### CSI Service Account Token

CSI Service Account Token feature moves to Beta in 1.21. This feature improves the security posture and allows CSI drivers to receive pods' [bound service account tokens](https://github.com/kubernetes/enhancements/blob/master/keps/sig-auth/1205-bound-service-account-tokens/README.md). This feature also provides a knob to re-publish volumes so that short-lived volumes can be refreshed.

### CSI Health Monitoring

- Volume binding: report UnschedulableAndUnresolvable status instead of an error when bound PVs not found ([#96291](https://github.com/kubernetes/kubernetes/pull/96291), [@cofyc](https://github.com/cofyc)) [SIG Apps, Scheduling and Storage]

## Dependencies

### Added
_Nothing has changed._

# Release 2.9.1

Add an upper bound for `protobuf` in `setup.py` since `protobuf` after version 3.20 is currently incompatible with TensorFlow. See https://github.com/tensorflow/tensorflow/issues/53234, https://github.com/protocolbuffers/protobuf/issues/9954 and https://github.com/tensorflow/tensorflow/issues/56077.

# Release 2.8.2

- Volume binding: report UnschedulableAndUnresolvable status instead of an error when bound PVs not found ([#95541](https://github.com/kubernetes/kubernetes/pull/95541), [@cofyc](https://github.com/cofyc)) [SIG Apps, Scheduling and Storage]

- When using `kubectl logs <pod-name>` and the pod is not found, the error message now includes the namespace. Previously, the message would be "Error from server (NotFound): pods "my-pod-name" not found". Now, it reflects the namespace in the message as follows: "Error from server (NotFound): pods "my-pod-name" not found in namespace "default"".

            assertTrue(result.length > 0, "Result should not be empty");

            // Verify round-trip conversion
            String roundTrip = new String(result, StandardCharsets.UTF_16LE);
            assertEquals(UNICODE_STRING, roundTrip, "Round-trip conversion should preserve Unicode");
        }

        @Test
        @DisplayName("getASCIIBytes should encode string as ASCII")

* Fix race condition in setting node statusUpdateNeeded flag  ([#32807](https://github.com/kubernetes/kubernetes/pull/32807), [@jingxu97](https://github.com/jingxu97))
* kube-proxy: Add a lower-bound for conntrack (128k default) ([#33051](https://github.com/kubernetes/kubernetes/pull/33051), [@thockin](https://github.com/thockin))

* Tune down initialDelaySeconds for readinessProbe. ([#33146](https://github.com/kubernetes/kubernetes/pull/33146), [@MrHohn](https://github.com/MrHohn))
* kube-proxy: Add a lower-bound for conntrack (128k default) ([#33051](https://github.com/kubernetes/kubernetes/pull/33051), [@thockin](https://github.com/thockin))

    - `apiserver_flowcontrol_lower_limit_seats`: Configured lower bound on number of execution seats available to each priority level
    - `apiserver_flowcontrol_upper_limit_seats`: Configured upper bound on number of execution seats available to each priority level

		m.Set(sysCPULoadPerc, math.Round(perc*100)/100)
	}

	ts := cpuMetrics.TimesStat
	if ts != nil {
		tot := ts.User + ts.System + ts.Idle + ts.Iowait + ts.Nice + ts.Steal
		cpuUserVal := math.Round(ts.User/tot*100*100) / 100
		m.Set(sysCPUUser, cpuUserVal)
		cpuSystemVal := math.Round(ts.System/tot*100*100) / 100
		m.Set(sysCPUSystem, cpuSystemVal)
		cpuNiceVal := math.Round(ts.Nice/tot*100*100) / 100