <br>
     * The value is, e.g. title,url,content,doc_id,content_title,content_description <br>
     * comment: <br>
     * Enhanced RAG flow settings.<br>
     * Fields to retrieve for full document content.
     * @return The value of found property. (NotNull: if not found, exception but basically no way)
     */
    String getRagChatContentFields();

pkg go/ast, type SendStmt struct, Value Expr
pkg go/ast, type SliceExpr struct
pkg go/ast, type SliceExpr struct, High Expr
pkg go/ast, type SliceExpr struct, Lbrack token.Pos
pkg go/ast, type SliceExpr struct, Low Expr
pkg go/ast, type SliceExpr struct, Rbrack token.Pos
pkg go/ast, type SliceExpr struct, X Expr
pkg go/ast, type Spec interface, End() token.Pos
pkg go/ast, type Spec interface, Pos() token.Pos