- `spec.signerName` is now required, and requests for `kubernetes.io/legacy-unknown` are not allowed to be created via the `certificates.k8s.io/v1` API
  - `spec.usages` is now required, may not contain duplicate values, and must only contain known usages
  - `status.conditions` may not contain duplicate types
  - `status.conditions[*].status` is now required

- Warnings for the use of deprecated and known-bad values in pod specs are now sent. ([#101688](https://github.com/kubernetes/kubernetes/pull/101688), [@liggitt](https://github.com/liggitt))

## Known Issues

No Known Issues Reported

## Urgent Upgrade Notes

### (No, really, you MUST read this before you upgrade)

#### kube-apiserver:

## Known Issues

This section contains a list of known issues reported in Kubernetes 1.9 release. The content is populated from the [v1.9.x known issues and FAQ accumulator] [#57159](https://github.com/kubernetes/kubernetes/issues/57159).

  - kubeadm now handles air-gapped environments by using the local client version as a fallback.
  - Some kubeadm commands are now allowed to work in a completely offline mode.
- Certificate handling improvements:
  - Renew certs as part of upgrade.
  - New `kubeadm alpha phase certs renew` command for renewing certificates.
  - Certificates created with kubeadm now have improved uniqueness of Distinguished Name fields.

</li>
<li>
	At most one of the type parameters has a known type argument.
	In this case, the type parameters are <i>joined</i>:
	they both stand for the same type argument.
	If neither type parameter has a known type argument yet,
	a future type argument inferred for one the type parameters
	is simultaneously inferred for both of them.
</li>
<li>
	Both type parameters have a known type argument

#### KeyCloak

```
export MINIO_ROOT_USER=minio
export MINIO_ROOT_PASSWORD=minio123
export MINIO_IDENTITY_OPENID_CONFIG_URL=http://localhost:8080/auth/realms/demo/.well-known/openid-configuration

        }
        if (i1 == -1) {
            // second one is known, so it comes first
            return 1;
        }
        if (i2 == -1) {
            // first one is known, so it comes first
            return -1;
        }
        int rv = Integer.compare(i1, i2);
        if (rv != 0) {
            return rv;
        }
        // same execution point, now compare priorities

These credentials can now be used to perform MinIO API operations.

### Using MinIO Console

- Open MinIO URL on the browser, lets say <http://localhost:9000/>
- Click on `Login with SSO`
- User will be redirected to the Keycloak user login page, upon successful login the user will be redirected to MinIO page and logged in automatically,
  the user should see now the buckets and objects they have access to.

	v := t.val.Load()
	ttl := t.ttl
	vTime := t.lastUpdateMs.Load()
	tNow := time.Now().UnixMilli()
	if v != nil && tNow-vTime < ttl.Milliseconds() {
		return *v, nil
	}

	// Fetch new value asynchronously, while we do not return an error
	// if v != nil value or
	if t.opts.NoWait && v != nil && tNow-vTime < ttl.Milliseconds()*2 {
		if t.updating.TryLock() {
			go func() {