- The kube-controller-manager's deprecated `--experimental-cluster-signing-duration` flag is now removed. Adapt your machinery to use the `--cluster-signing-duration` flag that is available since v1.19. ([#108476](https://github.com/kubernetes/kubernetes/pull/108476), [@ialidzhikov](https://github.com/ialidzhikov))

pkg syscall (freebsd-arm64), const SIGCONT Signal
pkg syscall (freebsd-arm64), const SIGEMT = 7
pkg syscall (freebsd-arm64), const SIGEMT Signal
pkg syscall (freebsd-arm64), const SIGINFO = 29
pkg syscall (freebsd-arm64), const SIGINFO Signal
pkg syscall (freebsd-arm64), const SIGIO = 23
pkg syscall (freebsd-arm64), const SIGIO Signal
pkg syscall (freebsd-arm64), const SIGIOT = 6

pkg syscall (darwin-arm64), const SIGCONT Signal
pkg syscall (darwin-arm64), const SIGEMT = 7
pkg syscall (darwin-arm64), const SIGEMT Signal
pkg syscall (darwin-arm64), const SIGINFO = 29
pkg syscall (darwin-arm64), const SIGINFO Signal
pkg syscall (darwin-arm64), const SIGIO = 23
pkg syscall (darwin-arm64), const SIGIO Signal
pkg syscall (darwin-arm64), const SIGIOT = 6
pkg syscall (darwin-arm64), const SIGIOT Signal

pkg syscall (netbsd-arm64-cgo), const SIGCONT Signal
pkg syscall (netbsd-arm64-cgo), const SIGEMT = 7
pkg syscall (netbsd-arm64-cgo), const SIGEMT Signal
pkg syscall (netbsd-arm64-cgo), const SIGINFO = 29
pkg syscall (netbsd-arm64-cgo), const SIGINFO Signal
pkg syscall (netbsd-arm64-cgo), const SIGIO = 23
pkg syscall (netbsd-arm64-cgo), const SIGIO Signal
pkg syscall (netbsd-arm64-cgo), const SIGIOT = 6

pkg syscall (darwin-386), const SIGBUS = 10
pkg syscall (darwin-386), const SIGCHLD = 20
pkg syscall (darwin-386), const SIGCONT = 19
pkg syscall (darwin-386), const SIGEMT = 7
pkg syscall (darwin-386), const SIGINFO = 29
pkg syscall (darwin-386), const SIGIO = 23
pkg syscall (darwin-386), const SIGIOT = 6
pkg syscall (darwin-386), const SIGPROF = 27
pkg syscall (darwin-386), const SIGSTOP = 17

  - [Major Themes](#major-themes)
    - [Dockershim Removed from kubelet](#dockershim-removed-from-kubelet)
    - [Beta APIs Off by Default](#beta-apis-off-by-default)
    - [Signing Release Artifacts](#signing-release-artifacts)
    - [OpenAPI v3](#openapi-v3)
    - [Storage Capacity and Volume Expansion Are Generally Available](#storage-capacity-and-volume-expansion-are-generally-available)

* Native support for token based bootstrap flow.  This includes signing a well known ConfigMap in the `kube-public` namespace and cleaning out expired tokens. ([#36101](https://github.com/kubernetes/kubernetes/pull/36101), [@jbeda](https://github.com/jbeda))

### ConfigMap

- kube-apiserver: `--service-account-max-token-expiration` can now be used in combination with an external token signer `--service-account-signing-endpoint`, as long as the `--service-account-max-token-expiration` is not longer than the external token signer's max expiration. ([#129816](https://github.com/kubernetes/kubernetes/pull/129816), [@sambdavidson](https://github.com/sambdavidson)) [SIG...

pkg syscall (freebsd-riscv64), const SIGEMT = 7 #53466
pkg syscall (freebsd-riscv64), const SIGEMT Signal #53466
pkg syscall (freebsd-riscv64), const SIGINFO = 29 #53466
pkg syscall (freebsd-riscv64), const SIGINFO Signal #53466
pkg syscall (freebsd-riscv64), const SIGIO = 23 #53466
pkg syscall (freebsd-riscv64), const SIGIO Signal #53466
pkg syscall (freebsd-riscv64), const SIGIOT = 6 #53466

### SIG Auth

- TokenRequest and TokenRequestProjection are now beta features. To enable these feature, the API server needs to be started with the `--service-account-issuer`, `--service-account-signing-key-file`, and `--service-account-api-audiences` flags.
([#67349](https://github.com/kubernetes/kubernetes/pull/67349), [@mikedanese](https://github.com/mikedanese))