- Graduated the `LegacyServiceAccountTokenTracking` feature gate to Beta. The usage of auto-generated secret-based service account token now produces warnings by default, and relevant Secrets are labeled with a last-used timestamp (label key `kubernetes.io/legacy-token-last-used`). ([#114523](https://github.com/kubernetes/kubernetes/pull/114523), [@zshihang](https://github.com/zshihang)) [SIG API Machinery and Auth]

         */
        protected List<String> pageNumbers;
        /**
         * Indicates if the search results are partial.
         */
        protected boolean partial;
        /**
         * The time taken for the search query in milliseconds.
         */
        protected long queryTime;
        /**
         * The search query string.
         */
        protected String searchQuery;
        /**

// The resulting size on disk will always be returned.
// The metadata will be compared to consensus on the object layer before any changes are applied.
// If no metadata is supplied, -1 is returned if no action is taken.
func (i *scannerItem) applyActions(ctx context.Context, objAPI ObjectLayer, objInfos []ObjectInfo, lr lock.Retention, sizeS *sizeSummary, fn actionsAccountingFn) {
	if len(objInfos) == 0 {
		return
	}

    // ============================================================

    /** User information session key. */
    public static final String USER_INFO = "LoginInfo";

    /** Search engine API access token key. */
    public static final String SEARCH_ENGINE_API_ACCESS_TOKEN = "searchEngineApiAccessToken";

    /** Default field name identifier. */
    public static final String DEFAULT_FIELD = "_default";

Another feature moving to GA in v1.22 is CSI Service Account Token support. This feature allows CSI drivers to use pods' [bound service account tokens](https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/#bound-service-account-token-volume) instead of a more privileged identity. It also provides control over to re-publishing these volumes, so that short-lived tokens can be refreshed.

### SIG Windows development tools

 - The default Bootstrap Token created with `kubeadm init` v1.8 expires
 and is deleted after 24 hours by default to limit the exposure of the
 valuable credential. You can create a new Bootstrap Token with
 `kubeadm token create` or make the default token permanently valid by specifying
 `--token-ttl 0` to `kubeadm init`. The default token can later be deleted with
 `kubeadm token delete`.

     */
    task.addListener(() -> scheduled.cancel(false), directExecutor());
    return task;
  }

  /**
   * Returns a {@code Future} whose result is taken from the given primary {@code input} or, if the
   * primary input fails with the given {@code exceptionType}, from the result provided by the

     * @param allRecordCount the total number of records found
     * @param allRecordCountRelation the relationship of the record count (exact, approximate, etc.)
     * @param queryTime the time taken to execute the search query
     * @param partialResults whether the results are partial due to timeout or other constraints
     * @param facetResponse the facet information for the search results

- Allowed creating ServiceAccount tokens bound to Node objects.
  This allows users to bind a service account token's validity to a named Node object, similar to Pod bound tokens.

## Changelog since v1.5.5

### Other notable changes

* kube-up (with gce/gci and gce/coreos providers) now ensures the authentication token file contains correct tokens for the control plane components, even if the file already exists (ensures upgrades and downgrades work successfully) ([#43676](https://github.com/kubernetes/kubernetes/pull/43676), [@liggitt](https://github.com/liggitt))