- Added support to the kube-apiserver for an alpha feature enabling external signing of service account tokens and fetching of public verifying keys, by enabling the Alpha `ExternalServiceAccountTokenSigner` feature gate and specifying `--service-account-signing-endpoint`. The flag value can either be the location of a Unix domain socket on a filesystem, or be prefixed with an @ symbol and...

- Restore --verify-only function in code generation wrappers. ([#123261](https://github.com/kubernetes/kubernetes/pull/123261), [@skitt](https://github.com/skitt)) [SIG API Machinery]

- The beta `RootCAConfigMap` feature gate is enabled by default and causes kube-controller-manager to publish a "kube-root-ca.crt" ConfigMap to every namespace. This ConfigMap contains a CA bundle used for verifying connections to the kube-apiserver. ([#96197](https://github.com/kubernetes/kubernetes/pull/96197), [@zshihang](https://github.com/zshihang)) [SIG API Machinery, Apps, Auth and Testing]

           * This test relies on behavior that's unspecified but currently
           * guaranteed by the implementation: Cancellation of inputs is
           * performed in the order they were provided to the constructor. Verify
           * that as a sanity check:
           */
          assertFalse(future2.isCancelled());
          // Now attempt to trigger the exception:
          future2.set(DATA2);
        },

           * This test relies on behavior that's unspecified but currently
           * guaranteed by the implementation: Cancellation of inputs is
           * performed in the order they were provided to the constructor. Verify
           * that as a sanity check:
           */
          assertFalse(future2.isCancelled());
          // Now attempt to trigger the exception:
          future2.set(DATA2);
        },

- Replace scale up forbidden window with disregarding CPU samples collected when pod was initializing. ([#67252](https://github.com/kubernetes/kubernetes/pull/67252), [@jbartosik](https://github.com/jbartosik))
- [e2e] verifying LimitRange update is effective before creating new pod ([#68171](https://github.com/kubernetes/kubernetes/pull/68171), [@dixudx](https://github.com/dixudx))

* change default azure file mount permission to 0777 ([#69854](https://github.com/kubernetes/kubernetes/pull/69854), [@andyzhangx](https://github.com/andyzhangx))
* Verify invalid secret/configmap/projected volumes before calling setup ([#68691](https://github.com/kubernetes/kubernetes/pull/68691), [@gnufied](https://github.com/gnufied))



# v1.10.9

edwards25519.NewScalar().MultiplyAdd(k, &priv.s, r) copy(signature[:32], R.Bytes()) copy(signature[32:], S.Bytes()) return signature } func Verify(pub *PublicKey, message, sig []byte) error { return verify(pub, message, sig) } func verify(pub *PublicKey, message, sig []byte) error { fipsSelfTest() fips140.RecordApproved() return verifyWithDom(pub, message, sig, domPrefixPure, "") } func VerifyPH(pub *PublicKey, message []byte, sig []byte, context string) error { fipsSelfTest() fips140.RecordApproved() if l := len(message);...

    val get = server.takeRequest()
    assertThat(get.headers["Private"]).isEqualTo("Secret")
    assertThat(get.headers["User-Agent"]).isEqualTo("App 1.0")
    assertThat(hostnameVerifier.calls).containsExactly("verify android.com")
  }

  /**
   * We had a bug where OkHttp would crash if HTTP proxies returned a truncated response.
   * https://github.com/square/okhttp/issues/5727
   */
  @Test

Release artifacts are [signed](https://github.com/kubernetes/enhancements/issues/3031) using [cosign](https://github.com/sigstore/cosign)
signatures
and there is experimental support for [verifying image signatures](https://kubernetes.io/docs/tasks/administer-cluster/verify-signed-images/).