- Fixes kubelet crash in client certificate rotation cases ([#88079](https://github.com/kubernetes/kubernetes/pull/88079), [@liggitt](https://github.com/liggitt)) [SIG API Machinery, Auth and Node]

###  Introduced KMS v2

- Fixes an issue affecting log rotation with CRI runtimes where kubelet tries to compress Windows logs before closing file handles ([#112482](https://github.com/kubernetes/kubernetes/pull/112482), [@ibabou](https://github.com/ibabou)) [SIG Node and Windows]

BX; \ MOVL (a*4)(DI), DX; \ MOVL (b*4)(DI), CX; \ RORL $22, DX; \ ANDL (a*4)(DI), CX; \ XORL CX, BX; \ XORL DX, AX; \ ADDL AX, BX // Calculate T1 and T2, then e = d + T1 and a = T1 + T2. // The values for e and a are stored in d and h, ready for rotation. #define SHA256ROUND(index, const, a, b, c, d, e, f, g, h) \ SHA256T1(const, e, f, g, h); \ MOVL AX, 292(SP); \ SHA256T2(a, b, c); \ MOVL 292(SP), AX; \ ADDL AX, BX; \ ADDL AX, (d*4)(DI); \ MOVL BX, (h*4)(DI) #define SHA256ROUND0(index, const, a,...

- Client-go certificate manager rotation gained the ability to preserve optional intermediate chains accompanying issued certificates ([#88744](https://github.com/kubernetes/kubernetes/pull/88744), [@jackkleeman](https://github.com/jackkleeman)) [SIG API Machinery and Auth]

BX; \ MOVL (a*4)(DI), DX; \ MOVL (b*4)(DI), CX; \ RORL $22, DX; \ ANDL (a*4)(DI), CX; \ XORL CX, BX; \ XORL DX, AX; \ ADDL AX, BX // Calculate T1 and T2, then e = d + T1 and a = T1 + T2. // The values for e and a are stored in d and h, ready for rotation. #define SHA256ROUND(index, const, a, b, c, d, e, f, g, h) \ SHA256T1(const, e, f, g, h); \ MOVL AX, 292(SP); \ SHA256T2(a, b, c); \ MOVL 292(SP), AX; \ ADDL AX, BX; \ ADDL AX, (d*4)(DI); \ MOVL BX, (h*4)(DI) #define SHA256ROUND0(index, const, a,...

The memory model is specified more formally in the next section.
</p>

<p>
A data race is defined as
a write to a memory location happening concurrently with another read or write to that same location,
unless all the accesses involved are atomic data accesses as provided by the <code>sync/atomic</code> package.
As noted already, programmers are strongly encouraged to use appropriate synchronization

 * ({@code [ ]}) indicates that the range is closed on that side; a parenthesis ({@code ( )}) means
 * it is either open or unbounded. The construct {@code {x | statement}} is read "the set of all
 * <i>x</i> such that <i>statement</i>.")
 *
 * <blockquote>
 *
 * <table>
 * <caption>Range Types</caption>
 * <tr><th>Notation        <th>Definition               <th>Factory method

 * ({@code [ ]}) indicates that the range is closed on that side; a parenthesis ({@code ( )}) means
 * it is either open or unbounded. The construct {@code {x | statement}} is read "the set of all
 * <i>x</i> such that <i>statement</i>.")
 *
 * <blockquote>
 *
 * <table>
 * <caption>Range Types</caption>
 * <tr><th>Notation        <th>Definition               <th>Factory method

import okio.Buffer
import okio.BufferedSource
import okio.ByteString
import okio.ForwardingSource
import okio.Source
import okio.buffer

/**
 * Streaming decoder of data encoded following Abstract Syntax Notation One (ASN.1). There are
 * multiple variants of ASN.1, including:
 *
 *  * DER: Distinguished Encoding Rules. This further constrains ASN.1 for deterministic encoding.
 *  * BER: Basic Encoding Rules.
 *