pkg syscall (netbsd-arm64-cgo), const AF_DATAKIT ideal-int
pkg syscall (netbsd-arm64-cgo), const AF_DECnet = 12
pkg syscall (netbsd-arm64-cgo), const AF_DECnet ideal-int
pkg syscall (netbsd-arm64-cgo), const AF_DLI = 13
pkg syscall (netbsd-arm64-cgo), const AF_DLI ideal-int
pkg syscall (netbsd-arm64-cgo), const AF_E164 = 26
pkg syscall (netbsd-arm64-cgo), const AF_E164 ideal-int
pkg syscall (netbsd-arm64-cgo), const AF_ECMA = 8

pkg syscall (darwin-amd64), func SetBpfDatalink //deprecated
pkg syscall (darwin-amd64), func SetBpfHeadercmpl //deprecated
pkg syscall (darwin-amd64), func SetBpfImmediate //deprecated
pkg syscall (darwin-amd64), func SetBpfInterface //deprecated
pkg syscall (darwin-amd64), func SetBpfPromisc //deprecated
pkg syscall (darwin-amd64), func SetBpfTimeout //deprecated
pkg syscall (darwin-amd64), func StringSlicePtr //deprecated

  and “net.ipv4.tcp_keepalive_probes“ sysctl by default; Pod Security Admission
  allows this sysctl in `v1.29+` versions of the baseline and restricted policies. ([#121240](https://github.com/kubernetes/kubernetes/pull/121240), [@HirazawaUi](https://github.com/HirazawaUi))
- `kubelet` now allows pods to use the `net.ipv4.tcp_keepalive_time` sysctl by default

  // +optional
  optional int64 fsGroup = 5;

  // Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
  // sysctls (by the container runtime) might fail to launch.
  // Note that this field cannot be set when spec.os.name is windows.
  // +optional
  repeated Sysctl sysctls = 7;

* The Sysctls experimental feature has been promoted to beta (enabled by default via the `Sysctls` feature flag). PodSecurityPolicy and Pod objects now have fields for specifying and controlling sysctls. Alpha sysctl annotations will be ignored by 1.11+ kubelets. All alpha sysctl annotations in existing deployments must be converted to API fields to be effective. ([#6371](https://github.com...

- Pod SecurityContext sysctls name parameter for update requests where the existing object's sysctl contains slashes and kubelet sysctl whitelist support contains slashes. ([#102393](https://github.com/kubernetes/kubernetes/pull/102393), [@mengjiao-liu](https://github.com/mengjiao-liu)) [SIG Apps, Auth, Node, Storage and Testing]...

* The `spec.SecurityContext.Sysctls` field is now dropped during creation of `Pod` objects unless the `Sysctls` feature gate is enabled. ([#72752](https://github.com/kubernetes/kubernetes/pull/72752), [@rajathagasthya](https://github.com/rajathagasthya))
    * The `spec.AllowedUnsafeSysctls` and `spec.ForbiddenSysctls` fields are now dropped during creation of `PodSecurityPolicy` objects unless the `Sysctls` feature gate is enabled.

- Sysctls graduates to General Availability and thus unconditionally enabled. ([#99158](https://github.com/kubernetes/kubernetes/pull/99158), [@wgahnagl](https://github.com/wgahnagl))

  
  When the feature gate is enabled, kubelet ignores errors that happens during setting the following sysctl values: `vm.overcommit_memory`, `vm.panic_on_oom`, `kernel.panic`, `kernel.panic_on_oops`, `kernel.keys.root_maxkeys`, `kernel.keys.root_maxbytes`. (These sysctl values for the host, not for the containers)
  
  kubelet also ignores an error during opening `/dev/kmsg`.

- Kubelet allows pods to use the `net.ipv4.ip_local_reserved_ports` sysctl by default and the minimal kernel version is 3.16; Pod Security admission allows this sysctl in v1.27+ versions of the baseline and restricted policies. ([#115374](https://github.com/kubernetes/kubernetes/pull/115374), [@pacoxu](https://github.com/pacoxu)) [SIG Auth, Network and Node]