map<string, k8s.io.apimachinery.pkg.api.resource.Quantity> hard = 1;

  // A collection of filters that must match each object tracked by a quota.
  // If not specified, the quota matches all objects.
  // +optional
  repeated string scopes = 2;

  // scopeSelector is also a collection of filters like scopes that must match each object tracked by a quota
  // but expressed using ScopeSelectorOperator in combination with possible values.

- Introduced a new boolean kubelet flag `--fail-cgroupv1`. ([#126031](https://github.com/kubernetes/kubernetes/pull/126031), [@harche](https://github.com/harche)) [SIG API Machinery and Node]

- Updated cAdvisor to v0.47.2 - Fix metrics in cri-o when a container restarts ([#118797](https://github.com/kubernetes/kubernetes/pull/118797), [@harche](https://github.com/harche)) [SIG Node]

## Dependencies

### Added
_Nothing has changed._

### Changed

* Advanced audit policy now supports matching subresources and resource names, but the top level resource no longer matches the subresouce. For example "pods" no longer matches requests to the logs subresource of pods. Use "pods/logs" to match subresources. ([#48836](https://github.com/kubernetes/kubernetes/pull/48836), [@ericchiang](https://github.com/ericchiang))

## Changes to API Resources
### ABAC
* ABAC policies using `"user":"*"` or `"group":"*"` to match all users or groups will only match authenticated requests. To match unauthenticated requests, ABAC policies must explicitly specify `"group":"system:unauthenticated"` ([#38968](https://github.com/kubernetes/kubernetes/pull/38968), [@liggitt](https://github.com/liggitt))

* Audit policy supports matching subresources and resource names, but the top level resource no longer matches the subresouce. For example "pods" no longer matches requests to the logs subresource of pods. Use "pods/logs" to match subresources. ([#48836](https://github.com/kubernetes/kubernetes/pull/48836), [@ericchiang](https://github.com/ericchiang))

- Updated cAdvisor to v0.47.2 - Fix metrics in cri-o when a container restarts ([#118774](https://github.com/kubernetes/kubernetes/pull/118774), [@harche](https://github.com/harche)) [SIG Node]

- Updated cAdvisor to v0.44.2 - Fix metrics in cri-o when a container restarts ([#118800](https://github.com/kubernetes/kubernetes/pull/118800), [@harche](https://github.com/harche)) [SIG Node]

## Dependencies

### Added
_Nothing has changed._

### Changed
- github.com/google/cadvisor: [v0.44.1 → v0.44.2](https://github.com/google/cadvisor/compare/v0.44.1...v0.44.2)

- Added support for Evented PLEG feature gate. ([#111384](https://github.com/kubernetes/kubernetes/pull/111384), [@harche](https://github.com/harche))

  - Regenerate list of EC2 instances
  - Fix pricing endpoint in AWS China Region
  
  ### Azure
  - Add optional jitter on initial VMSS VM cache refresh, keep the refreshes spread over time
  - Serve from cache for the whole period of ongoing throttling
  - Fix unwanted VMSS VMs cache invalidation
  - Enforce setting the number of retries if cloud provider backoff is enabled
  - Don't update capacity if VMSS provisioning state is updating