- Fixed kubelet creating extra sandbox for pods with RestartPolicyOnFailure after all containers succeeded ([#92614](https://github.com/kubernetes/kubernetes/pull/92614), [@tnqn](https://github.com/tnqn)) [SIG Node and Testing]

- Fixed the example validation rule in godoc:
  
  When configuring a JWT authenticator:
  
  If username.expression uses 'claims.email', then 'claims.email_verified' must be used in
  username.expression or extra[*].valueExpression or claimValidationRules[*].expression.
  An example claim validation rule expression that matches the validation automatically

			n, err = xlStorage.ReadFile(t.Context(), testCase.volume, testCase.fileName, testCase.offset, buf, v)
			if err != nil && testCase.expectedErr != nil {
				// Validate if the type string of the errors are an exact match.
				if err.Error() != testCase.expectedErr.Error() {
					if runtime.GOOS != globalWindowsOSName {
						t.Errorf("Case: %d %#v, expected: %s, got: %s", i+1, testCase, testCase.expectedErr, err)
					} else {

            Map<Object, Object> result = new HashMap<>();
            for (Object key : keys) {
              Object value = new Object();
              result.put(key, value);
              // add extra entries
              result.put(value, key);
            }
            return result;
          }
        };
    LoadingCache<Object, Object> cache = CacheBuilder.newBuilder().build(loader);

    /** The key of the message: Crawling/Displaying */
    public static final String LABELS_pathmap_pt_both = "{labels.pathmap_pt_both}";

    /** The key of the message: Extracted URL Conversion */
    public static final String LABELS_pathmap_pt_stored = "{labels.pathmap_pt_stored}";

    /** The key of the message: Regular Name */

  - `failurePolicy` default changed from `Ignore` to `Fail` for v1
  - `matchPolicy` default changed from `Exact` to `Equivalent` for v1
  - `timeout` default changed from `30s` to `10s` for v1
  - `sideEffects` default value is removed, and the field made required, and only `None` and `NoneOnDryRun` are permitted for v1

- When configuring a JWT authenticator:
  
  If `username.expression` used 'claims.email', then 'claims.email_verified' must have been used in `username.expression` or `extra[*].valueExpression` or `claimValidationRules[*].expression`. An example claim validation rule expression that matches the validation automatically applied when `username.claim` is set to 'email' is 'claims.?email_verified.orValue(true) == true'.

		// to verify for legacy version.
		if formatLegacy {
			// We only need this code if we are moving
			// from `xl.json` to `xl.meta`, we can avoid
			// one extra readdir operation here for all
			// new deployments.
			entries, err := readDir(currentDataPath)
			if err != nil && err != errFileNotFound {
				return res, osErrToFileErr(err)
			}

- Fixed kubelet creating extra sandbox for pods with RestartPolicyOnFailure after all containers succeeded ([#92614](https://github.com/kubernetes/kubernetes/pull/92614), [@tnqn](https://github.com/tnqn)) [SIG Node and Testing]

@Beta
public final class PublicSuffixPatterns {
  private PublicSuffixPatterns() {}

  /** If a hostname is contained as a key in this map, it is a public suffix. */
  public static final ImmutableMap<String, PublicSuffixType> EXACT =
      TrieParser.parseTrie(