// If set, the name of the container from PodSpec that this ephemeral container targets.
  // The ephemeral container will be run in the namespaces (IPC, PID, etc) of this container.
  // If not set then the ephemeral container uses the namespaces configured in the Pod spec.
  //
  // The container runtime must implement support for this feature. If the runtime does not
  // support namespace targeting then the result of setting this field is undefined.

	    its position in the array.
	</li>
	<li>An element with a key uses the key as its index. The
	    key must be a non-negative constant
	    <a href="#Representability">representable</a> by
	    a value of type <code>int</code>; and if it is typed
	    it must be of <a href="#Numeric_types">integer type</a>.
	</li>
	<li>An element without a key uses the previous element's index plus one.

- Added CEL runtime cost calculation into ValidatingAdmissionPolicy, matching the evaluation cost
  restrictions that already apply to CustomResourceDefinition.
  If rule evaluation uses more compute than the limit, the API server aborts the evaluation and the
  admission check that was being performed is aborted; the `failurePolicy` for the ValidatingAdmissionPolicy

    - https://github.com/kubernetes/kubernetes/issues/92272
    - https://github.com/kubernetes/kubernetes/issues/92250
  
    To address this, the new debian-hyperkube-base image (v1.1.0) uses the
    debian-iptables base image (v12.1.0), which includes iptables-wrapper, a

    - https://github.com/kubernetes/kubernetes/issues/92272
    - https://github.com/kubernetes/kubernetes/issues/92250
  
    To address this, the new debian-hyperkube-base image (v1.1.0) uses the
    debian-iptables base image (v12.1.0), which includes iptables-wrapper, a

* Forgiveness alpha version api definition ([#39469](https://github.com/kubernetes/kubernetes/pull/39469), [@kevin-wangzefeng](https://github.com/kevin-wangzefeng))
* Rescheduler uses taints in v1beta1 and will remove old ones (in version v1alpha1) right after its start. ([#43106](https://github.com/kubernetes/kubernetes/pull/43106), [@piosz](https://github.com/piosz))

### Volumes

    - https://github.com/kubernetes/kubernetes/issues/92272
    - https://github.com/kubernetes/kubernetes/issues/92250
  
    To address this, the new debian-hyperkube-base image (v1.1.0) uses the
    debian-iptables base image (v12.1.0), which includes iptables-wrapper, a

memory resources

Originally, Kubernetes used the v1 cgroups API. With that design, the QoS class for a pod only applied to CPU resources (such as `cpu_shares`). The Kubernetes cgroup manager uses `memory.limit_in_bytes` in v1 cgroups to limit the memory capacity for a container, and uses `oom_scores` to recommend an order for killing container processes if an out-of-memory event occurs. This implementation has shortcomings: for `Guaranteed` pods, memory can not be fully reserved, and the...

- Changed how KMS v2 encryption at rest can generate data encryption keys.

- Fixes kubelet crash in client certificate rotation cases ([#88079](https://github.com/kubernetes/kubernetes/pull/88079), [@liggitt](https://github.com/liggitt)) [SIG API Machinery, Auth and Node]