- OIDC authentication will now fail if the username asserted based on a CEL expression config is the empty string.  Previously the request would be authenticated with the username set to the empty string. ([#123568](https://github.com/kubernetes/kubernetes/pull/123568),...

- github.com/coredns/caddy: [v1.1.0 → v1.1.1](https://github.com/coredns/caddy/compare/v1.1.0...v1.1.1)
- github.com/coreos/go-oidc: [v2.1.0+incompatible → v2.2.1+incompatible](https://github.com/coreos/go-oidc/compare/v2.1.0...v2.2.1)
- github.com/coreos/go-semver: [v0.3.0 → v0.3.1](https://github.com/coreos/go-semver/compare/v0.3.0...v0.3.1)

- fluentd-gcp is unchanged at v3.2.0 since Kubernetes 1.13 ([#70954](https://github.com/kubernetes/kubernetes/pull/70954))
- OIDC authentication is unchanged at coreos/go-oidc v2 since Kubernetes 1.10 ([#58544](https://github.com/kubernetes/kubernetes/pull/58544))
- Calico is unchanged at v3.3.1 since Kubernetes 1.13 ([#70932](https://github.com/kubernetes/kubernetes/pull/70932))

- Resolves an issue with the "ServiceAccountIssuerDiscovery should support OIDC discovery" conformance test failing on clusters which are configured with issuers outside the cluster ([#101725](https://github.com/kubernetes/kubernetes/pull/101725), [@mtaufen](https://github.com/mtaufen)) [SIG Auth and Testing]

- fluentd-gcp has been updated to v3.2.0 ([#70954](https://github.com/kubernetes/kubernetes/pull/70954))
- OIDC authentication is unchanged at coreos/go-oidc v2 since Kubernetes 1.10 ([#58544](https://github.com/kubernetes/kubernetes/pull/58544))
- Calico was updated to v3.3.1 ([#70932](https://github.com/kubernetes/kubernetes/pull/70932))

meSelector","expectedNodeName","pattern","operator","check","result","what","_argument","simple","forward","ofType","_context","xml","outerCache","nodeIndex","start","parent","useCache","diff","firstChild","lastChild","pseudo","args","setFilters","idx","matched","not","matcher","compile","unmatched","has","lang","elemLang","hash","location","root","focus","activeElement","err","safeActiveElement","hasFocus","href","tabIndex","enabled","checked","selected","selectedIndex","empty","nextSibling","h...

#ñ]°” “Ž‡Së¸| À®Û]rß ={ï ê4tÔ±#Â&ÅònüA©L eR ³.D µ {ÏG±ÜãG+ò ¨ ¨ =KnduÂUwgf*}`XGF ïJ6æȪ%¼®Ä(ÆÔ1! WðCçOG.¯«è¼ ¡Cž{* ØKìÿJ#z©ÿ,q]Á ë÷KD[9 ½ÈO, Ø Þ«ó‹’Ÿ9§B‰¹þÇÝül0 ê–‰y¹Æõ4ôH¤£Î*Ø ðYcÖ(é ·@½ ´íO¤@×Ü7¤ãÌæ¸ø ®ù&û 3R[F2é ^1-VÆ«ë CŸ7âêÂv ]ÃßmšTb rÞH?ÐÇ’˜ˆ#á%òïÐF‹ âêþ :3LÝœóKìh ô ­ä Õ*ʬ% ŽðÑDë k§K‡ýU oRÁ k2s:’PRºï%§ >’ô @…½s ‹Îµ2Ûf&õ ‚«+e Öô݉´ ƒÜ[ H d-<%,A¸ ˆ¯2ñ²ÄÊõ짦cïÞ\kSbSÛGxz™qëÄ •â›#®Šfy÷ŸémøYw´vw vßA÷ï ²í ]|*ŠõÑÅ Ÿ€ þ6Å™#C ~ÖëŒð%g å Dª?w \Ô%e‹3Òe'¯ó rIK î.ª¤œ $ ® Ø ðIh„×£‰æ¦Ž§ ˜ 0Q ¦öÖè?^ÌfI²,4#Üaî\P...

- Kube-apiserver: Fixed OIDC discovery document publishing when external service account token signing was enabled. ([#131493](https://github.com/kubernetes/kubernetes/pull/131493), [@hoskeri](https://github.com/hoskeri)) [SIG API Machinery, Auth and Testing]

meSelector","expectedNodeName","pattern","operator","check","result","what","_argument","simple","forward","ofType","_context","xml","outerCache","nodeIndex","start","parent","useCache","diff","firstChild","lastChild","pseudo","args","setFilters","idx","matched","not","matcher","compile","unmatched","has","lang","elemLang","hash","location","root","focus","activeElement","err","safeActiveElement","hasFocus","href","tabIndex","enabled","checked","selected","selectedIndex","empty","nextSibling","h...

### API Change

- '`kube-apiserver`: adds `--authentication-config` flag for reading `AuthenticationConfiguration`
  files. `--authentication-config` flag is mutually exclusive with the existing `--oidc-*`
  flags.' ([#119142](https://github.com/kubernetes/kubernetes/pull/119142), [@aramase](https://github.com/aramase))
- '`kube-scheduler` component config (`KubeSchedulerConfiguration`) `kubescheduler.config.k8s.io/v1beta3`