- Masks ceph RBD adminSecrets in logs when logLevel >= 4 ([#95245](https://github.com/kubernetes/kubernetes/pull/95245), [@sfowl](https://github.com/sfowl)) [SIG Storage]
- Vsphere: improve logging message on node cache refresh event ([#95236](https://github.com/kubernetes/kubernetes/pull/95236), [@andrewsykim](https://github.com/andrewsykim)) [SIG Cloud Provider]

## Dependencies

### Added
_Nothing has changed._

### Changed

- Fixed an issue blocking azure auth to prompt to device code authentication flow when refresh token expires. ([#102063](https://github.com/kubernetes/kubernetes/pull/102063), [@tdihp](https://github.com/tdihp))

  - Add support for Apache CloudStack
  
  ### AWS
  - Regenerate list of EC2 instances
  - Fix pricing endpoint in AWS China Region
  
  ### Azure
  - Add optional jitter on initial VMSS VM cache refresh, keep the refreshes spread over time
  - Serve from cache for the whole period of ongoing throttling
  - Fix unwanted VMSS VMs cache invalidations
  - Enforce setting the number of retries if cloud provider backoff is enabled

   * acquire(10) request arriving. We serve the request partly from storedPermits, using all the
   * remaining 7.0 permits, and the remaining 3.0, we serve them by fresh permits produced by the
   * rate limiter.
   *
   * We already know how much time it takes to serve 3 fresh permits: if the rate is
   * "1 token per second", then this will take 3 seconds. But what does it mean to serve 7 stored

            // Create fresh authentication
            NtlmPasswordAuthentication auth = new NtlmPasswordAuthentication(baseContext, WORKGROUP, USERNAME, PASSWORD);
            CIFSContext result = baseContext.withCredentials(auth);

            // Add a unique identifier to help with debugging
            log.debug("Created fresh context for test isolation: {}", System.currentTimeMillis());

			name:           "Correct-Decom-Pool-Removed",
			expectedErr:    false,
			expectedUpdate: true,
		},
		{
			meta:           poolMeta{}, // no-pool info available fresh setup.
			pools:          pools,
			name:           "Correct-Fresh-Setup",
			expectedErr:    false,
			expectedUpdate: true,
		},
		{
			meta:           nmeta2,
			pools:          orderChangePools,

      - name: Checkout minio-iam-testing
        uses: actions/checkout@v4
        with:
          repository: minio/minio-iam-testing
          path: minio-iam-testing
      - name: Test import of IAM artifacts when in fresh cluster there are missing groups etc
        run: |
          make test-iam-import-with-missing-entities
  iam-import-with-openid:
    name: Test IAM import in new cluster with opendid configurations

        if (mustRevalidate) append("must-revalidate, ")
        if (maxStaleSeconds != -1) append("max-stale=").append(maxStaleSeconds).append(", ")
        if (minFreshSeconds != -1) append("min-fresh=").append(minFreshSeconds).append(", ")
        if (onlyIfCached) append("only-if-cached, ")
        if (noTransform) append("no-transform, ")
        if (immutable) append("immutable, ")
        if (isEmpty()) return ""

        .onlyIfCached()
        .noTransform()
        .immutable()
        .build()
    assertThat(cacheControl.toString()).isEqualTo(
      "no-cache, no-store, max-age=1, max-stale=2, min-fresh=3, only-if-cached, " +
        "no-transform, immutable",
    )
    assertThat(cacheControl.noCache).isTrue()
    assertThat(cacheControl.noStore).isTrue()
    assertThat(cacheControl.maxAgeSeconds).isEqualTo(1)

        /**
         * Verifies that isStale returns false for a fresh handle.
         */
        @Test
        public void testIsStale_ReturnsFalseWhenNotStale() {
            when(smbPipeHandle.isStale()).thenReturn(false);
            assertFalse(smbPipeHandle.isStale(), "isStale() should return false for a fresh handle.");
        }

        /**