- Fix a bug that DefaultPreemption plugin is disabled when using (legacy) scheduler policy. ([#96472](https://github.com/kubernetes/kubernetes/pull/96472), [@Huang-Wei](https://github.com/Huang-Wei)) [SIG Scheduling and Testing]

			inspectZipW.Close()
			encStream.Close()
			stream.AddError(msg)
		}
		defer encStream.Close()

		inspectZipW = zip.NewWriter(encStream)
		defer inspectZipW.Close()
	} else {
		// Legacy: Remove if we stop supporting inspection without public key.
		var key [32]byte
		// MUST use crypto/rand
		n, err := crand.Read(key[:])
		if err != nil || n != len(key) {
			bugLogIf(ctx, err)

				opaCfg, err := opa.LookupConfig(s[config.PolicyOPASubSys][config.Default],
					NewHTTPTransport(), xhttp.DrainBody)
				if err != nil {
					iamLogIf(ctx, fmt.Errorf("Unable to initialize AuthZPlugin from legacy OPA config: %w", err))
				} else {
					authZPluginCfg.URL = opaCfg.URL
					authZPluginCfg.AuthToken = opaCfg.AuthToken
					authZPluginCfg.Transport = opaCfg.Transport

- Removed k8s.io/legacy-cloud-providers from staging. ([#124767](https://github.com/kubernetes/kubernetes/pull/124767), [@carlory](https://github.com/carlory)) [SIG API Machinery, Cloud Provider and Release]

- [aws] Fixed a bug which reduces the number of unnecessary calls to STS in the event of assume role failures in the legacy cloud provider ([#110706](https://github.com/kubernetes/kubernetes/pull/110706), [@prateekgogia](https://github.com/prateekgogia)) [SIG Cloud Provider]

## Dependencies

### Added
_Nothing has changed._

- Removed generally available feature-gate `ZeroLimitedNominalConcurrencyShares` ([#126894](https://github.com/kubernetes/kubernetes/pull/126894), [@carlory](https://github.com/carlory)) [SIG API Machinery]

- Introduced the `LegacySidecarContainers` feature gate enabling the legacy code path that predates the `SidecarContainers` feature. This temporary feature gate is disabled by default, only available in v1.33, and will be removed in v1.34. ([#130058](https://github.com/kubernetes/kubernetes/pull/130058), [@gjkim42](https...

- `kube-controller-manager`: The `LegacyServiceAccountTokenCleanUp` feature gate
  is now available as alpha (off by default). When enabled, the `legacy-service-account-token-cleaner`
  controller loop removes service account token secrets that have not been used
  in the time specified by `--legacy-service-account-token-clean-up-period` (defaulting
  to one year), **and are** referenced from the `.secrets` list of a ServiceAccount

## Changelog since v1.8.0-alpha.3

### Action Required

* New GCE or GKE clusters created with `cluster/kube-up.sh` will not enable the legacy ABAC authorizer by default. If you would like to enable the legacy ABAC authorizer, export ENABLE_LEGACY_ABAC=true before running `cluster/kube-up.sh`. ([#51367](https://github.com/kubernetes/kubernetes/pull/51367), [@cjcullen](https://github.com/cjcullen))

D,EAA9CtD,YAA8CsD,EAAnCrG,QAAW4C,IAAAA,OAAQjG,IAAAA,UAChC+O,EAAgB3I,EAAUmB,KAAVnB,CAAgB,GAAhBA,EAAqB,CAArBA,WAGlBuG,EAAU,EAAVA,EACQ,CAAC,EAAD,CAAU,CAAV,EAEAqC,WAGU,MAAlBD,QACKvM,KAAOa,EAAQ,CAARA,IACPX,MAAQW,EAAQ,CAARA,GACY,OAAlB0L,QACFvM,KAAOa,EAAQ,CAARA,IACPX,MAAQW,EAAQ,CAARA,GACY,KAAlB0L,QACFrM,MAAQW,EAAQ,CAARA,IACRb,KAAOa,EAAQ,CAARA,GACa,QAAlB0L,SACFrM,MAAQW,EAAQ,CAARA,IACRb,KAAOa,EAAQ,CAARA,KAGX4C,iBChHgBhD,KAAKgM,ML1DDhM,KAAViM,QAAUjM,KAAjB8J,S5BlBD9J,KAAKkM,OkCHmB,WAAlB,QAAOrQ,OAAP,EAAqD,W...