### kube-dns
* Adds support for configurable DNS stub domains and upstream nameservers.
  The following configuration options have been added to the `kube-system:kube-dns` ConfigMap:
  ```
  "stubDomains": {
    "acme.local": ["1.2.3.4"]
  },
  ```
  is a map of domain to list of nameservers for the domain. This is used
  to inject private DNS domains into the kube-dns namespace. In the above

fetching of public verifying keys, by enabling the Alpha `ExternalServiceAccountTokenSigner` feature gate and specifying `--service-account-signing-endpoint`. The flag value can either be the location of a Unix domain socket on a filesystem, or be prefixed with an @ symbol and name a Unix domain socket in the abstract socket namespace. ([#128190](https://github.com/kubernetes/kubernetes/pull/128190), [@HarshalNeelkamal](https://github.com/HarshalNeelkamal)) [SIG API Machinery, Apps, Auth, Etcd, Instrumentation,...

Public Domain...

- Fix a bug on GCE that /etc/crictl.yaml is not generated when crictl is preloaded. ([#66877](https://github.com/kubernetes/kubernetes/pull/66877), [@Random-Liu](https://github.com/Random-Liu))
- Revert #63905: Setup dns servers and search domains for Windows Pods. DNS for Windows containers will be set by CNI plugins. ([#66587](https://github.com/kubernetes/kubernetes/pull/66587), [@feiskyer](https://github.com/feiskyer))

        serverData1.sflags = (byte) 0x11;
        serverData1.smaxMpxCount = 100;
        serverData1.oemDomainName = "DOMAIN1";
        serverData1.encryptedPasswords = true;

        serverData2.sflags = (byte) 0x22;
        serverData2.smaxMpxCount = 200;
        serverData2.oemDomainName = "DOMAIN2";
        serverData2.encryptedPasswords = false;

        // Then - instances should be independent

    }

    /**
     * Test getting the account name.
     */
    @Test
    void testGetAccountName() {
        rpc.sid_t rpcSid = new rpc.sid_t();
        SID sid = new SID(rpcSid, SID.SID_TYPE_USER, "DOMAIN", "user", false);
        assertEquals("user", sid.getAccountName());

        SID domainSid = new SID(rpcSid, SID.SID_TYPE_DOMAIN, "DOMAIN", null, false);

        String root = "share";
        String path = "\\folder";
        String fullPath = "\\" + domain + "\\" + root + path; // Should be "\domain.com\share\folder"

        lenient().when(smbTransport.getDfsReferrals(auth, fullPath, 0)).thenReturn(dfsReferral);

        assertEquals(dfsReferral, dfs.getReferral(smbTransport, domain, root, path, auth));
    }

    @Test

- Kube-proxy:...

            this.domainName = domainNameString.check(pacStream.readString());

            // ID for domain (used with relative IDs to get SIDs)
            SID domainId = null;
            if (domainIdPointer != 0) {
                domainId = pacStream.readSid();
            }

            // Extra SIDs data
            PacSidAttributes[] extraSidAtts = {};

    * Donc, le certificat et le traitement du cryptage sont faits avant HTTP.
* TCP ne connaît pas les "domaines", seulement les adresses IP.
    * L'information sur le domaine spécifique demandé se trouve dans les données HTTP.
* Les certificats HTTPS "certifient" un certain domaine, mais le protocole et le cryptage se font au niveau TCP, avant de savoir quel domaine est traité.