- fluentd-gcp has been updated to v3.2.0 ([#70954](https://github.com/kubernetes/kubernetes/pull/70954))
- OIDC authentication is unchanged at coreos/go-oidc v2 since Kubernetes 1.10 ([#58544](https://github.com/kubernetes/kubernetes/pull/58544))
- Calico was updated to v3.3.1 ([#70932](https://github.com/kubernetes/kubernetes/pull/70932))

#ñ]°” “Ž‡Së¸| À®Û]rß ={ï ê4tÔ±#Â&ÅònüA©L eR ³.D µ {ÏG±ÜãG+ò ¨ ¨ =KnduÂUwgf*}`XGF ïJ6æȪ%¼®Ä(ÆÔ1! WðCçOG.¯«è¼ ¡Cž{* ØKìÿJ#z©ÿ,q]Á ë÷KD[9 ½ÈO, Ø Þ«ó‹’Ÿ9§B‰¹þÇÝül0 ê–‰y¹Æõ4ôH¤£Î*Ø ðYcÖ(é ·@½ ´íO¤@×Ü7¤ãÌæ¸ø ®ù&û 3R[F2é ^1-VÆ«ë CŸ7âêÂv ]ÃßmšTb rÞH?ÐÇ’˜ˆ#á%òïÐF‹ âêþ :3LÝœóKìh ô ­ä Õ*ʬ% ŽðÑDë k§K‡ýU oRÁ k2s:’PRºï%§ >’ô @…½s ‹Îµ2Ûf&õ ‚«+e Öô݉´ ƒÜ[ H d-<%,A¸ ˆ¯2ñ²ÄÊõ짦cïÞ\kSbSÛGxz™qëÄ •â›#®Šfy÷ŸémøYw´vw vßA÷ï ²í ]|*ŠõÑÅ Ÿ€ þ6Å™#C ~ÖëŒð%g å Dª?w \Ô%e‹3Òe'¯ó rIK î.ª¤œ $ ® Ø ðIh„×£‰æ¦Ž§ ˜ 0Q ¦öÖè?^ÌfI²,4#Üaî\P...

meSelector","expectedNodeName","pattern","operator","check","result","what","_argument","simple","forward","ofType","_context","xml","outerCache","nodeIndex","start","parent","useCache","diff","firstChild","lastChild","pseudo","args","setFilters","idx","matched","not","matcher","compile","unmatched","has","lang","elemLang","hash","location","root","focus","activeElement","err","safeActiveElement","hasFocus","href","tabIndex","enabled","checked","selected","selectedIndex","empty","nextSibling","h...

- Kube-apiserver: Fixed OIDC discovery document publishing when external service account token signing was enabled. ([#131493](https://github.com/kubernetes/kubernetes/pull/131493), [@hoskeri](https://github.com/hoskeri)) [SIG API Machinery, Auth and Testing]

meSelector","expectedNodeName","pattern","operator","check","result","what","_argument","simple","forward","ofType","_context","xml","outerCache","nodeIndex","start","parent","useCache","diff","firstChild","lastChild","pseudo","args","setFilters","idx","matched","not","matcher","compile","unmatched","has","lang","elemLang","hash","location","root","focus","activeElement","err","safeActiveElement","hasFocus","href","tabIndex","enabled","checked","selected","selectedIndex","empty","nextSibling","h...

### API Change

- '`kube-apiserver`: adds `--authentication-config` flag for reading `AuthenticationConfiguration`
  files. `--authentication-config` flag is mutually exclusive with the existing `--oidc-*`
  flags.' ([#119142](https://github.com/kubernetes/kubernetes/pull/119142), [@aramase](https://github.com/aramase))
- '`kube-scheduler` component config (`KubeSchedulerConfiguration`) `kubescheduler.config.k8s.io/v1beta3`

- Ingress glbc is unchanged from 1.10: v1.0.0 ([#61302](https://github.com/kubernetes/kubernetes/pull/61302))
- OIDC authentication is unchanged from 1.10: coreos/go-oidc v2 ([#58544](https://github.com/kubernetes/kubernetes/pull/58544))
- Calico is unchanged from 1.10: v2.6.7 ([#59130](https://github.com/kubernetes/kubernetes/pull/59130))

- Resolves an issue with the "ServiceAccountIssuerDiscovery should support OIDC discovery" conformance test failing on clusters which are configured with issuers outside the cluster ([#101589](https://github.com/kubernetes/kubernetes/pull/101589), [@mtaufen](https://github.com/mtaufen)) [SIG Auth and Testing]

* Bug fixes:

  * Make gcp auth provider not to override the Auth header if it's already exits ([#45575](https://github.com/kubernetes/kubernetes/pull/45575), [@wanghaoran1988](https://github.com/wanghaoran1988))

  * The oidc client plugin has reduce round trips and fix scopes requested ([#45317](https://github.com/kubernetes/kubernetes/pull/45317), [@ericchiang](https://github.com/ericchiang))

- Kube-apiserver: fixes a 1.32+ regression validating OIDC and anonymous authentication flags are mutually exclusive to authentication configuration. Fixes an issue where the kube-apiserver `/flagz` endpoint would not respond correctly with parsed flags value. ([#130332](https://github.com/kubernetes/kube...