- kube-dns add-on:
  - All containers are now being executed under more restrictive privileges.
  - Most of the containers now run as non-root user and has the root filesystem set as read-only.
  - The remaining container running as root only has the minimum Linux capabilities it requires to run.

- The helping message of commands which have sub-commands is now clearer and more instructive. It will show the full command instead of `kubectl <command> --help ...`
  

<li>
	Similarly, if all types in <code>C</code>'s type set are
	channel types with the same element type and non-conflicting
	channel directions,
	and <code>P</code> has a known type argument <code>A</code>,
	the most restrictive channel type in <code>C</code>'s type
	set and <code>A</code> must unify loosely.
</li>
<li>
	If <code>P</code> does not have a known type argument
	and <code>C</code> contains exactly one type term <code>T</code>

- Fixes `kubectl drain --dry-run=server`. ([#100206](https://github.com/kubernetes/kubernetes/pull/100206), [@KnVerey](https://github.com/KnVerey))
- Fixes an overly restrictive conformance test to accept service account tokens signed by an ECDSA key ([#100680](https://github.com/kubernetes/kubernetes/pull/100680), [@smira](https://github.com/smira)) [SIG Architecture, Auth and Testing]