- Fix kubelet token cache returning stale tokens when service accounts are recreated with the same name. The token cache is now UID-aware and the new `TokenRequestServiceAccountUIDValidation` feature gate (Beta, enabled by default) validates the TokenRequest UID when set matches the service account UID. ([#132803...

  is now available as alpha (off by default). When enabled, the `legacy-service-account-token-cleaner`
  controller loop removes service account token secrets that have not been used
  in the time specified by `--legacy-service-account-token-clean-up-period` (defaulting
  to one year), **and are** referenced from the `.secrets` list of a ServiceAccount

- Fixes a 1.32 regression in with the ServiceAccountNodeAudienceRestriction feature where `azureFile` volumes encounter "failed to get service accoount token attributes" errors. Reverts the `ServiceAccountNodeAudienceRestriction` feature to disabled in v1.32. Refer to https://github.com/kubernetes/kubernetes/issues/129935 for more details. If you're using in-tree inline volumes or in-tree persistent volumes...

.Values.metrics.serviceMonitor.relabelConfigs }} {{- toYaml .Values.metrics.serviceMonitor.relabelConfigs | nindent 6 }} {{- end }} {{- if not .Values.metrics.serviceMonitor.public }} bearerTokenSecret: name: {{ template "minio.fullname" . }}-prometheus key: token {{- end }} namespaceSelector: matchNames: - {{ .Release.Namespace | quote }} selector: matchLabels: app: {{ include "minio.name" . }} release: {{ .Release.Name }} monitoring: "true" {{- end }} {{- if .Values.metrics.serviceMonitor.enabled }} --- apiVersion:...

// applicable here.
//
// Service accounts are replicated as long as they are not meant for the root
// user.
//
// STS accounts are replicated, but only if the session token is verifiable
// using the local cluster's root credential.
func (c *SiteReplicationSys) IAMChangeHook(ctx context.Context, item madmin.SRIAMItem) error {
	// The IAM item has already been applied to the local cluster at this

.Values.metrics.serviceMonitor.relabelConfigs }} {{ toYaml .Values.metrics.serviceMonitor.relabelConfigs | indent 6 }} {{- end }} {{- if not .Values.metrics.serviceMonitor.public }} bearerTokenSecret: name: {{ template "minio.fullname" . }}-prometheus key: token {{- end }} namespaceSelector: matchNames: - {{ .Release.Namespace | quote }} selector: matchLabels: app: {{ include "minio.name" . }} release: {{ .Release.Name }} monitoring: "true" {{- end }} minio/templates/statefulset.yaml {{- if eq .Values.mode...

.Values.metrics.serviceMonitor.scrapeTimeout }} scrapeTimeout: {{ .Values.metrics.serviceMonitor.scrapeTimeout }} {{- end }} {{- if not .Values.metrics.serviceMonitor.public }} bearerTokenSecret: name: {{ template "minio.fullname" . }}-prometheus key: token {{- end }} namespaceSelector: matchNames: - {{ .Release.Namespace | quote }} selector: matchLabels: app: {{ include "minio.name" . }} release: {{ .Release.Name }} monitoring: true {{- end }} minio/templates/statefulset.yaml {{- if eq .Values.mode "distributed"...

.Values.metrics.serviceMonitor.scrapeTimeout }} scrapeTimeout: {{ .Values.metrics.serviceMonitor.scrapeTimeout }} {{- end }} {{- if not .Values.metrics.serviceMonitor.public }} bearerTokenSecret: name: {{ template "minio.fullname" . }}-prometheus key: token {{- end }} namespaceSelector: matchNames: - {{ .Release.Namespace | quote }} selector: matchLabels: app: {{ include "minio.name" . }} release: {{ .Release.Name }} monitoring: "true" {{- end }} minio/templates/statefulset.yaml {{- if eq .Values.mode...

.Values.metrics.serviceMonitor.scrapeTimeout }} scrapeTimeout: {{ .Values.metrics.serviceMonitor.scrapeTimeout }} {{- end }} {{- if not .Values.metrics.serviceMonitor.public }} bearerTokenSecret: name: {{ template "minio.fullname" . }}-prometheus key: token {{- end }} namespaceSelector: matchNames: - {{ .Release.Namespace | quote }} selector: matchLabels: app: {{ include "minio.name" . }} release: {{ .Release.Name }} monitoring: "true" {{- end }} minio/templates/statefulset.yaml {{- if eq .Values.mode...

- Updated an audit annotation key used by the `…/serviceaccounts/<name>/token` resource handler.