<match value="\nRelay-Version:" type="string" offset="2:9"/>
      <match value="\n#!\ rnews" type="string" offset="2:9"/>
      <match value="\nN#!\ rnews" type="string" offset="2:9"/>
      <match value="\nForward\ to" type="string" offset="2:9"/>
      <match value="\nPipe\ to" type="string" offset="2:9"/>
      <match value="\nReturn-Path:" type="string" offset="2:9"/>
      <match value="\nFrom:" type="string" offset="2:9"/>

  allows this sysctl in `v1.29+` versions of the baseline and restricted policies. ([#121240](https://github.com/kubernetes/kubernetes/pull/121240), [@HirazawaUi](https://github.com/HirazawaUi))
- `kubelet` now allows pods to use the `net.ipv4.tcp_keepalive_time` sysctl by default
  and the minimal kernel version is 4.5; Pod Security Admission allows this sysctl

pkg syscall (netbsd-arm64-cgo), const ERPCMISMATCH Errno
pkg syscall (netbsd-arm64-cgo), const ESHUTDOWN = 58
pkg syscall (netbsd-arm64-cgo), const ESOCKTNOSUPPORT = 44
pkg syscall (netbsd-arm64-cgo), const ESPIPE = 29
pkg syscall (netbsd-arm64-cgo), const ESRCH = 3
pkg syscall (netbsd-arm64-cgo), const ESTALE = 70
pkg syscall (netbsd-arm64-cgo), const ETHER_ADDR_LEN = 6
pkg syscall (netbsd-arm64-cgo), const ETHER_ADDR_LEN ideal-int

pkg syscall (darwin-arm64), const ESHLIBVERS Errno
pkg syscall (darwin-arm64), const ESHUTDOWN = 58
pkg syscall (darwin-arm64), const ESOCKTNOSUPPORT = 44
pkg syscall (darwin-arm64), const ESPIPE = 29
pkg syscall (darwin-arm64), const ESRCH = 3
pkg syscall (darwin-arm64), const ESTALE = 70
pkg syscall (darwin-arm64), const ETIME = 101
pkg syscall (darwin-arm64), const ETIME Errno

- Fixed a regression introduced in v1.29 where conntrack entries for UDP connections
  to deleted pods did not get cleaned up correctly, which could (among other things)

- GRPC probes are now a GA feature. `GRPCContainerProbe` feature gate was locked to default value and will be removed in v1.29. If you were setting this feature gate explicitly, please remove it now. ([#116233](https://github.com/kubernetes/kubernetes/pull/116233), [@SergeyKanzhelev](https://github.com/SergeyKanzhelev))

- Introduce support for CEL optionals (see [CEL spec proposal 246](https://github.com/google/cel-spec/wiki/proposal-246)).
  This feature will not be fully enabled until a future Kubernetes release (likely to be v1.29), but is added in v1.28 to enable
  safe rollback on downgrade. ([#118339](https://github.com/kubernetes/kubernetes/pull/118339), [@jpbetz](https://github.com/jpbetz)) [SIG API Machinery, Auth, Cloud Provider and Testing]

- Kube scheduler Component Config release version v1beta3 is deprecated in v1.26 and will be removed in v1.29, 
  also v1beta2 will be removed in v1.28. ([#112257](https://github.com/kubernetes/kubernetes/pull/112257), [@kerthcet](https://github.com/kerthcet)) [SIG Scheduling]

V(a,t){return function(e){return null!=e?(K(this,a,e),M.updateOffset(this,t),this):B(this,a)}}function B(e,a){return e.isValid()?e._d["get"+(e._isUTC?"UTC":"")+a]():NaN}function K(e,a,t){e.isValid()&&!isNaN(t)&&("FullYear"===a&&I(e.year())&&1===e.month()&&29===e.date()?(t=G(t),e._d["set"+(e._isUTC?"UTC":"")+a](t,e.month(),Se(t,e.month()))):e._d["set"+(e._isUTC?"UTC":"")+a](t))}var q,Z=/\d/,$=/\d\d/,Q=/\d{3}/,X=/\d{4}/,ee=/[+-]?\d{6}/,ae=/\d\d?/,te=/\d\d\d\d?/,se=/\d\d\d\d\d\d?/,ne=/\d{1,3}/,re=/\d{1,4}...