* requests for a TLS client certificate for any node are approved if the CSR creator has `create` permission on the `certificatesigningrequests` resource and `nodeclient` subresource in the `certificates.k8s.io` API group

- Kubeadm: remove the deprecated `--csr-only` and `--csr-dir` flags from `kubeadm init phase certs`. Deprecate the same flags under `kubeadm certs renew`. In both the cases the command `kubeadm certs generate-csr` should be used instead. ([#102108](https://github.com/kubernetes/kubernetes/pull/102108), [@neolit123](https://github.com/neolit123))

  <mime-type type="application/cals-1840"/>

  <mime-type type="application/cbor">
    <acronym>CBOR</acronym>
    <_comment>Concise Binary Object Representation container</_comment>
    <tika:link>http://tools.ietf.org/html/rfc7049</tika:link>
    <magic priority="60">
      <match value="0xd9d9f7" type="string" offset="0" />
    </magic>
    <glob pattern="*.cbor"/>
  </mime-type>

  <mime-type type="application/ccxml+xml">

- Resolves an issue using `kubectl certificate approve/deny` against a server serving the v1 CSR API ([#91691](https://github.com/kubernetes/kubernetes/pull/91691), [@liggitt](https://github.com/liggitt)) [SIG Auth and CLI]

### Other (Cleanup or Flake)

- Update CNI to v0.8.6

113549, 2, 5}, crypto.SHA1: {1, 3, 14, 3, 2, 26}, // https://csrc.nist.gov/projects/computer-security-objects-register/algorithm-registration // // nistAlgorithms OBJECT IDENTIFIER ::= { joint-iso-ccitt(2) country(16) us(840) // organization(1) gov(101) csor(3) nistAlgorithm(4) } // // hashAlgs OBJECT IDENTIFIER ::= { nistAlgorithms 2 } // // id-sha256 OBJECT IDENTIFIER ::= { hashAlgs 1 } // id-sha384 OBJECT IDENTIFIER ::= { hashAlgs 2 } // id-sha512 OBJECT IDENTIFIER ::= { hashAlgs 3 } // id-sha224 OBJECT...

","even","grep","_elem","odd","len","j","end","sort","splice","extend","options","copy","copyIsArray","clone","target","deep","isPlainObject","Array","isArray","undefined","expando","Math","random","replace","isReady","error","msg","noop","proto","Ctor","isEmptyObject","globalEval","textContent","documentElement","nodeValue","makeArray","results","inArray","isXMLDoc","namespace","namespaceURI","docElem","ownerDocument","test","second","invert","matches","callbackExpect","arg","value","guid","Sym...

- Kubeadm: deprecate the "--csr-only" and "--csr-dir" flags of the "kubeadm init phase certs" subcommands. Please use "kubeadm alpha certs generate-csr" instead. This new command allows you to generate new private keys and certificate signing requests for all the control-plane components, so that the certificates can be signed by an external...

- kubeadm: Fixed the machine readability of `kubeadm token create --print-join-command` ([#75487](https://github.com/kubernetes/kubernetes/pull/75487), [@displague](https://github.com/displague))

113549, 2, 5}, crypto.SHA1: {1, 3, 14, 3, 2, 26}, // https://csrc.nist.gov/projects/computer-security-objects-register/algorithm-registration // // nistAlgorithms OBJECT IDENTIFIER ::= { joint-iso-ccitt(2) country(16) us(840) // organization(1) gov(101) csor(3) nistAlgorithm(4) } // // hashAlgs OBJECT IDENTIFIER ::= { nistAlgorithms 2 } // // id-sha256 OBJECT IDENTIFIER ::= { hashAlgs 1 } // id-sha384 OBJECT IDENTIFIER ::= { hashAlgs 2 } // id-sha512 OBJECT IDENTIFIER ::= { hashAlgs 3 } // id-sha224 OBJECT...

- Fixed a data race that could occur when a single Go type was serialized to CBOR concurrently for the first time within a program. ([#129170](https://github.com/kubernetes/kubernetes/pull/129170), [@benluddy](https://github.com/benluddy)) [SIG API Machinery]