## Changes by Kind

### API Change

- Improved scheduling performance when many nodes, and prefilter returns 1-2 nodes (e.g. daemonset)
  

  * You can remove the "old" taints (stored internally as annotations) at any time after the upgrade by doing `kubectl annotate nodes <node name> scheduler.alpha.kubernetes.io/taints-` (note the minus at the end, which means "delete the taint with this key")

    - [Feature](#feature-8)
    - [Design](#design-1)
    - [Other (Bug, Cleanup or Flake)](#other-bug-cleanup-or-flake-5)
- [v1.18.0-alpha.4](#v1180-alpha4)
  - [Important note about manual tag](#important-note-about-manual-tag)
- [v1.18.0-alpha.3](#v1180-alpha3)
  - [Downloads for v1.18.0-alpha.3](#downloads-for-v1180-alpha3)
    - [Client Binaries](#client-binaries-24)
    - [Server Binaries](#server-binaries-24)

- The example API server has renamed its `wardle.k8s.io` API group to `wardle.example.com` ([#81670](https://github.com/kubernetes/kubernetes/pull/81670), [@liggitt](https://github.com/liggitt))
- CRDs defaulting is promoted to GA. Note: the feature gate CustomResourceDefaulting will be removed in 1.18. ([#84713](https://github.com/kubernetes/kubernetes/pull/84713), [@sttts](https://github.com/sttts))

    * A sample DaemonSet to deploy Flexvolume drivers is now available.

* [prototype] Volume snapshots

  * You can now create a volume snapshot by calling the Kubernetes API.

  * Note that the prototype does not support quiescing before snapshot, so snapshots might be inconsistent.

specified in the service account's secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the `kubernetes.io/enforce-mountable-secrets` annotation are used together with ephemeral containers.

**Note**: This only impacts the cluster if the ServiceAccount admission plugin is used (most cluster should have this on by default as recommended in https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#serviceaccount), the `kub...

- SCTP support in API objects (Pod, Service, NetworkPolicy) is now GA.
  Note that this has no effect on whether SCTP is enabled on nodes at the kernel level,

enabled admission plugins are now `NamespaceLifecycle,LimitRanger,ServiceAccount,PersistentVolumeLabel,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,StorageObjectInUseProtection`. Please note that if you previously had not set the `--admission-control` flag, your cluster behavior may change (to be more standard). ([#74610](https://github.com/kubernetes/kubernetes/pull/74610), [@oomichi](https://github.com/oomichi))


...

    *   If you upgrade your client-go libs and use the `AppsV1()` interface, please note that the default garbage collection behavior is changed.

### **Auth**

#### **Audit**

  In addition, when this feature is enabled, the 'details' field of 'Status' from the LIST response
  includes information that identifies the corrupt object(s).
  NOTE: unsafe deletion ignores finalizer constraints, and skips precondition checks.
  WARNING: this may break the workload associated with the resource being unsafe-deleted, if it relies on