#### Fixed Versions

- kubelet v1.22.14
- kubelet v1.23.11
- kubelet v1.24.5
- kubelet v1.25.0


To upgrade, refer to this documentation _For core Kubernetes:_ https://kubernetes.io/docs/tasks/administer-cluster/cluster-management/#upgrading-a-cluster 

### Detection

Kubernetes Audit logs may indicate if the user name was misspelled to bypass the restriction placed on which user is a pod allowed to run as.

    }

    /**
     * Validate that the constructor masks the supplied value to its
     * lowest 8 bits (NdrShort incorrectly masks to 8 bits even though it's a short).
     */
    @ParameterizedTest
    @ValueSource(ints = { 0, 1, 255, -1, 256, 65535 })
    void constructorMasksValue(int input) {
        NdrShort ns = new NdrShort(input);
        // NdrShort masks to 0xFF (8 bits) in its constructor
        int expected = input & 0xFF;

- DRAAdminAccess was enabled by default allowing users to create `ResourceClaims` and `ResourceClaimTemplates` in privileged mode to grant access to devices that were in use by other users for admin tasks like monitoring health or status of the device. ([#133085](https://github.com/kubernetes/kubernetes/pull/133085), [@ritazh](https://github.com/ritazh)) [SIG Auth and Node]

        // Then
        assertNotNull(msrpcSamrConnect2, "Should handle null server name");
    }

    @Test
    @DisplayName("Should work with different access masks")
    void shouldWorkWithDifferentAccessMasks() {
        // Test with different access masks
        int[] accessMasks = { 0x00000001, // SAM_SERVER_CONNECT
                0x00000002, // SAM_SERVER_SHUTDOWN
                0x00000004, // SAM_SERVER_INITIALIZE

 - Newly provisioned PVs by EBS plugin will no longer use...

### Other (Cleanup or Flake)

- Client-go header logging (at verbosity levels >= 9) now masks `Authorization` header contents ([#95316](https://github.com/kubernetes/kubernetes/pull/95316), [@sfowl](https://github.com/sfowl)) [SIG API Machinery]

## Dependencies

### Added
_Nothing has changed._

  private val sinkBuffer: Buffer = sink.buffer
  private var writerClosed = false

  /** Lazily initialized on first use. */
  private var messageDeflater: MessageDeflater? = null

  // Masks are only a concern for client writers.
  private val maskKey: ByteArray? = if (isClient) ByteArray(4) else null
  private val maskCursor: Buffer.UnsafeCursor? = if (isClient) Buffer.UnsafeCursor() else null

            len++;
            if (len > maxLen) {
                throw new RuntimeCIFSException("zero termination not found");
            }
        }
        return len;
    }

    /**
     * Masks sensitive values in a string for security purposes.
     *
     * @param value the string potentially containing sensitive information

        [`tf.keras.layers.MultiHeadAttention`](https://www.tensorflow.org/api_docs/python/tf/keras/layers/MultiHeadAttention).
        *   Implicit masks for `query`, `key` and `value` inputs will
            automatically be used to compute a correct attention mask for the
            layer. These padding masks will be combined with any
            `attention_mask` passed in directly when calling the layer. This can
            be used with

  private val controlFrameBuffer = Buffer()
  private val messageFrameBuffer = Buffer()

  /** Lazily initialized on first use. */
  private var messageInflater: MessageInflater? = null

  // Masks are only a concern for server writers.
  private val maskKey: ByteArray? = if (isClient) null else ByteArray(4)
  private val maskCursor: Buffer.UnsafeCursor? = if (isClient) null else Buffer.UnsafeCursor()