### Promoted endPort in Network Policy to Stable

Promoted `endPort` in [Network Policy](https://kubernetes.io/docs/concepts/services-networking/network-policies/#targeting-a-range-of-ports) to GA. Network Policy providers that support `endPort` field now can use it to specify a range of ports to apply a Network Policy. Previously, each Network Policy could only target a single port.

      - [Cluster Discovery/Bootstrap](#cluster-discoverybootstrap)
      - [Multi-platform](#multi-platform)
      - [Cloud Providers](#cloud-providers)
    - [Network](#network)
      - [network-policy](#network-policy)
      - [kube-proxy ipvs mode](#kube-proxy-ipvs-mode)
    - [API Machinery](#api-machinery)
      - [kube-apiserver](#kube-apiserver)
      - [Dynamic Admission Control](#dynamic-admission-control)

  // +optional
  optional string hostIP = 5;
}

// ContainerResizePolicy represents resource resize policy for the container.
message ContainerResizePolicy {
  // Name of the resource to which this resource resize policy applies.
  // Supported values: cpu, memory.
  optional string resourceName = 1;

  // Restart policy to apply when specified resource is resized.
  // If not specified, it defaults to NotRequired.

- The PodDisruptionBudget API has been promoted to policy/v1 with no schema changes. The only functional change is that an empty selector (`{}`) written to a policy/v1 PodDisruptionBudget now selects all pods in the namespace. The behavior of the policy/v1beta1 API remains unchanged. The policy/v1beta1 PodDisruptionBudget API is deprecated and will no longer be served in 1.25+. ([#99290](https://github.com/kubernetes/ku...

- The legacy scheduler policy config is removed in v1.23, the associated flags `policy-config-file`, `policy-configmap`, `policy-configmap-namespace` and `use-legacy-policy-config` are also removed. Migrate to Component Config instead, see https://kubernetes.io/docs/reference/scheduling/config/ for details. ([#105424](https://github.com/kubernete...

### CVE-2023-2728: Bypassing enforce mountable secrets policy imposed by the ServiceAccount admission plugin

### CVE-2023-2728: Bypassing enforce mountable secrets policy imposed by the ServiceAccount admission plugin

For stable features, the `kubectl` tool follows the Kubernetes [version skew policy](https://kubernetes.io/releases/version-skew-policy/);
however, kubectl v1.21 and older do not support the new API for ephemeral containers.

pkg syscall (darwin-arm64), const IPV6_HLIMDEC = 1
pkg syscall (darwin-arm64), const IPV6_HLIMDEC ideal-int
pkg syscall (darwin-arm64), const IPV6_IPSEC_POLICY = 28
pkg syscall (darwin-arm64), const IPV6_IPSEC_POLICY ideal-int
pkg syscall (darwin-arm64), const IPV6_JOIN_GROUP = 12
pkg syscall (darwin-arm64), const IPV6_LEAVE_GROUP = 13
pkg syscall (darwin-arm64), const IPV6_MAXHLIM = 255

### CVE-2023-2728: Bypassing enforce mountable secrets policy imposed by the ServiceAccount admission plugin