- Expanded the on-disk kubelet credential provider configuration to allow an optional `tokenAttribute`...

double quotes <code>""</code> or back quotes <code>``</code>.
</p>

<p>
The form <code>a … b</code> represents the set of characters from
<code>a</code> through <code>b</code> as alternatives. The horizontal
ellipsis <code>…</code> is also used elsewhere in the spec to informally denote various
enumerations or code snippets that are not further specified. The character <code>…</code>

303C          ; valid                                  # 3.2  MASU MARK
303D          ; valid                  ;      ; NV8    # 3.2  PART ALTERNATION MARK
303E          ; valid                  ;      ; NV8    # 3.0  IDEOGRAPHIC VARIATION INDICATOR
303F          ; valid                  ;      ; NV8    # 1.1  IDEOGRAPHIC HALF FILL SPACE

The code which implements them will be removed in a future release, so users of those need to start replacing the deprecated flags with some alternative solutions.

### Software Supply Chain SLSA Level 1 Compliance in the Kubernetes Release Process

- New metrics: `apiserver_kube_aggregator_x509_missing_san_total` and `apiserver_webhooks_x509_missing_san_total`. This metric measures a number of connections to webhooks/aggregated API servers that use certificates without Subject Alternative Names. It being non-zero is a warning sign that these connections will stop functioning in the future since Golang is going to deprecate x509 certificate subject Common Names for server hostname verification. ([#95396](https://github.com/kubern...

- Remove the deprecated flag `--experimental-check-node-capabilities-before-mount`. With CSI now GA, there is a better alternative. Remove any use of  `--experimental-check-node-capabilities-before-mount` from your kubelet scripts or manifests. ([#104732](https://github.com/kubernetes/kubernetes/pull/104732), [@mengjiao-liu](https://github.com/mengjiao-liu))

    <glob pattern="*.vtu"/>
  </mime-type>

  <mime-type type="model/vrml">
    <glob pattern="*.wrl"/>
    <glob pattern="*.vrml"/>
  </mime-type>

  <mime-type type="multipart/alternative"/>

  <mime-type type="multipart/appledouble">
    <magic priority="50">
      <match value="0x00051607" type="string" offset="0"/>
    </magic>
  </mime-type>

    Corresponding Source from a network server at no charge.

    c) Convey individual copies of the object code with a copy of the
    written offer to provide the Corresponding Source.  This
    alternative is allowed only occasionally and noncommercially, and
    only if you received the object code with such an offer, in accord
    with subsection 6b.

  * There are known bugs that result in errors when querying Kubelet's stats summary API. We expect to fix them in v1.8.1.

#### kubelet

* [alpha] Kubelet now supports alternative container-level CPU affinity policies by using the new CPU manager. ([#375](https://github.com/kubernetes/enhancements/issues/375), [@sjenning](https://github.com/sjenning), [@ConnorDoyle](https://github.com/ConnorDoyle))