* Allow kube- and cloud-controller-manager to listen on ports up to 65535. ([#65860](https://github.com/kubernetes/kubernetes/pull/65860), [@sttts](https://github.com/sttts))
* Allow kube-scheduler to listen on ports up to 65535. ([#65833](https://github.com/kubernetes/kubernetes/pull/65833), [@sttts](https://github.com/sttts))

- CCM server will not listen insecurely if secure port is specified ([#68982](https://github.com/kubernetes/kubernetes/pull/68982), [@aruneli](https://github.com/aruneli))

- Add --permit-address-sharing flag to `kube-apiserver` to listen with `SO_REUSEADDR`. While allowing to listen on wildcard IPs like 0.0.0.0 and specific IPs in parallel, it avoids waiting for the kernel to release socket in `TIME_WAIT` state, and hence, considerably reducing `kube-apiserver` restart times under certain conditions. ([#93861](https://github.com/kubernetes/kubernetes/pull/93861), [@sttts](https://github.com/sttts))...

pkg syscall (netbsd-arm64-cgo), const SYS_EXTATTR_LIST_FD = 370
pkg syscall (netbsd-arm64-cgo), const SYS_EXTATTR_LIST_FD ideal-int
pkg syscall (netbsd-arm64-cgo), const SYS_EXTATTR_LIST_FILE = 371
pkg syscall (netbsd-arm64-cgo), const SYS_EXTATTR_LIST_FILE ideal-int
pkg syscall (netbsd-arm64-cgo), const SYS_EXTATTR_LIST_LINK = 372
pkg syscall (netbsd-arm64-cgo), const SYS_EXTATTR_LIST_LINK ideal-int

pkg syscall (darwin-arm64), const SYS_LINK = 9
pkg syscall (darwin-arm64), const SYS_LINK ideal-int
pkg syscall (darwin-arm64), const SYS_LIO_LISTIO = 320
pkg syscall (darwin-arm64), const SYS_LIO_LISTIO ideal-int
pkg syscall (darwin-arm64), const SYS_LISTEN = 106
pkg syscall (darwin-arm64), const SYS_LISTEN ideal-int
pkg syscall (darwin-arm64), const SYS_LISTXATTR = 240
pkg syscall (darwin-arm64), const SYS_LISTXATTR ideal-int

- The resource version option, when passed to a list call, is now consistently interpreted as the minimum allowed resource version.  Previously when listing resources that had the watch cache disabled clients could retrieve a snapshot at that exact resource version.  If the client requests a resource version newer than the current state, a TimeoutError...

cluster-internal resources installed by kubeadm will be overwritten when upgrading from v1.6 to v1.7. ([#47081](https://github.com/kubernetes/kubernetes/pull/47081), [@luxas](https://github.com/luxas))

* kubeadm deb/rpm packages: cAdvisor doesn't listen on `0.0.0.0:4194` without authentication/authorization because of the possible information leakage. The cAdvisor API can still be accessed via `https://{node-ip}:10250/stats/`, though. ([kubernetes/release#356](https://github.com/kubernetes/release/pull/356),...

## Changelog since v1.11.0

### Action Required

  - *apiserver_cache_list_returned_objects_total*: Counter of objects returned for a LIST request from watch cache, broken down by resource_prefix
  - *apiserver_storage_list_total*: Counter of LIST requests served from etcd, broken down by resource

* The Kubernetes API server now supports the ability to break large LIST calls into multiple smaller chunks.  A client can specify a limit to the number of results to return, and if more results exist a token will be returned that allows the client to continue the previous list call repeatedly until all results are retrieved.  The resulting list is identical to a list call that does not perform chunking thanks to capabilities provided by etcd3.  This allows the server...