* Allow for configuring etcd hostname in the manifest ([#54403](https://github.com/kubernetes/kubernetes/pull/54403), [@wojtek-t](https://github.com/wojtek-t))
* - kubeadm  will warn users if access to IP ranges for Pods or Services will be done via HTTP proxy. ([#52792](https://github.com/kubernetes/kubernetes/pull/52792), [@kad](https://github.com/kad))

<!-- BEGIN MUNGE: GENERATED_TOC -->

- [v1.21.14](#v12114)
  - [Downloads for v1.21.14](#downloads-for-v12114)
    - [Source Code](#source-code)
    - [Client Binaries](#client-binaries)
    - [Server Binaries](#server-binaries)
    - [Node Binaries](#node-binaries)
    - [Container Images](#container-images)
  - [Changelog since v1.21.13](#changelog-since-v12113)
  - [Dependencies](#dependencies)
    - [Added](#added)
    - [Changed](#changed)

<!-- BEGIN MUNGE: GENERATED_TOC -->
- [v1.10.13](#v11013)
  - [Downloads for v1.10.13](#downloads-for-v11013)
    - [Client Binaries](#client-binaries)
    - [Server Binaries](#server-binaries)
    - [Node Binaries](#node-binaries)
  - [Changelog since v1.10.12](#changelog-since-v11012)
    - [Other notable changes](#other-notable-changes)
- [v1.10.12](#v11012)
  - [Downloads for v1.10.12](#downloads-for-v11012)
    - [Client Binaries](#client-binaries-1)

<!-- BEGIN MUNGE: GENERATED_TOC -->

- [v1.27.13](#v12713)
  - [Downloads for v1.27.13](#downloads-for-v12713)
    - [Source Code](#source-code)
    - [Client Binaries](#client-binaries)
    - [Server Binaries](#server-binaries)
    - [Node Binaries](#node-binaries)
    - [Container Images](#container-images)
  - [Changelog since v1.27.12](#changelog-since-v12712)
  - [Important Security Information](#important-security-information)

- Fixes v1.17.0 regression in --service-cluster-ip-range handling with IPv4 ranges larger than 65536 IP addresses ([#86534](https://github.com/kubernetes/kubernetes/pull/86534), [@liggitt](https://github.com/liggitt)) [SIG Network]

<!-- BEGIN MUNGE: GENERATED_TOC -->
- [v1.8.15](#v1815)
  - [Downloads for v1.8.15](#downloads-for-v1815)
    - [Client Binaries](#client-binaries)
    - [Server Binaries](#server-binaries)
    - [Node Binaries](#node-binaries)
  - [Changelog since v1.8.14](#changelog-since-v1814)
    - [Action Required](#action-required)
    - [Other notable changes](#other-notable-changes)
- [v1.8.14](#v1814)
  - [Downloads for v1.8.14](#downloads-for-v1814)

<!-- BEGIN MUNGE: GENERATED_TOC -->

- [v1.28.9](#v1289)
  - [Downloads for v1.28.9](#downloads-for-v1289)
    - [Source Code](#source-code)
    - [Client Binaries](#client-binaries)
    - [Server Binaries](#server-binaries)
    - [Node Binaries](#node-binaries)
    - [Container Images](#container-images)
  - [Changelog since v1.28.8](#changelog-since-v1288)
  - [Important Security Information](#important-security-information)

- PodSecurityPolicy objects now support a `MayRunAs` rule for `fsGroup` and `supplementalGroups` options. This allows specifying ranges of allowed GIDs for pods/containers without forcing a default GID the way `MustRunAs` does. This means that a container to which such a policy applies to won't use any fsGroup/supplementalGroup GID if not explicitly specified, yet a specified GID...

- Added the latest GCE pinhole firewall feature, which introduces `destination-ranges` in the ingress `firewall-rules`. It restricts access to the backend IPs by allowing traffic through `ILB` or `NetLB` only. This change does **NOT** change the existing `ILB` or `NetLB` behavior. ([#109510](https://github.com/kubernetes/kubernetes/pull/109510),...

- Kube-controller-manager: volume plugins can be restricted from contacting local and loopback addresses by setting `--volume-host-allow-local-loopback=false`, or from contacting specific CIDR ranges by setting `--volume-host-cidr-denylist` (for example, `--volume-host-cidr-denylist=127.0.0.1/28,feed::/16`) ([#91785](https://github.com/kubernetes/kubernetes/pull/91785), [@mattcary](https://github.com/mattcary)) [SIG API Machinery, Apps, Auth,...