- Fix: azure disk detach failure if node not exists ([#82640](https://github.com/kubernetes/kubernetes/pull/82640), [@andyzhangx](https://github.com/andyzhangx))
- Add azure disk encryption(SSE+CMK) support ([#84605](https://github.com/kubernetes/kubernetes/pull/84605), [@andyzhangx](https://github.com/andyzhangx))

    server.enqueue(
      MockResponse
        .Builder()
        .inTunnel()
        .build(),
    )
    server.enqueue(MockResponse(body = "encrypted response from the origin server"))
    client =
      client
        .newBuilder()
        .proxy(server.proxyAddress)
        .sslSocketFactory(
          handshakeCertificates.sslSocketFactory(),

  - `apiserver_authorization_config_controller_last_config_info` metric after successfully loading the authorization configuration file.
  - `apiserver_encryption_config_controller_last_config_info` metric after successfully loading the encryption configuration file. ([#132299](https://github.com/kubernetes/kubernetes/pull/132299), [@aramase](https://github.com/aramase)) [SIG API Machinery, Auth and Testing]

- go.opentelemetry.io/otel/sdk: v1.28.0 → v1.33.0
- go.opentelemetry.io/otel/trace: v1.28.0 → v1.33.0
- go.opentelemetry.io/otel: v1.28.0 → v1.33.0
- go.opentelemetry.io/proto/otlp: v1.3.1 → v1.4.0
- golang.org/x/crypto: v0.28.0 → v0.36.0
- golang.org/x/net: v0.30.0 → v0.38.0
- golang.org/x/oauth2: v0.23.0 → v0.27.0
- golang.org/x/sync: v0.8.0 → v0.12.0
- golang.org/x/sys: v0.26.0 → v0.31.0
- golang.org/x/term: v0.25.0 → v0.30.0

- API server's deprecated `--experimental-encryption-provider-config` flag is now removed. Adapt your machinery to use the `--encryption-provider-config` flag that is available since v1.13. ([#108423](https://github.com/kubernetes/kubernetes/pull/108423), [@ialidzhikov](https://github.com/ialidzhikov))

* Fixed encryption key and encryption provider rotation ([#58375](https://github.com/kubernetes/kubernetes/pull/58375), [@liggitt](https://github.com/liggitt))

* Encryption key and encryption provider rotation now works properly. ([#58375](https://github.com/kubernetes/kubernetes/pull/58375), [@liggitt](https://github.com/liggitt))

## Dependencies

### Added
_Nothing has changed._

### Changed
- golang.org/x/crypto: 5ea612d → 5770296
- golang.org/x/sys: d19ff85 → 665e8c7

### Removed
_Nothing has changed._



# v1.21.11


## Downloads for v1.21.11



### Source Code

- Added support for max attach limit for Cinder ([#72980](https://github.com/kubernetes/kubernetes/pull/72980), [@gnufied](https://github.com/gnufied))
- Enabled mTLS encryption between etcd and kube-apiserver in GCE ([#70144](https://github.com/kubernetes/kubernetes/pull/70144), [@wenjiaswe](https://github.com/wenjiaswe))

## Dependencies

### Added
_Nothing has changed._

### Changed
- github.com/yuin/goldmark: [v1.4.0 → v1.4.13](https://github.com/yuin/goldmark/compare/v1.4.0...v1.4.13)
- golang.org/x/crypto: 32db794 → 8634188
- golang.org/x/mod: v0.4.2 → 86c51ed
- golang.org/x/net: 491a49a → 1e63c2f
- golang.org/x/oauth2: 2bc19b1 → d3ed0bb
- golang.org/x/sync: 036812b → 886fb93
- golang.org/x/sys: f4d4317 → v0.3.0