- Allowed creating ServiceAccount tokens bound to Node objects.
  This allows users to bind a service account token's validity to a named Node object, similar to Pod bound tokens.

## Changelog since v1.5.5

### Other notable changes

* kube-up (with gce/gci and gce/coreos providers) now ensures the authentication token file contains correct tokens for the control plane components, even if the file already exists (ensures upgrades and downgrades work successfully) ([#43676](https://github.com/kubernetes/kubernetes/pull/43676), [@liggitt](https://github.com/liggitt))

pkg debug/pe, const IMAGE_DIRECTORY_ENTRY_TLS ideal-int
pkg debug/pe, const IMAGE_FILE_MACHINE_ARM64 = 43620
pkg debug/pe, const IMAGE_FILE_MACHINE_ARM64 ideal-int
pkg go/ast, type CompositeLit struct, Incomplete bool
pkg go/token, method (*File) AddLineColumnInfo(int, string, int, int)
pkg go/types, func NewInterfaceType([]*Func, []Type) *Interface
pkg go/types, method (*Interface) EmbeddedType(int) Type
pkg go/types, method (*Var) Embedded() bool

.Values.metrics.serviceMonitor.relabelConfigs }} {{ toYaml .Values.metrics.serviceMonitor.relabelConfigs | indent 6 }} {{- end }} {{- if not .Values.metrics.serviceMonitor.public }} bearerTokenSecret: name: {{ template "minio.fullname" . }}-prometheus key: token {{- end }} namespaceSelector: matchNames: - {{ .Release.Namespace | quote }} selector: matchLabels: app: {{ include "minio.name" . }} release: {{ .Release.Name }} monitoring: "true" {{- end }} {{- if .Values.metrics.serviceMonitor.enabled }} --- apiVersion:...

.Values.metrics.serviceMonitor.relabelConfigs }} {{ toYaml .Values.metrics.serviceMonitor.relabelConfigs | indent 6 }} {{- end }} {{- if not .Values.metrics.serviceMonitor.public }} bearerTokenSecret: name: {{ template "minio.fullname" . }}-prometheus key: token {{- end }} namespaceSelector: matchNames: - {{ .Release.Namespace | quote }} selector: matchLabels: app: {{ include "minio.name" . }} release: {{ .Release.Name }} monitoring: "true" {{- end }} {{- if .Values.metrics.serviceMonitor.enabled }} --- apiVersion:...

	if err != nil {
		writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
		return
	}

	writeSuccessResponseJSON(w, encryptedData)
}

// RevokeTokens - POST /minio/admin/v3/revoke-tokens/{userProvider}
func (a adminAPIHandlers) RevokeTokens(w http.ResponseWriter, r *http.Request) {
	ctx := r.Context()

	// Get current object layer instance.
	objectAPI := newObjectLayerFn()

- Fixed ambiguous behavior when bearer token (kubectl --token=..) and an exec credential plugin was configured in the same context - the bearer token now takes precedence. ([#91745](https://github.com/kubernetes/kubernetes/pull/91745), [@anderseknert](https://github.com/anderseknert)) [SIG API Machinery, Auth and Testing]

    // (2) "Dolphin". If we're rotating an array a of size n by a distance of d, then element a[0]
    //     ends up at a[d], which in turn ends up at a[2d], and so on until we get back to a[0].
    //     (All indices taken mod n.) If d and n are mutually prime, all elements will have been
    //     moved at that point. Otherwise, we can rotate the cycle a[1], a[1 + d], a[1 + 2d], etc,

.Values.metrics.serviceMonitor.scrapeTimeout }} scrapeTimeout: {{ .Values.metrics.serviceMonitor.scrapeTimeout }} {{- end }} {{- if not .Values.metrics.serviceMonitor.public }} bearerTokenSecret: name: {{ template "minio.fullname" . }}-prometheus key: token {{- end }} namespaceSelector: matchNames: - {{ .Release.Namespace | quote }} selector: matchLabels: app: {{ include "minio.name" . }} release: {{ .Release.Name }} monitoring: true {{- end }} minio/templates/statefulset.yaml {{- if eq .Values.mode "distributed"...

    assertThat(response.cacheResponse!!.request.url).isEqualTo(request.url)
  }

  @Test
  fun postWithOverrideResponse() {
    val url = server.url("/abc?token=123")
    val cacheUrlOverride = url.newBuilder().removeAllQueryParameters("token").build()

    val request =
      Request
        .Builder()
        .url(url)
        .method("POST", "XYZ".toRequestBody())