- Encrypted data with DEK using AES-GCM instead of AES-CBC for kms data encryption. No user action required. Reads with AES-GCM and AES-CBC will continue to be allowed. ([#111119](https://github.com/kubernetes/kubernetes/pull/111119), [@aramase](https://github.com/aramase))...

### Bug or Regression

- Fixed a bug where clusters that use KMS v1 with skewed API servers on versions v1.24 and v1.25 would see internal errors when attempting to read encrypted data via the v1.24 API servers. ([#119387](https://github.com/kubernetes/kubernetes/pull/119387), [@enj](https://github.com/enj)) [SIG API Machinery and Auth]

## Dependencies

### Added
_Nothing has changed._

src) } func (x *CBCDecrypter) SetIV(iv []byte) { if len(iv) != len(x.iv) { panic("cipher: incorrect length IV") } copy(x.iv[:], iv) } func cryptBlocksDecGeneri(b *Block, civ *[BlockSize]byte, dst, src []byte) { // For each block, we need to xor the decrypted data with the previous // block's ciphertext (the iv). To avoid making a copy each time, we loop // over the blocks backwards. end := len(src) start := end - BlockSize prev := start - BlockSize // Copy the last block of ciphertext as the IV of the...

src) } func (x *CBCDecrypter) SetIV(iv []byte) { if len(iv) != len(x.iv) { panic("cipher: incorrect length IV") } copy(x.iv[:], iv) } func cryptBlocksDecGeneri(b *Block, civ *[BlockSize]byte, dst, src []byte) { // For each block, we need to xor the decrypted data with the previous // block's ciphertext (the iv). To avoid making a copy each time, we loop // over the blocks backwards. end := len(src) start := end - BlockSize prev := start - BlockSize // Copy the last block of ciphertext as the IV of the...