bpfL3IfacePattern:
                description: BPFL3IfacePattern is a regular expression that allows
                  to list tunnel devices like wireguard or vxlan (i.e., L3 devices)
                  in addition to BPFDataIfacePattern. That is, tunnel interfaces not
                  created by Calico, that Calico workload traffic flows over as well
                  as any interfaces that handle incoming traffic to nodeports and

	// +optional
	RunAsNonRoot *bool
	// A list of groups applied to the first process run in each container, in
	// addition to the container's primary GID and fsGroup (if specified).  If
	// the SupplementalGroupsPolicy feature is enabled, the
	// supplementalGroupsPolicy field determines whether these are in addition
	// to or instead of any group memberships defined in the container image.

within matching brace brackets.
</p>

<pre class="ebnf">
Block = "{" StatementList "}" .
StatementList = { Statement ";" } .
</pre>

<p>
In addition to explicit blocks in the source code, there are implicit blocks:
</p>

<ol>
	<li>The <i>universe block</i> encompasses all Go source text.</li>

	// A list of groups applied to the first process run in each container, in
	// addition to the container's primary GID and fsGroup (if specified).  If
	// the SupplementalGroupsPolicy feature is enabled, the
	// supplementalGroupsPolicy field determines whether these are in addition
	// to or instead of any group memberships defined in the container image.

	"supplementalGroups":       "A list of groups applied to the first process run in each container, in addition to the container's primary GID and fsGroup (if specified).  If the SupplementalGroupsPolicy feature is enabled, the supplementalGroupsPolicy field determines whether these are in addition to or instead of any group memberships defined in the container image. If unspecified, no additional groups are added, though group memberships defined...

          "supplementalGroups": {

  optional bool runAsNonRoot = 3;

  // A list of groups applied to the first process run in each container, in
  // addition to the container's primary GID and fsGroup (if specified).  If
  // the SupplementalGroupsPolicy feature is enabled, the
  // supplementalGroupsPolicy field determines whether these are in addition
  // to or instead of any group memberships defined in the container image.

The SIG also provided match criteria that allow policy rules to match a source or destination CIDR. Both features are in beta. SIG Network also improved the kube-proxy to include an alpha IPVS mode in addition to the current iptables and userspace modes.

[SIG Network]: https://github.com/kubernetes/community/tree/master/sig-network

### SIG Scalability

  the cloud provider take both IPs into account. ([#120275](https://github.com/kubernetes/kubernetes/pull/120275), [@danwinship](https://github.com/danwinship))
- The `Dockerfile` for the kubectl image has been updated with the addition of a specific base image and essential utilities (bash and jq). ([#119592](https://github.com/kubernetes/kubernetes/pull/119592), [@rayandas](https://github.com/rayandas))

  // Human-readable message indicating details about last transition.
  // +optional
  optional string message = 6;
}

// PodDNSConfig defines the DNS parameters of a pod in addition to
// those generated from DNSPolicy.
message PodDNSConfig {
  // A list of DNS name server IP addresses.
  // This will be appended to the base nameservers generated from DNSPolicy.