- JWT authenticators now set the `jti` claim (if present and is a string value) as credential id for use by audit logging. ([#127010](https://github.com/kubernetes/kubernetes/pull/127010), [@aramase](https://github.com/aramase)) [SIG API Machinery, Auth and Testing]

default `admin.conf` was bound to `system:masters` Group, which was undesired. Executing `kubeadm init phase kubeconfig all` or just `kubeadm init` will now generate the new `super-admin.conf` file. The cluster admin can then decide to keep the file present on a node host or move it to a safe location. `kubadm certs renew` will renew the certificate in `super-admin.conf` to one year if the file exists; if it does not exist a "MISSING" note will be printed. `kubeadm upgrade apply` for this release will...

                    throw new SmbException("Account '" + username + "' is locked out until " + account.getLockoutExpiry());
                } else {
                    // Lockout expired, reset
                    account.reset();
                }
            }
        }

        // Check per-IP limit
        if (sourceIp != null) {

- During device plugin allocation, resources requested by the pod can only be allocated if the device plugin has registered itself to kubelet AND healthy devices are present on the node to be allocated. If these conditions are not sattisfied, the pod would fail with `UnexpectedAdmissionError` error. ([#116337](https://github.com/kubernetes/kubernetes/pull/116337), [@swatisehgal](https://github.com/swatisehgal)) [SIG Node...

	if n == 0 {
		b.Reset()
		return
	}
	b.lastRead = opInvalid
	if n < 0 || n > b.Len() {
		panic("bytes.Buffer: truncation out of range")
	}
	b.buf = b.buf[:b.off+n]
}

// Reset resets the buffer to be empty,
// but it retains the underlying storage for use by future writes.
// Reset is the same as [Buffer.Truncate](0).
func (b *Buffer) Reset() {
	b.buf = b.buf[:0]
	b.off = 0

- Bug fixes for EndpointSlice controller that prevent race condition and modifying shared objects. ([#87731](https://github.com/kubernetes/kubernetes/pull/87731), [@robscott](https://github.com/robscott)) [SIG Apps and Network]

        assertEquals(State.OPEN, circuitBreaker.getState(), "Circuit should be OPEN");

        // Manually reset
        circuitBreaker.reset();
        assertEquals(State.CLOSED, circuitBreaker.getState(), "Circuit should be CLOSED after reset");
        assertEquals(0, circuitBreaker.getFailureCount(), "Failure count should be reset");
    }

    @Test
    public void testCustomFailureDetection() throws CIFSException {

            log.error("Failed to reset SingletonContext instance", e);
            fail("Failed to reset SingletonContext instance: " + e.getMessage());
        }
        // Clear system properties that might affect the test
        System.clearProperty("jcifs.properties");
        System.clearProperty("java.protocol.handler.pkgs");
        // Clear jcifs-specific properties to prevent test interference

- Fixed kubelet startup getting stuck with `NewVolumeManagerReconstruction` feature enabled and a CSI volume present in /var/lib/kubelet/pods. ([#117804](https://github.com/kubernetes/kubernetes/pull/117804), [@jsafrane](https://github.com/jsafrane)) [SIG Node and Storage]

   */
  fun newClient(): OkHttpClient {
    var client = testClient
    if (client == null) {
      client =
        initialClientBuilder()
          .dns(SINGLE_INET_ADDRESS_DNS) // Prevent unexpected fallback addresses.
          .eventListenerFactory { ClientRuleEventListener(logger = ::addEvent) }
          .build()
      connectionListener.forbidLock(RealConnectionPool.get(client.connectionPool))