`/healthz`, `/pods` and `/configz` by granting the caller `nodes/proxy` permission in RBAC but that also grants the caller permissions to exec, run and attach to containers on the nodes and doing so does not follow the least privilege principle. Granting callers more permissions than they need can give attackers an opportunity to escalate privileges. ([#126347](https://github.com/kubernetes/kubernetes/pull/126347), [@vinayakankugoyal](https://github.com/vinayakankugoyal)) [SIG API Machinery, Auth, Cluster Lifecycle...

   *     underlying this step or, if {@code get()} throws a different kind of exception, that
   *     exception itself. To avoid hiding bugs and other unrecoverable errors, callers should
   *     prefer more specific types, avoiding {@code Throwable.class} in particular.
   * @param fallback the function to be called if this step fails with the expected exception type.

      .assertSentRequestAtMillis(request1SentAt, request1ReceivedAt)
      .assertReceivedResponseAtMillis(request1SentAt, request1ReceivedAt)

    // Check the network response. It has the caller's request, plus some caching headers.
    cacheHit.networkResponse()
      .assertCode(304)
      .assertHeader("Donut", "b")
      .assertRequestHeader("Accept-Language", "en-US")

      client.newBuilder()
        .sslSocketFactory(handshakeCertificates.sslSocketFactory())
    }
  }

  /** Confirm that runtime exceptions thrown inside of OkHttp propagate to the caller.  */
  @Test
  fun unexpectedExceptionSync() {
    client =
      client.newBuilder()
        .dns { hostname: String? -> throw RuntimeException("boom!") }
        .build()

* The error handling behavior of `pkg/client/restclient.Result` has changed.  Calls to `Result.Raw()` will no longer parse the body, although they will still return errors that react to `pkg/api/errors.Is*()` as in previous releases.  Callers of `Get()` and `Into()` will continue to receive errors that are parsed from the body if the kind and apiVersion of the body match the `Status` object. ([#36001](https://github.com/kubernetes/kubernetes/pull/36001), [@smarterclayton](https://gith...