```yaml
    kind: NetworkPolicy
    apiVersion: networking.k8s.io/v1
    metadata:
      name: default-deny
    spec:
      podSelector:
    ```

  Added `validationActions` to `ValidatingAdmissionPolicyBinding`, enabling validation failures to be handled by any combination of the warn, audit and deny enforcement actions. ([#115973](https://github.com/kubernetes/kubernetes/pull/115973), [@jpbetz](https://github.com/jpbetz))

pkg syscall (darwin-arm64), const PT_ATTACHEXC ideal-int
pkg syscall (darwin-arm64), const PT_CONTINUE = 7
pkg syscall (darwin-arm64), const PT_CONTINUE ideal-int
pkg syscall (darwin-arm64), const PT_DENY_ATTACH = 31
pkg syscall (darwin-arm64), const PT_DENY_ATTACH ideal-int
pkg syscall (darwin-arm64), const PT_DETACH = 11
pkg syscall (darwin-arm64), const PT_DETACH ideal-int
pkg syscall (darwin-arm64), const PT_FIRSTMACH = 32

	   traffic:

	   ```yaml
           kind: NetworkPolicy
           apiVersion: networking.k8s.io/v1
           metadata:
             name: default-deny
           spec:
             podSelector:
	   ```

	   This will ensure that pods that aren't matched by any other
	   NetworkPolicy will continue to be fully-isolated, as they were
	   before.

- Kubelet should reconcile `kubernetes.io/os` and `kubernetes.io/arch` labels on the node object. The side-effect of this is kubelet would deny admission to pod which has nodeSelector with label `kubernetes.io/os` or `kubernetes.io/arch` which doesn't match the underlying OS or arch on the host OS. 

* DenyEscalatingExec admission controller now checks psp HostNetwork as well as hostIPC and hostPID. hostNetwork is also checked to deny exec /attach. ([#56839](https://github.com/kubernetes/kubernetes/pull/56839), [@hzxuzhonghu](https://github.com/hzxuzhonghu))