* The Kubelet's deprecated `--allow-privileged` flag now defaults to true. This enables users to stop setting `--allow-privileged` in order to transition to `PodSecurityPolicy`. Previously, users had to continue setting `--allow-privileged`, because the default was false. ([#63442](https://github.com/kubernetes/kubernetes/pull/63442), [@mtaufen](https://github.com/mtaufen))

        * `failure-domain.beta.kubernetes.io/region`
        * `[*.]kubelet.kubernetes.io/*`
        * `[*.]node.kubernetes.io/*`
    * Setting other `kubernetes.io/`- and `k8s.io/`-prefixed labels using the `--node-labels` flag will produce a warning in v1.13, and be disallowed in v1.15. Setting labels that are not prefixed with `kubernetes.io/` or `k8s.io/` is still permitted.

pkg syscall (darwin-arm64), const SYS_SETSOCKOPT ideal-int
pkg syscall (darwin-arm64), const SYS_SETTID = 285
pkg syscall (darwin-arm64), const SYS_SETTID ideal-int
pkg syscall (darwin-arm64), const SYS_SETTID_WITH_PID = 311
pkg syscall (darwin-arm64), const SYS_SETTID_WITH_PID ideal-int
pkg syscall (darwin-arm64), const SYS_SETTIMEOFDAY = 122
pkg syscall (darwin-arm64), const SYS_SETTIMEOFDAY ideal-int

- [`KT-59317`](https://youtrack.jetbrains.com/issue/KT-59317) Deprecate ios()  preset in favor of target hierarchy
- [`KT-47144`](https://youtrack.jetbrains.com/issue/KT-47144) [Multiplatform] Warn about setting *Test.dependsOn(*Main)
- [`KT-59733`](https://youtrack.jetbrains.com/issue/KT-59733) Make KotlinDefaultHierarchyFallbackIllegalTargetNames to check target names disregarding the case

### Non-recursive Volume Ownership (FSGroup) graduates to Beta

By default, the `fsgroup` setting, if specified, recursively updates permissions for every file in a volume on every mount. This can make mount, and pod startup, very slow if the volume has many files. 

- Kubernetes 1.23 is now built with go1.19.4. To match behavior of previous Kubernetes 1.23 patch releases:
  - `kube-apiserver` defaults the GOGC setting to 63, to approximate go1.17 garbage collection memory performance in heavily loaded API servers

  
  kubelet also ignores an error during opening `/dev/kmsg`.
  This feature gate also allows kube-proxy to ignore an error during setting `RLIMIT_NOFILE`.
  

  Setting feature gate MultiCIDRRangeAllocator=true, determines whether the MultiCIDRRangeAllocator controller can be used, while the kube-controller-manager flag below will pick the active controller.

  linking directly to the master branch. This ensures that links reference a
  specific point in time, rather than a document that may change over time.
  
  See here for guidance on getting permanent links to files: https://help.github.com/en/articles/getting-permanent-links-to-files
  
  Please use the following format for linking documentation:
  - [KEP]: <link>
  - [Usage]: <link>
  - [Other doc]: <link>

* kube-controller-manager: Fixes bug setting headless service labels on endpoints ([#85361](https://github.com/kubernetes/kubernetes/pull/85361), [@liggitt](https://github.com/liggitt))



# v1.16.3

[Documentation](https://docs.k8s.io)