in accord with this section must be in a format that is publicly
documented (and with an implementation available to the public in
source code form), and must require no special password or key for
unpacking, reading or copying.

  7. Additional Terms.

  "Additional permissions" are terms that supplement the terms of this
License by making exceptions from one or more of its conditions.

- The API server now re-uses data encryption keys while the kms v2 plugin key ID is stable.  Data encryption keys are still randomly generated on server start but an atomic counter is used to prevent nonce collisions. ([#116155](https://github.com/kubernetes/kubernetes/pull/116155), [@enj](https://github.com/enj))

 * Permit a dangling semicolon in media type parsing.


## Version 1.x

[Change log](changelog_1x.md)


 [brick]: https://noncombatant.org/2015/05/01/about-http-public-key-pinning/
 [interceptors]: https://square.github.io/okhttp/interceptors/

        rawtypeToWildcard(MinMaxPriorityQueue.expectedSize(heapSize)).create();
    /*
     * this map would contain the same exact elements as the MinMaxHeap; the
     * value in the map is the number of occurrences of the key.
     */
    SortedMap<Integer, AtomicInteger> replica = Maps.newTreeMap();
    assertTrue("Empty heap should be OK", mmHeap.isIntact());
    for (int i = 0; i < heapSize; i++) {
      int randomInt = random.nextInt();

			if kmsKey != "" {
				_, err := GlobalKMS.GenerateKey(ctx, &kms.GenerateKeyRequest{
					Name:           kmsKey,
					AssociatedData: kms.Context{"MinIO admin API": "ServerInfoHandler"}, // Context for a test key operation
				})
				if err != nil {
					if errors.Is(err, kes.ErrKeyNotFound) {
						rpt.SetStatus(bucket, fileName, errKMSKeyNotFound)
						continue
					}
					rpt.SetStatus(bucket, fileName, err)

* Fix [broken service accounts when using dedicated service account key](https://github.com/kubernetes/kubernetes/issues/44285). ([#44169](https://github.com/kubernetes/kubernetes/pull/44169), [@mikedanese](https://github.com/mikedanese))

$preloader.children().hide()\n        }, 200)\n      }\n    }, this._config.preloadDuration)\n  }\n\n  _max(numbers) {\n    // Calculate the maximum number in a list\n    let max = 0\n\n    Object.keys(numbers).forEach(key => {\n      if (numbers[key] > max) {\n        max = numbers[key]\n      }\n    })\n\n    return max\n  }\n\n  _isFooterFixed() {\n    return $(SELECTOR_FOOTER).css('position') === 'fixed'\n  }\n\n  // Static\n\n  static _jQueryInterface(config = '') {\n    return this.each(function...

- kube-controller-manager
  - The deprecated `--insecure-experimental-approve-all-kubelet-csrs-for-group` flag has been removed.
- kubelet
  - The deprecated `--google-json-key` flag has been removed. Remove the `--google-json-key` flag from kubelet invocations before upgrading. ([#69354](https://github.com/kubernetes/kubernetes/pull/69354), [@yujuhong](https://github.com/yujuhong))

* The `kube-cloud-controller-manager` flag `--service-account-private-key-file` was non-functional and is now deprecated. ([#50289](https://github.com/kubernetes/kubernetes/pull/50289), [@liggitt](https://github.com/liggitt))
    * The `kube-cloud-controller-manager` flag `--use-service-account-credentials` is now honored consistently, regardless of whether `--service-account-private-key-file` was specified.

- Kubeadm: during execution of the `certs check-expiration` command, treat the etcd CA as external if there is a missing etcd CA key file (etcd/ca.key) and perform the proper validation on certificates signed by the etcd CA....