* Fix public IP not found issues for VMSS nodes ([#80703](https://github.com/kubernetes/kubernetes/pull/80703), [@feiskyer](https://github.com/feiskyer))
* Resolves a bug that prevented sending a multi-version custom resource to an admission webhook. ([#79495](https://github.com/kubernetes/kubernetes/pull/79495), [@liggitt](https://github.com/liggitt))

    * Before, when users run admission webhook as an addon pod, after they remove the webhook, kube-addon-manager won't cleanup the webhook configuration `MutatingWebhookConfiguration`/`ValidationWebhookConfiguration`, because those resources are not prune-whitelisted. Cluster will go into a bad state that no pod can be admitted.

pkg syscall (darwin-arm64), const SYS_READ_NOCANCEL = 396
pkg syscall (darwin-arm64), const SYS_READ_NOCANCEL ideal-int
pkg syscall (darwin-arm64), const SYS_REBOOT = 55
pkg syscall (darwin-arm64), const SYS_REBOOT ideal-int
pkg syscall (darwin-arm64), const SYS_RECVFROM = 29
pkg syscall (darwin-arm64), const SYS_RECVFROM ideal-int
pkg syscall (darwin-arm64), const SYS_RECVFROM_NOCANCEL = 403

        * At Request audit level or higher, an annotation with key "patch.webhook.admission.k8s.io/round_{round idx}_index_{order idx}" get logged with the JSON payload logging the patch sent by a webhook for given request.

- Introduces a new metric: `admission_webhook_request_total` with the following labels: name (string) - the webhook name, type (string) - the admission type, operation (string) - the requested verb, code (int) - the HTTP status code, rejected (bool) - whether the request was rejected, namespace (string) - the namespace of the...

### CVE-2021-25735: Validating Admission Webhook does not observe some previous fields

A security issue was discovered in kube-apiserver that could allow node
updates to bypass a Validating Admission Webhook. You are only affected
by this vulnerability if you run a Validating Admission Webhook for Nodes
that denies admission based at least partially on the old state of the
Node object.

- Ignore context canceled from validate and mutate webhook ([#120017](https://github.com/kubernetes/kubernetes/pull/120017), [@divyasri537](https://github.com/divyasri537)) [SIG API Machinery]

- Added a new metric `webhook_fail_open_count` to monitor webhooks that fail to open. ([#107171](https://github.com/kubernetes/kubernetes/pull/107171), [@ltagliamonte-dd](https://github.com/ltagliamonte-dd))

pkg syscall (netbsd-arm64-cgo), const SYS_READV = 120
pkg syscall (netbsd-arm64-cgo), const SYS_READV ideal-int
pkg syscall (netbsd-arm64-cgo), const SYS_REBOOT = 208
pkg syscall (netbsd-arm64-cgo), const SYS_REBOOT ideal-int
pkg syscall (netbsd-arm64-cgo), const SYS_RECVFROM = 29
pkg syscall (netbsd-arm64-cgo), const SYS_RECVFROM ideal-int
pkg syscall (netbsd-arm64-cgo), const SYS_RECVMMSG = 475

### Feature

- An audit log entry will be generated when a validating admission webhook is failing open. ([#92739](https://github.com/kubernetes/kubernetes/pull/92739), [@cnphil](https://github.com/cnphil)) [SIG API Machinery]