- Added two client certificate metrics for exec auth:
    - `rest_client_certificate_expiration_seconds` a gauge reporting the lifetime of the current client certificate. Reports the time of expiry in seconds since January 1, 1970 UTC.

    /** The key of the configuration. e.g. config_id */
    String INDEX_FIELD_config_id = "index.field.config_id";

    /** The key of the configuration. e.g. expires */
    String INDEX_FIELD_EXPIRES = "index.field.expires";

    /** The key of the configuration. e.g. url */
    String INDEX_FIELD_URL = "index.field.url";

    /** The key of the configuration. e.g. doc_id */

 Extended resources cannot be overcommitted, so make sure that request and limit are equal
 if both are present in a container spec.

 - The default Bootstrap Token created with `kubeadm init` v1.8 expires
 and is deleted after 24 hours by default to limit the exposure of the
 valuable credential. You can create a new Bootstrap Token with
 `kubeadm token create` or make the default token permanently valid by specifying

* Cluster federation servers have changed the location in etcd where federated services are stored, so existing federated services must be deleted and recreated. Before upgrading, export all federated services from the federation server and delete the services. After upgrading the cluster, recreate the federated services from the exported data. ([#37770](https://github.com/kubernetes/kubernetes/pull/37770), [@enj](https://github.com/enj))...

([#69099](https://github.com/kubernetes/kubernetes/pull/69099), [@ehashman](https://github.com/ehashman))

## Deprecations

- kubectl
  - `kubectl convert` is deprecated and will be removed in v1.17.
  - The `--export` flag for the `kubectl get` command is deprecated and will be removed in v1.18. ([#73787](https://github.com/kubernetes/kubernetes/pull/73787), [@soltysh](https://github.com/soltysh))

- kubelet

- [`KT-58654`](https://youtrack.jetbrains.com/issue/KT-58654) Compiler error from kotlin.collections.Map : "Invalid phi record", while compiling for kotlin native

### Native. C Export

- [`KT-56182`](https://youtrack.jetbrains.com/issue/KT-56182) [K2/N] C export doesn't work for non-root packages with K2

### Native. C and ObjC Import

- The `batch/v2alpha1` CronJob type definitions and clients are deprecated and removed. ([#96987](https://github.com/kubernetes/kubernetes/pull/96987), [@soltysh](https://github.com/soltysh)) [SIG API Machinery, Apps, CLI and Testing]

pkg syscall (netbsd-arm64-cgo), const RTM_VERSION = 4
pkg syscall (netbsd-arm64-cgo), const RTM_VERSION ideal-int
pkg syscall (netbsd-arm64-cgo), const RTV_EXPIRE = 4
pkg syscall (netbsd-arm64-cgo), const RTV_EXPIRE ideal-int
pkg syscall (netbsd-arm64-cgo), const RTV_HOPCOUNT = 2
pkg syscall (netbsd-arm64-cgo), const RTV_HOPCOUNT ideal-int
pkg syscall (netbsd-arm64-cgo), const RTV_MTU = 1

Certificate management has become more robust in 1.15, with kubeadm now seamlessly rotating all your certificates (on upgrades) before they expire. Check the [kubeadm documentation](https://github.com/kubernetes/website/blob/dev-1.15/content/en/docs/reference/setup-tools/kubeadm/kubeadm-alpha.md) for information on how to manage your certificates.

  // path that is exported by the NFS server.
  // More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs
  optional string path = 2;

  // readOnly here will force the NFS export to be mounted with read-only permissions.
  // Defaults to false.
  // More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs
  // +optional
  optional bool readOnly = 3;
}