Merge branch 'master' into metadata-actor-status

docs/release_notes/v1.12.0.md

@@ -479,4 +479,10 @@ kubectl rollout restart deploy/<deployment-name>
 ## Deprecation Notices
 
 - The **NATS Streaming** PubSub component has been deprecated in Dapr 1.12 and will be removed in Dapr 1.13. The upstream NATS Streaming project has been deprecated and has reached End-Of-Life in June 2023. The upstream projects recommends all users [migrate to NATS JetStream](https://docs.dapr.io/reference/components-reference/supported-pubsub/setup-jetstream/).
-- The `UnsubscribeConfiguration` call for gRPC API has been deprecated. [6769](https://github.com/dapr/dapr/pull/6769)
+- The `UnsubscribeConfiguration` call for gRPC API has been deprecated. [6769](https://github.com/dapr/dapr/pull/6769)
+
+- The `certchain`, `issuer-ca-filename`, `issuer-certificate-filename`, and `issuer-key-filename` CLI flags have been deprecated in placement & operator and will no longer have any effect. Placement & operator now only requests their identity certificate from sentry.
+
+- The `token-audience` CLI flag has been deprecated in sentry. Sentry now requires inbound Kubernetes Service Account tokens to have an audience of `dapr.io/sentry` or the SPIFFE ID of sentry (`spiffe://<trust domain>/ns/<namespace>/dapr-sentry`).
+
+- The `DAPR_CERT_CHAIN` and `DAPR_CERT_KEY` daprd environment variables have been deprecated and will be ignored. Daprd must request their identity certificate from sentry.