- Added support for specifying `controlplane` or `cluster` egress selectors in JWT authenticators via the `issuer.egressSelectorType` field in the `AuthenticationConfiguration.jwt` array. If unset, the previous behavior of using no egress selector is preserved. This functionality requires the `StructuredAuthenticationConfigurationEgressSelector` beta feature gate (enabled by default). ([#132768](https://...

- Aggregated discovery supports both `v2beta1` and v2 types and feature is promoted to GA. ([#122882](https://github.com/kubernetes/kubernetes/pull/122882), [@Jefftree](https://github.com/Jefftree))

- For Dynamic Resource Allocation, labels in node selectors now are validated. Invalid labels already caused runtime errors before and are unlikely to occur in practice. ([#128932](https://github.com/kubernetes/kubernetes/pull/128932), [@pohly](https://github.com/pohly))

   * Returns this address's explicitly-specified HTTP proxy, or null to delegate to the
   * [proxy selector][proxySelector].
   */
  @get:JvmName("proxy") val proxy: Proxy?,
  protocols: List<Protocol>,
  connectionSpecs: List<ConnectionSpec>,
  /**
   * Returns this address's proxy selector. Only used if the proxy is null. If none of this
   * selector's proxies are reachable, a direct connection will be attempted.
   */

- Fixed CVE-2024-51744. ([#128621](https://github.com/kubernetes/kubernetes/pull/128621), [@kmala](https://github.com/kmala)) [SIG Auth, Cloud Provider and Node]
- Fixed `kubectl wait --for=create` behavior with label selectors, to properly wait for resources with matching labels to appear. ([#128662](https://github.com/kubernetes/kubernetes/pull/128662), [@omerap12](https://github.com/omerap12)) [SIG CLI and Testing]

- Services implemented a field selector for the ClusterIP and Type fields.

 * connection the client has many options:
 *
 *  * **HTTP proxy:** a proxy server may be explicitly configured for the client. Otherwise, the
 *    [proxy selector][java.net.ProxySelector] is used. It may return multiple proxies to attempt.
 *  * **IP address:** whether connecting directly to an origin server or a proxy, opening a socket

   * only [Proxy.NO_PROXY]. This comes up in several situations:
   *
   * * If neither a proxy nor proxy selector is configured.
   * * If the proxy is configured explicitly as [Proxy.NO_PROXY].
   * * If the proxy selector returns only [Proxy.NO_PROXY].
   * * If the proxy selector returns an empty list or null.
   *
   * Otherwise it lists the proxies in the order they will be attempted.
   *

        if (session != null) {
            org.eclipse.aether.repository.MirrorSelector selector = session.getMirrorSelector();
            if (selector != null) {
                RemoteRepository repo = selector.getMirror(RepositoryUtils.toRepo(repository));
                if (repo != null) {
                    Mirror mirror = new Mirror();

    assertThat(selection.hasNext()).isFalse()
    assertThat(routeSelector.hasNext()).isFalse()
    dns.assertRequests(uriHost)
    proxySelector.assertRequests() // No proxy selector requests!
  }

  /**
   * Don't call through to the proxy selector if we don't have a host name.
   * https://github.com/square/okhttp/issues/5770
   */
  @Test fun proxySelectorNotCalledForNullHost() {