pkg go/types, type Info struct, Defs map[*ast.Ident]Object
pkg go/types, type Info struct, Implicits map[ast.Node]Object
pkg go/types, type Info struct, InitOrder []*Initializer
pkg go/types, type Info struct, Scopes map[ast.Node]*Scope
pkg go/types, type Info struct, Selections map[*ast.SelectorExpr]*Selection
pkg go/types, type Info struct, Types map[ast.Expr]TypeAndValue
pkg go/types, type Info struct, Uses map[*ast.Ident]Object

  // If not specified, the quota matches all objects.
  // +optional
  repeated string scopes = 2;

  // scopeSelector is also a collection of filters like scopes that must match each object tracked by a quota
  // but expressed using ScopeSelectorOperator in combination with possible values.
  // For a resource to match, both scopes AND scopeSelector (if specified in spec), must be matched.
  // +optional

    *   `tf.distribute.experimental.ParameterServerStrategy` now supports
        training with Keras `Model.fit` when used with `DatasetCreator`.
    *   Creating `tf.random.Generator` under `tf.distribute.Strategy` scopes is
        now allowed (except for
        `tf.distribute.experimental.CentralStorageStrategy` and
        `tf.distribute.experimental.ParameterServerStrategy`). Different

    * Role bindings since the default scopes now include the "userinfo.email"
    * scope. This is a breaking change if the numeric uniqueIDs of the Google
    * service accounts were being used in RBAC role bindings. The behavior
    * can be overridden by explicitly specifying the scope values as
    * comma-separated string in the "users[*].config.scopes" field in the
    * KUBECONFIG file.

ecret","value":""},{"key":"claim_name","value":"policy"},{"key":"claim_userinfo","value":""},{"key":"role_policy","value":""},{"key":"claim_prefix","value":""},{"key":"redirect_uri","value":""},{"key":"redirect_uri_dynamic","value":"off"},{"key":"scopes","value":""},{"key":"vendor","value":""},{"key":"keycloak_realm","value":""},{"key":"keycloak_admin_url","value":""}]},"identity_plugin":{"_":[{"key":"url","value":""},{"key":"auth_token","value":""},{"key":"role_policy","value":""},{"key":"role_...

### Not Very Notable (that is, non-user-facing)

- Unit tests have been added for scopes and scope selectors in the quota spec ([#66351](https://github.com/kubernetes/kubernetes/pull/66351), [@vikaschoudhary16](https://github.com/vikaschoudhary16)) Courtesy of SIG Node, and SIG Scheduling

- Volume mount cleanup now considers only plugin directory and not the entire kubelet root ([#112607](https://github.com/kubernetes/kubernetes/pull/112607), [@mattcary](https://github.com/mattcary))
- `kubectl` now escapes terminal special characters in output. This fixes CVE-2021-25743.
   ([#112553](https://github.com/kubernetes/kubernetes/pull/112553), [@dgl](https://github.com/dgl))

### Other (Cleanup or Flake)

  * The oidc client plugin has reduce round trips and fix scopes requested ([#45317](https://github.com/kubernetes/kubernetes/pull/45317), [@ericchiang](https://github.com/ericchiang))