([#41449](https://github.com/kubernetes/kubernetes/pull/41449),
  [@zmerlynn](https://github.com/zmerlynn))
* Kubelet: Remove the PLEG health check from /healthz, Kubelet will now report
* NodeNotReady on failed PLEG health check.
  ([#41569](https://github.com/kubernetes/kubernetes/pull/41569),
  [@yujuhong](https://github.com/yujuhong))
* CRI: upgrade protobuf to v3. Protobuf v2 and v3 are not compatible.

- Fix the VMSS name and resource group name when updating Azure VMSS for LoadBalancer backendPools ([#89337](https://github.com/kubernetes/kubernetes/pull/89337), [@feiskyer](https://github.com/feiskyer)) [SIG Cloud Provider]
- Fix: check disk status before delete azure disk ([#88360](https://github.com/kubernetes/kubernetes/pull/88360), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider]

### Migration

Check out the [Pydantic migration guide](https://docs.pydantic.dev/2.0/migration/).

- [`KT-56943`](https://youtrack.jetbrains.com/issue/KT-56943) K/Wasm: implement `@WasmImport` diagnostics
- [`KT-55903`](https://youtrack.jetbrains.com/issue/KT-55903) K2: False negative CANNOT_CHECK_FOR_ERASED on is-check for type with reified type arguments
- [`KT-56944`](https://youtrack.jetbrains.com/issue/KT-56944) K/Wasm: implement `@JsFun` diagnostics

* GCE/GKE load balancer health check default interval changes from 2 seconds to 8 seconds, unhealthyThreshold to 3. ([#70099](https://github.com/kubernetes/kubernetes/pull/70099), [@grayluck](https://github.com/grayluck))
    * Health check parameters are configurable to be bigger than default values.



# v1.11.4

* GCE/GKE load balancer health check default interval changes from 2 seconds to 8 seconds, unhealthyThreshold to 3. ([#70099](https://github.com/kubernetes/kubernetes/pull/70099), [@grayluck](https://github.com/grayluck))
    * Health check parameters are configurable to be bigger than default values.

pkg syscall (darwin-arm64), const F_NODIRECT ideal-int
pkg syscall (darwin-arm64), const F_OK = 0
pkg syscall (darwin-arm64), const F_OK ideal-int
pkg syscall (darwin-arm64), const F_PATHPKG_CHECK = 52
pkg syscall (darwin-arm64), const F_PATHPKG_CHECK ideal-int
pkg syscall (darwin-arm64), const F_PEOFPOSMODE = 3
pkg syscall (darwin-arm64), const F_PEOFPOSMODE ideal-int
pkg syscall (darwin-arm64), const F_PREALLOCATE = 42

- Kubeadm: allow the "certs check-expiration" command to not require the existence of the cluster CA key (ca.key file) when checking the expiration of managed certificates in kubeconfig files. ([#106927](https://github.com/kubernetes/kubernetes/pull/106927), [@neolit123](https://github.com/neolit123)) [SIG Cluster Lifecycle]

winkernel mode. `--forward-healthcheck-vip`, if specified as true, health check traffic whose destination is service VIP will be forwarded to kube-proxy's healthcheck service. `--root-hnsendpoint-name` specifies the name of the hns endpoint for the root network namespace. This option enables the pass-through load balancers like Google's GCLB to correctly health check the backend services. Without this change, the health check packets is dropped, and Windows node will be considered to be unhealthy by...

- Use NLB Subnet CIDRs instead of VPC CIDRs in Health Check SG Rules ([#93515](https://github.com/kubernetes/kubernetes/pull/93515), [@t0rr3sp3dr0](https://github.com/t0rr3sp3dr0)) [SIG Cloud Provider]

## Dependencies

### Added
_Nothing has changed._

### Changed