- [`KT-38317`](https://youtrack.jetbrains.com/issue/KT-38317) Kotlin/Native: NSURLConnection HTTPS requests fail in iOS tests due to --standalone simctl flag
- [`KT-56280`](https://youtrack.jetbrains.com/issue/KT-56280) Gradle: freeCompilerArgs are no longer propagated from compilations to Native binaries

### Tools. Incremental Compile

pkg syscall (darwin-arm64), const SYS_SELECT_NOCANCEL = 407
pkg syscall (darwin-arm64), const SYS_SELECT_NOCANCEL ideal-int
pkg syscall (darwin-arm64), const SYS_SEMCTL = 254
pkg syscall (darwin-arm64), const SYS_SEMCTL ideal-int
pkg syscall (darwin-arm64), const SYS_SEMGET = 255
pkg syscall (darwin-arm64), const SYS_SEMGET ideal-int
pkg syscall (darwin-arm64), const SYS_SEMOP = 256

  and “net.ipv4.tcp_keepalive_probes“ sysctl by default; Pod Security Admission
  allows this sysctl in `v1.29+` versions of the baseline and restricted policies. ([#121240](https://github.com/kubernetes/kubernetes/pull/121240), [@HirazawaUi](https://github.com/HirazawaUi))
- `kubelet` now allows pods to use the `net.ipv4.tcp_keepalive_time` sysctl by default

- Changes behaviour of kube-proxy start; does not attempt to set specific `sysctl` values (which does not work in recent Kernel versions anymore in non-init namespaces), when the current sysctl values are already set higher. ([#103174](https://github.com/kubernetes/kubernetes/pull/103174), [@Napsty](https://github.com/Napsty))

  // credentials.  If not specified, default values will be attempted.
  // +optional
  optional LocalObjectReference secretRef = 5;
}

// Sysctl defines a kernel parameter to be set
message Sysctl {
  // Name of a property to set
  optional string name = 1;

  // Value of a property to set
  optional string value = 2;
}

  
  When the feature gate is enabled, kubelet ignores errors that happens during setting the following sysctl values: `vm.overcommit_memory`, `vm.panic_on_oom`, `kernel.panic`, `kernel.panic_on_oops`, `kernel.keys.root_maxkeys`, `kernel.keys.root_maxbytes`. (These sysctl values for the host, not for the containers)
  
  kubelet also ignores an error during opening `/dev/kmsg`.

- Kubelet allows pods to use the `net.ipv4.ip_local_reserved_ports` sysctl by default and the minimal kernel version is 3.16; Pod Security admission allows this sysctl in v1.27+ versions of the baseline and restricted policies. ([#115374](https://github.com/kubernetes/kubernetes/pull/115374), [@pacoxu](https://github.com/pacoxu)) [SIG Auth, Network and Node]

## Urgent Upgrade Notes 

### (No, really, you MUST read this before you upgrade)

* Add RBAC support to fluentd-elasticsearch cluster addon ([#46203](https://github.com/kubernetes/kubernetes/pull/46203), [@simt2](https://github.com/simt2))
* Avoid redundant copying of tars during kube-up for gce if the same file already exists ([#46792](https://github.com/kubernetes/kubernetes/pull/46792), [@ianchakeres](https://github.com/ianchakeres))

- Pod SecurityContext and PodSecurityPolicy supports slash as sysctl separator. ([#106834](https://github.com/kubernetes/kubernetes/pull/106834), [@mengjiao-liu](https://github.com/mengjiao-liu)) [SIG Apps, Architecture, Auth, Node, Security and Testing]