### Deploy a more secure control plane with kubeadm

A new alpha feature allows running the kubeadm control plane components as non-root users. This is a long requested security measure in kubeadm. To try it you must enable the kubeadm-specific `RootlessControlPlane` feature gate. When you deploy a cluster using this alpha feature, your control plane runs with lower privileges.

    private DocMetaCQ docMetaCQ;

    // ===================================================================================
    //                                                                             Control
    //                                                                             =======
    public DocMetaCQ docMeta() {
        if (docMetaCQ == null) {
            docMetaCQ = new DocMetaCQ();
        }

    private DocMetaCQ docMetaCQ;

    // ===================================================================================
    //                                                                             Control
    //                                                                             =======
    public DocMetaCQ docMeta() {
        if (docMetaCQ == null) {
            docMetaCQ = new DocMetaCQ();
        }

  - Make "kubeadm upgrade apply" add the "node-role.kubernetes.io/control-plane" label on existing nodes that only have the "node-role.kubernetes.io/master" label during upgrade.
  - Please adapt your tooling built on top of kubeadm to use the "node-role.kubernetes.io/control-plane" label.
  - The taint applied to control-plane nodes "node-role.kubernetes.io/master:NoSchedule" is now deprecated and will be removed in a future release after a GA deprecation period.

        assertNotNull(exception);
        assertNull(exception.getMessage());
        assertNull(exception.getCause());
    }

    /**
     * Test protected constructor with suppression and stack trace control
     */
    public void test_protectedConstructor_withSuppressionAndStackTrace() throws Exception {
        // Access protected constructor via reflection
        Constructor<CrawlerSystemException> constructor =

    - [kubeadm](#kubeadm-1)
    - [Other Deprecations](#other-deprecations)
  - [Changes to API Resources](#changes-to-api-resources)
    - [ABAC](#abac)
    - [Admission Control](#admission-control)
    - [Authentication](#authentication)
    - [Authorization](#authorization)
    - [Autoscaling](#autoscaling-1)
    - [Certificates](#certificates)
    - [ConfigMap](#configmap)

This is appropriate when we are logging in to our own application, probably with our own frontend.

Because we can trust it to receive the `username` and `password`, as we control it.

But if you are building an OAuth2 application that others would connect to (i.e., if you are building an authentication provider equivalent to Facebook, Google, GitHub, etc.) you should use one of the other flows.

    /*
     * Wait not just until the Future's value is set (as in future.get()) but
     * also until ListeningScheduledExecutorService's wrapper task is done
     * executing listeners, as detected by yielding control to afterExecute.
     */
    completed.await();
    assertTrue(future.isDone());
    assertThat(future.get()).isEqualTo(42);
    assertListenerRunImmediately(future);
    assertEquals(0, delegate.getQueue().size());

   * is set to {@code null}.
   *
   * <p>Like the {@link #toArray()} method, this method acts as bridge between array-based and
   * collection-based APIs. Further, this method allows precise control over the runtime type of the
   * output array, and may, under certain circumstances, be used to save allocation costs.
   *
   * <p>Suppose {@code x} is a queue known to contain only strings. The following code can be used

	// by the Content-Type header field.
	ContentEncoding string

	// Date and time at which the object is no longer able to be cached
	Expires time.Time

	// Cache-Control - Specifies caching behavior along the request/reply chain
	CacheControl string

	// Specify object storage class
	StorageClass string

	ReplicationStatusInternal string