### Feature

  * Add secretbox and AES-CBC encryption modes to at rest encryption. AES-CBC is considered superior to AES-GCM because it is resistant to nonce-reuse attacks, and secretbox uses Poly1305 and XSalsa20. ([#46916](https://github.com/kubernetes/kubernetes/pull/46916), [@smarterclayton](https://github.com/smarterclayton))

* Bug fixes:

- The API server now re-uses data encryption keys while the kms v2 plugin key ID is stable.  Data encryption keys are still randomly generated on server start but an atomic counter is used to prevent nonce collisions. ([#116155](https://github.com/kubernetes/kubernetes/pull/116155), [@enj](https://github.com/enj))

* Add secretbox and AES-CBC encryption modes to at rest encryption.  AES-CBC is considered superior to AES-GCM because it is resistant to nonce-reuse attacks, and secretbox uses Poly1305 and XSalsa20. ([#46916](https://github.com/kubernetes/kubernetes/pull/46916), [@smarterclayton](https://github.com/smarterclayton))

  // that are not part of the Kubernetes system.
  // +optional
  repeated string externalIPs = 5;

  // Supports "ClientIP" and "None". Used to maintain session affinity.
  // Enable client IP based session affinity.
  // Must be ClientIP or None.
  // Defaults to None.
  // More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies
  // +optional

```Python
from typing import Union
from fastapi import Cookie, FastAPI, Header, Path, Query

app = FastAPI()


@app.get("/items/{item_id}")
def main(
    item_id: int = Path(gt=0),
    query: Union[str, None] = Query(default=None, max_length=10),
    session: Union[str, None] = Cookie(default=None, min_length=3),

## Changelog since v1.18.15

## Changes by Kind

### Bug or Regression

- Avoid marking node as Ready until node has synced with API servers at least once ([#99034](https://github.com/kubernetes/kubernetes/pull/99034), [@ehashman](https://github.com/ehashman)) [SIG Node]

    * --alpha-endpoint-reconciler-type=(master-count, lease, none) (default
    * "master-count"). The original reconciler is 'master-count'. The 'lease'
    * reconciler uses the storageapi and a TTL to keep alive an endpoint within the
    * `kube-apiserver-endpoint` storage namespace. The 'none' reconciler is a noop
    * reconciler that does not do anything. This is useful for self-hosted

### Uncategorized

- NONE
  NONE ([#127462](https://github.com/kubernetes/kubernetes/pull/127462), [@dims](https://github.com/dims)) [SIG Node and Testing]

## Dependencies

### Added
_Nothing has changed._

### Changed

<p>
A <i>string type</i> represents the set of string values.
A string value is a (possibly empty) sequence of bytes.
The number of bytes is called the length of the string and is never negative.
Strings are immutable: once created,
it is impossible to change the contents of a string.
The predeclared string type is <code>string</code>;
it is a <a href="#Type_definitions">defined type</a>.
</p>

<p>