- The `StrictIPCIDRValidation` feature gate to kube-apiserver is now
  enabled by default, meaning that API fields no longer allow IP or CIDR
  values with extraneous leading "0"s (e.g., `010.000.000.005` rather than
  `10.0.0.5`) or CIDR subnet/mask values with ambiguous semantics (e.g.,

* Enable lazy inode table and journal initialization for ext3 and ext4 ([#38865](https://github.com/kubernetes/kubernetes/pull/38865), [@codablock](https://github.com/codablock))
* Kubelet will no longer set hairpin mode on every interface on the machine when an error occurs in setting up hairpin for a specific interface. ([#36990](https://github.com/kubernetes/kubernetes/pull/36990), [@bboreham](https://github.com/bboreham))

* Fix resync goroutine leak in ListAndWatch ([#35672](https://github.com/kubernetes/kubernetes/pull/35672), [@tatsuhiro-t](https://github.com/tatsuhiro-t))
* Kubelet will no longer set hairpin mode on every interface on the machine when an error occurs in setting up hairpin for a specific interface. ([#36990](https://github.com/kubernetes/kubernetes/pull/36990), [@bboreham](https://github.com/bboreham))

away went Alice like the wind, and was just in time to hear it
say, as it turned a corner, `Oh my ears and whiskers, how late
it's getting!'  She was close behind it when she turned the
corner, but the Rabbit was no longer to be seen:  she found
herself in a long, low hall, which was lit up by a row of lamps
hanging from the roof.

  There were doors all round the hall, but they were all locked;

away went Alice like the wind, and was just in time to hear it
say, as it turned a corner, `Oh my ears and whiskers, how late
it's getting!'  She was close behind it when she turned the
corner, but the Rabbit was no longer to be seen:  she found
herself in a long, low hall, which was lit up by a row of lamps
hanging from the roof.

  There were doors all round the hall, but they were all locked;

   * it's going to complete at all).
   *
   * <p>[*] To avoid hangs, I've disabled the in-thread calls. This makes the test take (very
   * roughly) 2.5s longer. (2.5s is also the maximum length of time we will wait for a timed get
   * that is expected to succeed; the fact that the numbers match is only a coincidence.) See the

   * it's going to complete at all).
   *
   * <p>[*] To avoid hangs, I've disabled the in-thread calls. This makes the test take (very
   * roughly) 2.5s longer. (2.5s is also the maximum length of time we will wait for a timed get
   * that is expected to succeed; the fact that the numbers match is only a coincidence.) See the

    // If we're working correctly, this should be greater than 100ms, but less than double that.
    // Previously we had a bug where we would download the entire response body as long as no
    // individual read took longer than 100ms.
    assertThat(elapsedMillis).isLessThan(500L)

    // Do another request to confirm that the discarded connection was not pooled.
    assertContent("A", getResponse(newRequest("/")))

			if srcChecksumDecrypted != nil {
				dstOpts.WantChecksum = hash.ChecksumFromBytes(srcChecksumDecrypted)

				// When an object is being copied from a source that is multipart, the destination will
				// no longer be multipart, and thus the checksum becomes full-object instead. Since
				// the CopyObject API does not require that the caller send us this final checksum, we need

       * one-sixth of them need cloning when a table doubles. The nodes they replace will be garbage
       * collectable as soon as they are no longer referenced by any reader thread that may be in
       * the midst of traversing table right now.
       */

      int newCount = count;