### Storage

- Fixed scanning of failed iSCSI targets. ([#74306](https://github.com/kubernetes/kubernetes/pull/74306), [@jsafrane](https://github.com/jsafrane))
- StorageOS volume plugin updated to fix an issue where volume mount succeeds even if request to mount via StorageOS API fails. ([#69782](https://github.com/kubernetes/kubernetes/pull/69782), [@darkowlzz](https://github.com/darkowlzz))

* When using client or server certificate rotation, the Kubelet will no longer wait until the initial rotation succeeds or fails before starting static pods.  This makes running self-hosted masters with rotation more predictable. ([#58930](https://github.com/kubernetes/kubernetes/pull/58930), [@smarterclayton](https://github.com/smarterclayton))

        // Second success should close the circuit (threshold is 2)
        result = circuitBreaker.executeWithCircuitBreaker(() -> "success 1");
        assertEquals("success 1", result, "Should execute second success");
        assertEquals(State.CLOSED, circuitBreaker.getState(), "Circuit should be CLOSED after success threshold");

        // Test max attempts in half-open with failure scenario
        circuitBreaker.trip(); // Open again

		host, port, err := extractHostPort(testCase.addr)
		if testCase.expectedErr == nil && err != nil {
			t.Fatalf("Test %d: should succeed but failed with err: %v", i+1, err)
		}
		if testCase.expectedErr != nil && err == nil {
			t.Fatalf("Test %d:, should fail but succeeded.", i+1)
		}
		if err == nil {
			if host != testCase.host {
				t.Fatalf("Test %d: expected: %v, found: %v", i+1, testCase.host, host)
			}

	echo "BUG: PutObject to bucket: multi-key-poc with valid sse-kms should succeed. Failed"
	exit 1
fi

mc cp /etc/issue myminio1/multi-key-poc/issue --enc-kms "myminio1/multi-key-poc/issue=minio-default-key-xxx" | grep "Insufficient permissions to access this path"
ret=$?
if [ $ret -eq 0 ]; then
	echo "BUG: PutObject to bucket: multi-key-poc with invalid sse-kms should fail. Succeeded"
	exit 1
fi

kill $pid

        context.put("authMethod", authMethod);
        context.put("success", success);

        String message = buildAuthMessage(success, maskedUsername, maskedAddress, authMethod);

        logEvent(type, severity, message, context);
        returnContextMap(context);
    }

    private String buildAuthMessage(boolean success, String maskedUsername, String maskedAddress, String authMethod) {

  override fun connectTcp(): ConnectResult {
    check(rawSocket == null) { "TCP already connected" }

    var success = false

    // Tell the call about the connecting call so async cancels work.
    user.addPlanToCancel(this)
    try {
      user.connectStart(route)

      connectSocket()
      success = true
      return ConnectResult(plan = this)
    } catch (e: IOException) {

        assertTrue(rateLimiter.checkAttempt("user1", "192.168.1.1"), "First attempt should be allowed");

        // Record success
        rateLimiter.recordSuccess("user1", "192.168.1.1");

        // Should still be allowed
        assertTrue(rateLimiter.checkAttempt("user1", "192.168.1.1"), "After success should be allowed");
    }

    @Test
    public void testAccountLockout() throws Exception {

OUT=$(./mc cp --quiet --recursive "${ALIAS_NAME}"/"${BUCKET}"/initial-data/ "${DEST_DIR}"/)
RET=${?}
if [ ${RET} -ne 0 ]; then
	# It is a success scenario as get objects should fail
	echo "GET objects failed as expected"
	echo "script passed" >resiliency-verify-failure.log
	exit 0
else
	echo "GET objects expected to fail, but succeeded: ${OUT}"

		t.Run("", func(t *testing.T) {
			_, err := parsePostPolicyForm(strings.NewReader(testCase.policy))
			if testCase.success && err != nil {
				t.Errorf("Expected success but failed with %s", err)
			}
			if !testCase.success && err == nil {
				t.Errorf("Expected failed but succeeded")
			}
		})
	}
}

type formValues struct {
	http.Header
}

func newFormValues() formValues {