- When the go-client reflector relists, the ResourceVersion list option is set to the reflector's latest synced resource version to ensure the reflector does not "go back in time" and reprocess events older than it has already processed. If the server responds with an HTTP 410 (Gone) status code response, the relist falls back to using `resourceVersion=""`. ([#83520](https://github.com/kubernetes/kubernetes/pull/83520), [@jpbetz](https...

	// +optional
	ReadOnlyRootFilesystem *bool
	// AllowPrivilegeEscalation controls whether a process can gain more
	// privileges than its parent process. This bool directly controls if
	// the no_new_privs flag will be set on the container process.
	// Note that this field cannot be set when spec.os.name is windows.
	// +optional
	AllowPrivilegeEscalation *bool

	"uid":                "UID is the primary uid initially attached to the first process in the container",
	"gid":                "GID is the primary gid initially attached to the first process in the container",
	"supplementalGroups": "SupplementalGroups are the supplemental groups initially attached to the first process in the container",
}

func (LinuxContainerUser) SwaggerDoc() map[string]string {

  // A list of groups applied to the first process run in each container, in addition
  // to the container's primary GID, the fsGroup (if specified), and group memberships
  // defined in the container image for the uid of the container process. If unspecified,
  // no additional groups are added to any container. Note that group memberships
  // defined in the container image for the uid of the container process are still effective,

	// UID is the primary uid initially attached to the first process in the container
	UID int64 `json:"uid" protobuf:"varint,1,name=uid"`
	// GID is the primary gid initially attached to the first process in the container
	GID int64 `json:"gid" protobuf:"varint,2,name=gid"`
	// SupplementalGroups are the supplemental groups initially attached to the first process in the container
	// +optional
	// +listType=atomic

                  status reports. [Default: 90s]'
                pattern: ^([0-9]+(\\.[0-9]+)?(ms|s|m|h))*$
                type: string
              routeRefreshInterval:
                description: 'RouteRefreshInterval is the period at which Felix re-checks
                  the routes in the dataplane to ensure that no other process has

- Kubelet.exe on Windows now checks that the process running as administrator and the executing user account is listed in the built-in administrators group.  This is the equivalent to checking the process is running as uid 0. ([#96616](https://github.com/kubernetes/kubernetes/pull/96616), [@perithompson](https://github.com/perithompson)) [SIG Node and Windows]

* Return apiserver panics as 500 errors instead terminating the apiserver process. ([#68001](https://github.com/kubernetes/kubernetes/pull/68001), [@sttts](https://github.com/sttts))

* Local volume source paths that are directories and not mount points fail to unmount.  A fix is in process ([#48331](https://github.com/kubernetes/kubernetes/issues/48331)).

## Changelog since v1.18.13

## Changes by Kind

### Feature

- Add a new flag to set priority for the kubelet on Windows nodes so that workloads cannot overwhelm the node there by disrupting kubelet process. ([#96158](https://github.com/kubernetes/kubernetes/pull/96158), [@ravisantoshgudimetla](https://github.com/ravisantoshgudimetla)) [SIG Node]

### Bug or Regression