- E2e tests wait for kube-root-ca.crt to be populated in namespaces for use with projected service account tokens, reducing delays starting those test pods and errors in the logs. ([#108860](https://github.com/kubernetes/kubernetes/pull/108860), [@eddiezane](https://github.com/eddiezane)) [SIG Testing]

          }
          remainingSetBits &= ~(1 << index);
          return elements.get(index);
        }
      };
    }

    @Override
    public int size() {
      return Integer.bitCount(mask);
    }

    @Override
    public boolean contains(@Nullable Object o) {
      Integer index = inputSet.get(o);
      return index != null && (mask & (1 << index)) != 0;
    }
  }

- `kube-controller-manager`: The `LegacyServiceAccountTokenCleanUp` feature gate
  is now available as alpha (off by default). When enabled, the `legacy-service-account-token-cleaner`
  controller loop removes service account token secrets that have not been used
  in the time specified by `--legacy-service-account-token-clean-up-period` (defaulting
  to one year), **and are** referenced from the `.secrets` list of a ServiceAccount

- Get-kube.sh uses the gcloud's current local GCP service account for auth when the provider is GCE or GKE instead of the metadata server default ([#88383](https://github.com/kubernetes/kubernetes/pull/88383), [@BenTheElder](https://github.com/BenTheElder)) [SIG Cluster Lifecycle]

        } catch (final Exception e) {
            throw new OpenSearchAccessException("Failed to check if " + sessionId + ":" + url + " exists.", e);
        }
    }

    /**
     * Gets the count of documents matching the search criteria.
     *
     * @param callback The callback to configure the search request.
     * @return The number of matching documents.
     */

    // for 5.5 seconds happens about 2% of the time.
    boolean longWait = NANOSECONDS.toSeconds(thread.timeSpentBlocked) >= 5;
    // Count how long it actually took to return; we'll accept any number between the expected delay
    // and the approximate actual delay, to be robust to variance in thread scheduling.
    char overWaitNanosFirstDigit =

issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a service account may only reference secrets specified in the service account's secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the `kubernetes.io/enforce-mountable-secrets` annotation are used together with ephemeral...

  // Example taken from twitter/hpack DecoderTest.testInsidiousMaxHeaderSize
  @Test
  fun readHeaderTableStateChangeInsidiousMaxHeaderByteCount() {
    bytesIn.writeByte(0x3f)
    bytesIn.write("e1ffffff07".decodeHex()) // count = -2147483648
    assertFailsWith<IOException> {
      hpackReader!!.readHeaders()
    }.also { expected ->
      assertThat(expected.message)
        .isEqualTo("Invalid dynamic table size update -2147483648")
    }

    }
    ```

    This above code relies on this `responseCount` extension val:

    ```kotlin
    val Response.responseCount: Int
      get() = generateSequence(this) { it.priorResponse }.count()
    ```
=== ":material-language-java: Java"
    ```java
      private final OkHttpClient client;

      public Authenticate() {
        client = new OkHttpClient.Builder()

* Error while tearing down pod, "device or resource busy" on service account secret ([28750](https://github.com/kubernetes/kubernetes/issues/28750))



# v1.3.2

[Documentation](http://kubernetes.github.io) & [Examples](http://releases.k8s.io/release-1.3/examples)

## Downloads