* Implement dynamic provisioning (beta) of PersistentVolumes via StorageClass ([#29006](https://github.com/kubernetes/kubernetes/pull/29006), [@jsafrane](https://github.com/jsafrane))
* Allow setting permission mode bits on secrets, configmaps and downwardAPI files ([#28936](https://github.com/kubernetes/kubernetes/pull/28936), [@rata](https://github.com/rata))

## Major Themes

- StatefulSets (ex-PetSets)
  - StatefulSets are beta now (fixes and stabilization)
- Improved Federation Support
  - New command: `kubefed`
  - DaemonSets
  - Deployments
  - ConfigMaps
- Simplified Cluster Deployment
  - Improvements to `kubeadm`
  - HA Setup for Master
- Node Robustness and Extensibility
  - Windows Server Container support
  - CRI for pluggable container runtimes

- kubeadm: ensured that a variety of API server requests were retried during "init", "join", "upgrade", "reset" workflows. Prior to this change, some API server requests, such as creating or updating ConfigMaps, were "one-shot" - i.e., they could fail if the API server dropped connectivity for a very short period of time.
   ([#123271](https://github.com/kubernetes/kubernetes/pull/123271), [@neolit123](https://github.com/neolit123))

'*' - apiGroups: - rbac.authorization.k8s.io resources: - clusterrolebindings - clusterroles - roles - rolebindings verbs: - '*' - apiGroups: - coordination.k8s.io resources: - leases verbs: - get - create - update - apiGroups: - "" resources: - configmaps - endpoints - events - namespaces - pods - pods/proxy - pods/portforward - persistentvolumeclai - secrets - services - serviceaccounts - resourcequotas verbs: - '*' --- manifests/charts/istio-operator/templates/crds.yaml {{- if .Values.enableCRDTemplates...