return jwtClaims, err
}

func validateSvcExpirationInUTC(expirationInUTC time.Time) error {
	if expirationInUTC.IsZero() || expirationInUTC.Equal(timeSentinel) {
		// Service accounts might not have expiration in older releases.
		return nil
	}

	currentTime := time.Now().UTC()
	minExpiration := currentTime.Add(minServiceAccountExpiry)
	maxExpiration := currentTime.Add(maxServiceAccountExpiry)

- `kubeadm`: will now allow deploying a kubelet that is 3 versions older than the version of `kubeadm` (N-3). This aligns with the recent change made by SIG Architecture that extends the support skew between the control plane and kubelets. Tolerate this new kubelet skew for the commands `init`, `join` and `upgrade`. Note that if the `kubeadm` user applies a control plane version that is older than the `kubeadm` version (N-1 maximum) then the skew between the kubelet and control...

quite natural to Alice to find herself talking familiarly with
them, as if she had known them all her life.  Indeed, she had
quite a long argument with the Lory, who at last turned sulky,
and would only say, `I am older than you, and must know better';
and this Alice would not allow without knowing how old it was,
and, as the Lory positively refused to tell its age, there was no
more to be said.

## Changelog since v1.16.10

## Changes by Kind

### API Change

- Resolve regression in metadata.managedFields handling in update/patch requests submitted by older API clients ([#91748](https://github.com/kubernetes/kubernetes/pull/91748), [@apelisse](https://github.com/apelisse)) [SIG API Machinery and Testing]

### Feature

  
  To allow cgroups v1 with `kubeadm` and `kubelet` version `v1.35` or newer, you must:
  - Ignore the error from the SystemVerification preflight check by `kubeadm`.

    <glob pattern="*.ai"/>
    <sub-class-of type="application/pdf"/>
  </mime-type>
  <mime-type type="application/illustrator+ps">
    <acronym>AI</acronym>
    <_comment>Adobe Illustrator Artwork -- the older postscript based AI files</_comment>
    <!-- we can do more specific versions by focusing on the integer in the regex below -->
    <tika:link>http://justsolve.archiveteam.org/wiki/Adobe_Illustrator_Artwork</tika:link>

however, kubectl v1.21 and older do not support the new API for ephemeral containers.

    /** The key of the message: Schedule */
    public static final String LABELS_CRON_EXPRESSION = "{labels.cronExpression}";

    /** The key of the message: Delete documents older than specified days */
    public static final String LABELS_DAY_FOR_CLEANUP = "{labels.dayForCleanup}";

    /** The key of the message: Concurrent Crawling Count */

- Resolve regression in `metadata.managedFields` handling in update/patch requests submitted by older API clients ([#91748](https://github.com/kubernetes/kubernetes/pull/91748), [@apelisse](https://github.com/apelisse))

            and newer CPUs.)
            *   [Example performance speedups.](https://medium.com/intel-analytics-software/leverage-intel-deep-learning-optimizations-in-tensorflow-129faa80ee07)
        *   For older CPUs, oneDNN optimizations are disabled by default.
    *   **Windows x86 package:** oneDNN optimizations are disabled by default.
    *   **Linux aach64 (`--config=mkl_aarch64`) package:**