* Fixes issue where AAD token obtained by kubectl is incompatible with on-behalf-of flow and oidc. ([#86412](https://github.com/kubernetes/kubernetes/pull/86412), [@weinong](https://github.com/weinong))
    * The audience claim before this fix has "spn:" prefix. After this fix, "spn:" prefix is omitted.

* Fixes issue where AAD token obtained by kubectl is incompatible with on-behalf-of flow and oidc. ([#86412](https://github.com/kubernetes/kubernetes/pull/86412), [@weinong](https://github.com/weinong))
    * The audience claim before this fix has "spn:" prefix. After this fix, "spn:" prefix is omitted.

- Fix the regression with the slow pods termination. Before this fix pods may take an additional time to terminate - up to one minute. Reversing the change that ensured that CNI resources cleaned up when the pod is removed on API server. ([#97980](https://github.com/kubernetes/kubernetes/pull/97980),...

pkg syscall (netbsd-arm64-cgo), const IP_PORTRANGE_HIGH ideal-int
pkg syscall (netbsd-arm64-cgo), const IP_PORTRANGE ideal-int
pkg syscall (netbsd-arm64-cgo), const IP_PORTRANGE_LOW = 2
pkg syscall (netbsd-arm64-cgo), const IP_PORTRANGE_LOW ideal-int
pkg syscall (netbsd-arm64-cgo), const IPPROTO_AH = 51
pkg syscall (netbsd-arm64-cgo), const IPPROTO_AH ideal-int
pkg syscall (netbsd-arm64-cgo), const IPPROTO_CARP = 112

pkg syscall (darwin-arm64), const IPV6_PORTRANGE_HIGH = 1
pkg syscall (darwin-arm64), const IPV6_PORTRANGE_HIGH ideal-int
pkg syscall (darwin-arm64), const IPV6_PORTRANGE_LOW = 2
pkg syscall (darwin-arm64), const IPV6_PORTRANGE_LOW ideal-int
pkg syscall (darwin-arm64), const IPV6_RECVTCLASS = 35
pkg syscall (darwin-arm64), const IPV6_RECVTCLASS ideal-int
pkg syscall (darwin-arm64), const IPV6_RTHDR_LOOSE = 0

- E2E storage tests: setting test tags like `[Slow]` via the `DriverInfo.FeatureTag` field is no longer supported. ([#121391](https://github.com/kubernetes/kubernetes/pull/121391), [@pohly](https://github.com/pohly))

- TLS timeouts have been extended to work around slow arm64 math/big functions. ([#66264](https://github.com/kubernetes/kubernetes/pull/66264), [@joejulian](https://github.com/joejulian))

**Fixed Versions**:
  - kube-apiserver v1.29.4
  - kube-apiserver v1.28.9
  - kube-apiserver v1.27.13

This vulnerability was reported by tha3e1vl.


**CVSS Rating:** Low (2.7) [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N)

## Changes by Kind

### Feature

- Kubernetes is now built with go 1.21.9

- Updated kubelet CLI summary documentation and generated webpage ([#73256](https://github.com/kubernetes/kubernetes/pull/73256), [@deitch](https://github.com/deitch))
- Set a low `oom_score_adj` for containers in pods with system-critical priorities ([#73758](https://github.com/kubernetes/kubernetes/pull/73758), [@sjenning](https://github.com/sjenning))

- Fix the regression with the slow pods termination. Before this fix pods may take an additional time to terminate - up to one minute. Reversing the change that ensured that CNI resources cleaned up when the pod is removed on API server. ([#97980](https://github.com/kubernetes/kubernetes/pull/97980),...