[@caesarxuchao](https://github.com/caesarxuchao))

* Using kubectl gcp auth plugin with a Google Service Account to authenticate to a cluster now additionally requests a token with the  "userinfo.email" scope. This way, users can write ClusterRoleBindings/RoleBindings with the email address of the service account directly. (This is a breaking change if the numeric uniqueIDs of the Google service accounts were being used in RBAC role bindings. The behavior can be overridden by explicitly specifying the...

* An `automountServiceAccountToken` field was added to ServiceAccount and PodSpec objects. If set to `false` on a pod spec, no service account token is automounted in the pod. If set to `false` on a service account, no service account token is automounted for that service account unless explicitly overridden in the pod spec. ([#37953](https://github.com/kubernetes/kubernetes/pull/37953), [@liggitt](https://github.com/liggitt))

### Windows

Support for Windows nodes and Windows containers went going stable.

Support for Group Managed Service Accounts (GMSA) for Windows containers in Kubernetes. GMSA are a specific type of Active Directory account that provides automatic password management, simplified service principal name (SPN) management, and the ability to delegate the management to other administrators across multiple servers.

		"ManagerID", "Active")

	t.Run("Account", func(t *testing.T) {
		AssertObjEqual(t, user.Account, expect.Account, "ID", "CreatedAt", "UpdatedAt", "DeletedAt", "UserID", "Number")

		if user.Account.Number != "" {
			if !user.Account.UserID.Valid {
				t.Errorf("Account's foreign key should be saved")
			} else {
				var account Account
				db(unscoped).First(&account, "user_id = ?", user.ID)

			t.Fatalf("errors happened when create: %v", err)
		}

		var account2 CustomizeAccount
		DB.Find(&account2, "user_id = ?", cusUser.ID)
		AssertEqual(t, account2.Number, number)
		AssertEqual(t, account2.Number2, cusUser.Account.Number2)
	})

                final Set<String> permissionSet = new HashSet<>();
                final IAccount account = authResult.account();
                final String homeAccountId = account.homeAccountId();
                final String username = account.username();
                if (logger.isDebugEnabled()) {
                    logger.debug("homeAccountId={}, username={}", homeAccountId, username);

- Authentication token cache size is increased (from 4k to 32k) to support clusters with many nodes or many namespaces with active service accounts. ([#83643](https://github.com/kubernetes/kubernetes/pull/83643), [@lavalamp](https://github.com/lavalamp))

    @ParameterizedTest
    @DisplayName("Test decode with various ACE counts")
    @ValueSource(ints = { 0, 1, 10, 100, 1000, 4096 })
    void testDecodeWithVariousAceCounts(int aceCount) throws SMBProtocolDecodingException {
        // This test is theoretical as we can't create huge buffers
        // but tests the boundary conditions
        if (aceCount <= 10) { // Only test small counts practically
            byte[] buffer = new byte[2048];

contemptuously.  `I dare say you never even spoke to Time!'

  `Perhaps not,' Alice cautiously replied:  `but I know I have to
beat time when I learn music.'

  `Ah! that accounts for it,' said the Hatter.  `He won't stand
beating.  Now, if you only kept on good terms with him, he'd do
almost anything you liked with the clock.  For instance, suppose

     * @return the extra SIDs array
     */
    public SID[] getExtraSids() {
        return this.extraSids;
    }

    /**
     * Returns the user account control flags.
     * @return the user account control value
     */
    public int getUserAccountControl() {
        return this.userAccountControl;
    }

    /**
     * Returns the user flags indicating PAC content.