// readOnlyRootFilesystem when set to true will force containers to run with a read only root file
  // system.  If the container specifically requests to run with a non-read only root file system
  // the PSP should deny the pod.
  // If set to false the container may run with a read only root file system if it wishes but it
  // will not be forced to.
  // +optional
  optional bool readOnlyRootFilesystem = 14;

* Fixed a panic in `kubectl run --attach ...` when the api server failed to create the runtime object (due to name conflict, PSP restriction, etc.) ([#61713](https://github.com/kubernetes/kubernetes/pull/61713), [@mountkin](https://github.com/mountkin))

### Ephemeral Containers Graduate to Stable

pro.tt pro.typeform.com pro.vn prochowice.pl prod production.aero productions prof prof.pr profesional.bo progressive project.museum promo properties property protection protonet.io pru prudential pruszkow.pl prvcy.page przeworsk.pl ps psc.br psi.br psp.gov.pl psse.gov.pl pstmn.io pt pt.eu.org pt.it pu.it pub pub.instances.scw.cloud pub.sa publ.pt public-inquiry.uk public.museum publishproxy.com pubol.museum pubtls.org pueblo.bo pug.it puglia.it pulawy.pl punyu.jp pup.gov.pl pupu.jp pussycat.jp pv.it...

- Kube-apiserver: the alpha PodSecurity feature can be enabled by passing `--feature-gates=PodSecurity=true`, and enables controlling allowed pods using namespace labels. See https://git.k8s.io/enhancements/keps/sig-auth/2579-psp-replacement for more details. ([#103099](https://github.com/kubernetes/kubernetes/pull/103099), [@liggitt](https://github.com/liggitt)) [SIG API Machinery, Auth, Instrumentation, Release, Security and Testing]

## Changelog since v1.20.0

## What's New (Major Themes)

### Deprecation of PodSecurityPolicy

szkola.pl
targi.pl
tm.pl
tourism.pl
travel.pl
turystyka.pl
// Government domains
gov.pl
ap.gov.pl
ic.gov.pl
is.gov.pl
us.gov.pl
kmpsp.gov.pl
kppsp.gov.pl
kwpsp.gov.pl
psp.gov.pl
wskr.gov.pl
kwp.gov.pl
mw.gov.pl
ug.gov.pl
um.gov.pl
umig.gov.pl
ugim.gov.pl
upow.gov.pl
uw.gov.pl
starostwo.gov.pl
pa.gov.pl
po.gov.pl
psse.gov.pl

* Fix panic in ControllerManager on GCE when it has a problem with creating external loadbalancer healthcheck ([#52646](https://github.com/kubernetes/kubernetes/pull/52646), [@gmarek](https://github.com/gmarek))
* PSP: add support for using `*` as a value in `allowedCapabilities` to allow to request any capabilities ([#51337](https://github.com/kubernetes/kubernetes/pull/51337), [@php-coder](https://github.com/php-coder))