- [Action Required](#action-required)
    - [Other notable changes](#other-notable-changes-6)
- [v1.10.6](#v1106)
  - [Downloads for v1.10.6](#downloads-for-v1106)
    - [Client Binaries](#client-binaries-7)
    - [Server Binaries](#server-binaries-7)
    - [Node Binaries](#node-binaries-7)
  - [Changelog since v1.10.5](#changelog-since-v1105)
    - [Action Required](#action-required-1)

*   If multiple PodSecurityPolicy objects allow a submitted pod, priority is given to policies that do not require default values for any fields in the pod spec. If default values are required, the first policy ordered by name that allows the pod is used. ([#52849](https://github.com/kubernetes/kubernetes/pull/52849),[ @liggitt](https://github.com/liggitt))

    - [Action Required](#action-required-6)
    - [Other notable changes](#other-notable-changes-18)
- [v1.8.0-alpha.1](#v180-alpha1)
  - [Downloads for v1.8.0-alpha.1](#downloads-for-v180-alpha1)
    - [Client Binaries](#client-binaries-20)
    - [Server Binaries](#server-binaries-20)
    - [Node Binaries](#node-binaries-20)
  - [Changelog since v1.7.0-alpha.4](#changelog-since-v170-alpha4)
    - [Action Required](#action-required-7)

- Kubeadm: allow the "certs check-expiration" command to not require the existence of the cluster CA key (ca.key file) when checking the expiration of managed certificates in kubeconfig files. ([#106929](https://github.com/kubernetes/kubernetes/pull/106929), [@neolit123](https://github.com/neolit123)) [SIG Cluster...

### Feature

- #### Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:
  
  <!--
  This section can be blank if this pull request does not require a release note.
  
  When adding links which point to resources within git repositories, like
  KEPs or supporting documentation, please reference a specific commit and avoid

    - [Client Binaries](#client-binaries-26)
    - [Server Binaries](#server-binaries-26)
    - [Node Binaries](#node-binaries-26)
  - [Changelog since v1.17.0](#changelog-since-v1170-1)
    - [Action Required](#action-required)
    - [Other notable changes](#other-notable-changes-1)

<!-- END MUNGE: GENERATED_TOC -->

# v1.18.20


## Downloads for v1.18.20

### Source Code

filename | sha512 hash

    - [Client Binaries](#client-binaries-16)
    - [Server Binaries](#server-binaries-16)
    - [Node Binaries](#node-binaries-16)
  - [Changelog since v1.13.0-alpha.3](#changelog-since-v1130-alpha3)
    - [Action Required](#action-required)
    - [Other notable changes](#other-notable-changes-14)
- [v1.13.0-alpha.3](#v1130-alpha3)
  - [Downloads for v1.13.0-alpha.3](#downloads-for-v1130-alpha3)
    - [Client Binaries](#client-binaries-17)

### Bug or Regression

- Fix error when trying to expand a volume that does not require node expansion ([#123055](https://github.com/kubernetes/kubernetes/pull/123055), [@gnufied](https://github.com/gnufied)) [SIG Node and Storage]

## Changes by Kind

### Deprecation

- Action-required: kubeadm: graduate the "kubeadm alpha certs" command to a parent command "kubeadm certs". The command "kubeadm alpha certs" is deprecated and will be removed in a future release. Please migrate. ([#94938](https://github.com/kubernetes/kubernetes/pull/94938), [@yagonobre](https://github.com/yagonobre)) [SIG Cluster Lifecycle]

containing service account tokens are no longer auto-generated for every ServiceAccount. Use the [TokenRequest](https://kubernetes.io/docs/reference/kubernetes-api/authentication-resources/token-request-v1/) API to acquire service account tokens, or if a non-expiring token is required, create a Secret API object for the token controller to populate with a service account token by following this [guide](https://kubernetes.io/docs/concepts/configuration/secret/#service-account-token-secrets). ([#1...