pkg syscall (netbsd-arm64-cgo), const AF_DATAKIT ideal-int
pkg syscall (netbsd-arm64-cgo), const AF_DECnet = 12
pkg syscall (netbsd-arm64-cgo), const AF_DECnet ideal-int
pkg syscall (netbsd-arm64-cgo), const AF_DLI = 13
pkg syscall (netbsd-arm64-cgo), const AF_DLI ideal-int
pkg syscall (netbsd-arm64-cgo), const AF_E164 = 26
pkg syscall (netbsd-arm64-cgo), const AF_E164 ideal-int
pkg syscall (netbsd-arm64-cgo), const AF_ECMA = 8

pkg syscall (darwin-amd64), func SetBpfDatalink //deprecated
pkg syscall (darwin-amd64), func SetBpfHeadercmpl //deprecated
pkg syscall (darwin-amd64), func SetBpfImmediate //deprecated
pkg syscall (darwin-amd64), func SetBpfInterface //deprecated
pkg syscall (darwin-amd64), func SetBpfPromisc //deprecated
pkg syscall (darwin-amd64), func SetBpfTimeout //deprecated
pkg syscall (darwin-amd64), func StringSlicePtr //deprecated

  and “net.ipv4.tcp_keepalive_probes“ sysctl by default; Pod Security Admission
  allows this sysctl in `v1.29+` versions of the baseline and restricted policies. ([#121240](https://github.com/kubernetes/kubernetes/pull/121240), [@HirazawaUi](https://github.com/HirazawaUi))
- `kubelet` now allows pods to use the `net.ipv4.tcp_keepalive_time` sysctl by default

- Kubelet now hard rejects pods with AppArmor if the node does not have AppArmor. ([#125776](https://github.com/kubernetes/kubernetes/pull/125776), [@vinayakankugoyal](https://github.com/vinayakankugoyal))
- Mount-utils: treated syscall.ENODEV as corrupted mount. ([#126174](https://github.com/kubernetes/kubernetes/pull/126174), [@dobsonj](https://github.com/dobsonj))

- Mount-utils: treat syscall.ENODEV as corrupted mount ([#126174](https://github.com/kubernetes/kubernetes/pull/126174), [@dobsonj](https://github.com/dobsonj)) [SIG Storage]

- Mount-utils: treat syscall.ENODEV as corrupted mount ([#126174](https://github.com/kubernetes/kubernetes/pull/126174), [@dobsonj](https://github.com/dobsonj)) [SIG Storage]

* The Sysctls experimental feature has been promoted to beta (enabled by default via the `Sysctls` feature flag). PodSecurityPolicy and Pod objects now have fields for specifying and controlling sysctls. Alpha sysctl annotations will be ignored by 1.11+ kubelets. All alpha sysctl annotations in existing deployments must be converted to API fields to be effective. ([#6371](https://github.com...

- Pod SecurityContext sysctls name parameter for update requests where the existing object's sysctl contains slashes and kubelet sysctl whitelist support contains slashes. ([#102393](https://github.com/kubernetes/kubernetes/pull/102393), [@mengjiao-liu](https://github.com/mengjiao-liu)) [SIG Apps, Auth, Node, Storage and Testing]...

- Pods were allowed to use the `net.ipv4.tcp_rmem` and `net.ipv4.tcp_wmem` sysctl by default
  when the kernel version was 4.15 or higher. With the kernel 4.15 the sysctl became namespaced.

* The `spec.SecurityContext.Sysctls` field is now dropped during creation of `Pod` objects unless the `Sysctls` feature gate is enabled. ([#72752](https://github.com/kubernetes/kubernetes/pull/72752), [@rajathagasthya](https://github.com/rajathagasthya))
    * The `spec.AllowedUnsafeSysctls` and `spec.ForbiddenSysctls` fields are now dropped during creation of `PodSecurityPolicy` objects unless the `Sysctls` feature gate is enabled.