- Secure serving on port 10258 to cloud-controller-manager (configurable via `--secure-port`) is now enabled. Delegated authentication and authorization are to be configured using the same flags as for aggregated API servers. Without configuration, the secure port will only allow access to `/healthz`. ([#67069](https://github.com/kubernetes/kubernetes/pull/67069), [@sttts](https...

#### kubectl:

* kubeadm: kubelets in kubeadm clusters now disable the readonly port (10255). If you're relying on unauthenticated access to the readonly port, please switch to using the secure port (10250). Instead, you can now use ServiceAccount tokens when talking to the secure port, which will make it easier to get access to, for example, the `/metrics` endpoint of the kubelet, securely. ([#64187](https://github.com/kubernetes/kubernetes/pull/64187), [@luxas](https://github.com/luxas))...

- GCERegionalPersistentDisk feature is GA now! ([#70716](https://github.com/kubernetes/kubernetes/pull/70716), [@jingxu97](https://github.com/jingxu97))

    <glob pattern="*.curl"/>
  </mime-type>
  <mime-type type="text/vnd.curl.dcurl">
    <glob pattern="*.dcurl"/>
  </mime-type>
  <mime-type type="text/vnd.curl.scurl">
    <glob pattern="*.scurl"/>
  </mime-type>
  <mime-type type="text/vnd.curl.mcurl">
    <glob pattern="*.mcurl"/>
  </mime-type>
  <mime-type type="text/vnd.dmclientscript"/>

cloud-controller-manager has been deprecated, and will be removed in a future release. Use `--secure-port` and `--bind-address` instead. ([#59582](https://github.com/kubernetes/kubernetes/pull/59582), [@sttts](https://github.com/sttts))

* The ability to use the insecure flags `--insecure-bind-address`, `--insecure-port` in the apiserver has been deprecated and will be removed in a future release. Use `--secure-port` and `--bind-address` instead. ([#59018](https://github.com/kubernetes/kubernetes/pull/59018),...

    - [Container Storage Interface graduations](#container-storage-interface-graduations)
    - [SIG Windows development tools](#sig-windows-development-tools)
    - [Deploy a more secure control plane with kubeadm](#deploy-a-more-secure-control-plane-with-kubeadm)
    - [etcd moves to version 3.5.0](#etcd-moves-to-version-350)
    - [Kubernetes Node system swap support](#kubernetes-node-system-swap-support)

- Kubeadm: reset raises warnings if it cannot delete folders ([#85265](https://github.com/kubernetes/kubernetes/pull/85265), [@SataQiu](https://github.com/SataQiu))

### Feature

- Kubernetes is now built with Golang 1.16.9 (#105672, @cpanato) [SIG Cloud Provider, Instrumentation, Release and Testing]

### Failing Test

- Backport: e2e.test now uses the secure port to retrieve metrics data to ensure compatibility with 1.21 and 1.22 (for upgrade tests) (#104328, @pohly) [SIG API Machinery, Instrumentation, Storage and Testing]

### Bug or Regression

pkg syscall (netbsd-arm64-cgo), const SIGTTIN Signal
pkg syscall (netbsd-arm64-cgo), const SIGTTOU = 22
pkg syscall (netbsd-arm64-cgo), const SIGTTOU Signal
pkg syscall (netbsd-arm64-cgo), const SIGURG = 16
pkg syscall (netbsd-arm64-cgo), const SIGURG Signal
pkg syscall (netbsd-arm64-cgo), const SIGUSR1 = 30
pkg syscall (netbsd-arm64-cgo), const SIGUSR1 Signal
pkg syscall (netbsd-arm64-cgo), const SIGUSR2 = 31