- The deprecated `--etcd-quorum-read` flag has been removed. Quorum reads are now always enabled when fetching data from etcd. Remove the `--etcd-quorum-read` flag from kube-apiserver invocations before upgrading.
- kube-controller-manager
  - The deprecated `--insecure-experimental-approve-all-kubelet-csrs-for-group` flag has been removed.
- kubelet

   * it should be interpreted as a pattern. This flag will be false if its `Set-Cookie` header
   * included a `domain` attribute.
   *
   * For example, suppose the cookie's domain is `example.com`. If this flag is true it matches
   * **only** `example.com`. If this flag is false it matches `example.com` and all subdomains

 * finalization to happen. However, a call to {@code System.gc()} is specified to be no more than a
 * hint, so this technique may fail at the whim of the JDK implementation, for example if a user
 * specified the JVM flag {@code -XX:+DisableExplicitGC}. But in practice, it works very well for
 * ordinary tests.
 *
 * <p>Failure of the expected event to occur within an implementation-defined "reasonable" time

    private int userLifetime = GSSCredential.DEFAULT_LIFETIME;
    /** The security context lifetime */
    private int contextLifetime = GSSContext.DEFAULT_LIFETIME;
    /** Flag indicating if fallback authentication is allowed */
    private boolean canFallback = false;
    /** Flag to force fallback authentication */
    private boolean forceFallback;

    static {
        PREFERRED_MECHS.add(new ASN1ObjectIdentifier("1.2.840.113554.1.2.2"));

            TestIterator.staticThrowOnOpen = true; // Set flag before constructor
            try {
                TestIterator.create(tree, parent, "*", null, 0, entry("first"), pages);
            } finally {
                TestIterator.staticThrowOnOpen = false; // Reset flag
            }
        });
        assertEquals("open fail", ex.getMessage());

            assertFalse(standardInfo.deletePending);
            assertFalse(standardInfo.directory);
        }

        @Test
        @DisplayName("Should handle directory flag")
        void testStandardInfoDirectory() {
            Trans2QueryPathInformationResponse.SmbQueryFileStandardInfo standardInfo = response.new SmbQueryFileStandardInfo();

            standardInfo.directory = true;

     *
     * @return whether signing has been negotiated
     */
    boolean isSigningNegotiated();

    /**
     * Checks whether a specific capability has been negotiated.
     *
     * @param cap the capability flag to check
     * @return whether capability is negotiated
     */
    boolean haveCapabilitiy(int cap);

    /**
     * Gets the negotiated send buffer size.
     *
     * @return the send buffer size

     */
    protected int rdmaCredits;
    /**
     * Flag indicating whether RDMA is currently enabled and available
     */
    protected boolean rdmaEnabled = false;
    /**
     * Port number for RDMA connections (default: 5445)
     */
    protected int rdmaPort = 5445;
    // Witness protocol configuration fields
    /**
     * Flag indicating whether SMB Witness protocol should be used for failover
     */

    }

    /**
     * Test individual FLAGS2 constants.
     */
    @Test
    @DisplayName("FLAGS2 individual constants are correct")
    void flags2ConstantsTest() {
        // Test individual flag values
        assertEquals(0x0001, SmbConstants.FLAGS2_LONG_FILENAMES);
        assertEquals(0x0002, SmbConstants.FLAGS2_EXTENDED_ATTRIBUTES);
        assertEquals(0x0800, SmbConstants.FLAGS2_EXTENDED_SECURITY_NEGOTIATION);

which enabled external signing of service account tokens and fetching of public verifying keys. This was accomplished by enabling the beta `ExternalServiceAccountTokenSigner` feature gate and specifying the `--service-account-signing-endpoint` flag. The flag value could either be the path to a Unix domain socket on the filesystem, or be prefixed with @ to indicate a Unix domain socket in the abstract namespace. ([#131300](https://github.com/kubernetes/kubernetes/pull/131300), [@HarshalNeelkamal](...