- [Continuous Improvement](#continuous-improvement)
    - [Extensibility](#extensibility)
  - [Extensibility around core Kubernetes APIs](#extensibility-around-core-kubernetes-apis)
    - [CustomResourceDefinitions Pruning](#customresourcedefinitions-pruning)
    - [CustomResourceDefinition Defaulting](#customresourcedefinition-defaulting)
    - [CustomResourceDefinition OpenAPI Publishing](#customresourcedefinition-openapi-publishing)

- Added unit test helpers to validate CEL and patterns in CustomResourceDefinitions. ([#129028](https://github.com/kubernetes/kubernetes/pull/129028), [@sttts](https://github.com/sttts))

In addition, users can now create multiple versions of CustomResourceDefinitions, but without any kind of automatic conversion, and CustomResourceDefinitions now allow specification of additional columns for `kubectl get` output via the `spec.additionalPrinterColumns` field.

### SIG Auth

## API Changes
- CustomResourceDefinitions now validate documented API semantics of `x-kubernetes-list-type` and `x-kubernetes-map-type` atomic to reject non-atomic sub-types. ([#84722](https://github.com/kubernetes/kubernetes/pull/84722), [@sttts](https://github.com/sttts))

  - `spec.versions[*].schema.openAPIV3Schema` is now required when creating v1 CustomResourceDefinitions
  - `spec.preserveUnknownFields: true` is disallowed when creating v1 CustomResourceDefinitions; it must be specified within schema definitions as `x-kubernetes-preserve-unknown-fields: true`

- The list-type of the alpha `resourceClaims` field introduced to `Pods` in `1.26.0` was modified from `set` to `map`, resolving an incompatibility with use of this schema in `CustomResourceDefinitions` and with server-side apply. ([#114585](https://github.com/kubernetes/kubernetes/pull/114585), [@JoelSpeed](https://github.com/JoelSpeed))

- CRI API had auth fields in image pulling marked as `debug_redact`. ([#133135](https://github.com/kubernetes/kubernetes/pull/133135), [@SergeyKanzhelev](https://github.com/SergeyKanzhelev))

* fix data loss issue if using existing azure disk with partitions in disk mount  ([#63270](https://github.com/kubernetes/kubernetes/pull/63270), [@andyzhangx](https://github.com/andyzhangx))
* The garbage collector now supports CustomResourceDefinitions and APIServices. ([#65916](https://github.com/kubernetes/kubernetes/pull/65916), [@xmudrii](https://github.com/xmudrii))

- Kube-apiserver: fixes a potential crash serving CustomResourceDefinitions that combine an invalid schema and CEL validation rules. ([#126167](https://github.com/kubernetes/kubernetes/pull/126167), [@cici37](https://github.com/cici37)) [SIG API Machinery and Testing]

* The garbage collector now supports CustomResourceDefinitions and APIServices. ([#65918](https://github.com/kubernetes/kubernetes/pull/65918), [@nikhita](https://github.com/nikhita))