assertEquals("S-1-5-10-20", unknown.getDomainName());
            assertEquals("30", unknown.getAccountName());

            // Domain type: domain name as-is, account name empty
            SID domain = new SID(buildSidT((byte) 1, ident, 10, 20), jcifs.SID.SID_TYPE_DOMAIN, "MYDOM", "ignored", false);
            assertEquals("MYDOM", domain.getDomainName());

- kube-apiserver: `--service-account-max-token-expiration` can now be used in combination with an external token signer `--service-account-signing-endpoint`, as long as the `--service-account-max-token-expiration` is not longer than the external token signer's max expiration. ([#129816](https://github.com/kubernetes/kubernetes/pull/129816), [@sambdavidson](h...

    private String decodeWideStringPointer(NdrBuffer buf) throws NdrException {
        int pointer = buf.dec_ndr_long();
        if (pointer == 0) {
            return null; // NULL pointer
        }

        int maxCount = buf.dec_ndr_long();
        int offset = buf.dec_ndr_long();
        int actualCount = buf.dec_ndr_long();

        if (actualCount <= 0) {
            return "";
        }

labels.ldap_admin_security_principal=Bind DN
labels.ldap_admin_security_credentials=Password
labels.ldap_base_dn=Base DN
labels.ldapAccountFilter=Account Filter
labels.ldapGroupFilter=Group Filter
labels.ldapMemberofAttribute=memberOf Attribute
labels.ldap_account_filter=Account Filter
labels.ldap_group_filter=Group Filter
labels.ldap_memberof_attribute=memberOf Attribute
labels.notification_login=Login Page

   * that this uses unsigned integers (see {@link com.google.common.primitives.UnsignedInts}).
   * Comparisons between the two should take this into account.
   *
   * <p>Fingerprint2011() is a form of Murmur2 on strings up to 32 bytes and a form of CityHash for
   * longer strings. It could have been one or the other throughout. The main advantage of the

### SIG Auth

- TokenRequest and TokenRequestProjection are now beta features. To enable these feature, the API server needs to be started with the `--service-account-issuer`, `--service-account-signing-key-file`, and `--service-account-api-audiences` flags.
([#67349](https://github.com/kubernetes/kubernetes/pull/67349), [@mikedanese](https://github.com/mikedanese))

   * throw an exception in response to any of {@code elements} being null or of the wrong type.
   *
   * <p><b>Note:</b> this method does not take into account the occurrence count of an element in
   * the two collections; it may still return {@code true} even if {@code elements} contains several

## Changelog since v1.13.1

### Other notable changes

* client-go: shortens refresh period for token files to 1 minute to ensure auto-rotated projected service account tokens are read frequently enough. ([#72437](https://github.com/kubernetes/kubernetes/pull/72437), [@liggitt](https://github.com/liggitt))

### CSI Service Account Token

        int bytesWritten = transaction.writeParameterWordsWireFormat(dst, 0);

        // Verify setup count is written correctly
        assertEquals(3, dst[35]);

        // Verify the total bytes written accounts for setup words
        assertTrue(bytesWritten >= 38 + 6); // Base structure + setup words
    }

    @Test
    @DisplayName("Test writeParameterWordsWireFormat returns correct byte count")