pkg syscall (freebsd-arm), const SYS_CAP_FCNTLS_GET = 537
pkg syscall (freebsd-arm), const SYS_CAP_FCNTLS_GET ideal-int
pkg syscall (freebsd-arm), const SYS_CAP_FCNTLS_LIMIT = 536
pkg syscall (freebsd-arm), const SYS_CAP_FCNTLS_LIMIT ideal-int
pkg syscall (freebsd-arm), const SYS_CAP_IOCTLS_GET = 535
pkg syscall (freebsd-arm), const SYS_CAP_IOCTLS_GET ideal-int
pkg syscall (freebsd-arm), const SYS_CAP_IOCTLS_LIMIT = 534

- CAP_SYS_ADMIN
- CAP_NET_ADMIN
- CAP_NET_RAW

## Ambient mode details

Fundamentally, this component is responsible for the following:

prepared before that call will be sent or received after the call.
Earlier versions of Go used channels with a one-element buffer,
making it difficult to use `Reset` and `Stop` correctly.
A visible effect of this change is that `len` and `cap` of timer channels
now returns 0 instead of 1, which may affect programs that
poll the length to decide whether a receive on the timer channel
will succeed.
Such code should use a non-blocking receive instead.

pkg syscall (freebsd-arm64), const SYS_CAP_GETMODE ideal-int
pkg syscall (freebsd-arm64), const SYS_CAP_IOCTLS_GET = 535
pkg syscall (freebsd-arm64), const SYS_CAP_IOCTLS_GET ideal-int
pkg syscall (freebsd-arm64), const SYS_CAP_IOCTLS_LIMIT = 534
pkg syscall (freebsd-arm64), const SYS_CAP_IOCTLS_LIMIT ideal-int
pkg syscall (freebsd-arm64), const SYS_CAP_RIGHTS_LIMIT = 533
pkg syscall (freebsd-arm64), const SYS_CAP_RIGHTS_LIMIT ideal-int

  private const val SETTINGS_HEADER_TABLE_SIZE = 4_096

  /**
   * The decoder has ultimate control of the maximum size of the dynamic table but we can choose
   * to use less. We'll put a cap at 16K. This is arbitrary but should be enough for most purposes.
   */
  private const val SETTINGS_HEADER_TABLE_SIZE_LIMIT = 16_384

  val STATIC_HEADER_TABLE =
    arrayOf(
      Header(TARGET_AUTHORITY, ""),

pkg syscall (freebsd-riscv64), const SYS_CAP_GETMODE ideal-int #53466
pkg syscall (freebsd-riscv64), const SYS_CAP_IOCTLS_GET = 535 #53466
pkg syscall (freebsd-riscv64), const SYS_CAP_IOCTLS_GET ideal-int #53466
pkg syscall (freebsd-riscv64), const SYS_CAP_IOCTLS_LIMIT = 534 #53466
pkg syscall (freebsd-riscv64), const SYS_CAP_IOCTLS_LIMIT ideal-int #53466

pkg syscall (freebsd-arm), const SYS_CAP_ENTER = 516
pkg syscall (freebsd-arm), const SYS_CAP_FCNTLS_GET = 537
pkg syscall (freebsd-arm), const SYS_CAP_FCNTLS_LIMIT = 536
pkg syscall (freebsd-arm), const SYS_CAP_GETMODE = 517
pkg syscall (freebsd-arm), const SYS_CAP_IOCTLS_GET = 535
pkg syscall (freebsd-arm), const SYS_CAP_IOCTLS_LIMIT = 534
pkg syscall (freebsd-arm), const SYS_CAP_NEW = 514

- '`kubeadm`: removed `system:masters` organization from `etcd/healthcheck-client`
  certificate.' ([#119859](https://github.com/kubernetes/kubernetes/pull/119859), [@SataQiu](https://github.com/SataQiu))
- Added `CAP_NET_RAW` to netadmin debug profile and removed privileges when debugging nodes. ([#118647](https://github.com/kubernetes/kubernetes/pull/118647), [@mochizuki875](https://github.com/mochizuki875))

  // If set to true or not present, the pod will be run in the host user namespace, useful
  // for when the pod needs a feature only available to the host user namespace, such as
  // loading a kernel module with CAP_SYS_MODULE.
  // When set to false, a new userns is created for the pod. Setting false is useful for
  // mitigating container breakout vulnerabilities even allowing users to run their

## Changes by Kind

### Feature

- Kubernetes is now built with go 1.21.9
  - update debian-base/set-cap to bookworm-v1.0.2 ([#124198](https://github.com/kubernetes/kubernetes/pull/124198), [@cpanato](https://github.com/cpanato)) [SIG API Machinery, Architecture, Release and Testing]

### Bug or Regression