* Change the default kubeadm bootstrap token TTL from infinite to 24 hours. This is a breaking change. If you require the old behavior, use `kubeadm init --token-ttl 0` / `kubeadm token create --ttl 0`. ([#48783](https://github.com/kubernetes/kubernetes/pull/48783), [@mattmoyer](https://github.com/mattmoyer))

### Other notable changes

    * A new `k8s_external` plugin that allows external zones to point to Kubernetes in-cluster services.
    * CoreDNS now checks if a zone transfer is allowed. Also allow a TTL of 0 to avoid caching in the cache plugin.
    * TTL is also applied to negative responses (NXDOMAIN, etc).

- util/initsystem: Added support for the OpenRC init system ([#73101](https://github.com/kubernetes/kubernetes/pull/73101), [@oz123](https://github.com/oz123))
- Default TTL for DNS records in kubernetes zone has been changed from 5s to 30s to keep consistent with old dnsmasq based kube-dns. The TTL can be customized with command `kubectl edit -n kube-system configmap/coredns`. ([#76238](https://github.com/kubernetes/kubernetes/pull/76238), [@Dieken](https://github.com/Dieken))

pkg syscall (netbsd-arm64-cgo), const IP_DEFAULT_MULTICAST_LOOP = 1
pkg syscall (netbsd-arm64-cgo), const IP_DEFAULT_MULTICAST_LOOP ideal-int
pkg syscall (netbsd-arm64-cgo), const IP_DEFAULT_MULTICAST_TTL = 1
pkg syscall (netbsd-arm64-cgo), const IP_DEFAULT_MULTICAST_TTL ideal-int
pkg syscall (netbsd-arm64-cgo), const IP_DF = 16384
pkg syscall (netbsd-arm64-cgo), const IP_DF ideal-int
pkg syscall (netbsd-arm64-cgo), const IP_DROP_MEMBERSHIP = 13

    * kubelet_docker_operations_timeout
    * network_plugin_operations_latency_microseconds
* Kubelet cert TTL via GaugeFunc: ([#85874](https://github.com/kubernetes/kubernetes/pull/85874), [@sambdavidson](https://github.com/sambdavidson))
  * Renamed Kubelet metric certificate_manager_server_expiration_seconds to certificate_manager_server_ttl_seconds and changed to report the second until expiration at read time rather than absolute time of expiry. 

pkg syscall (darwin-arm64), const IP_DEFAULT_MULTICAST_LOOP = 1
pkg syscall (darwin-arm64), const IP_DEFAULT_MULTICAST_LOOP ideal-int
pkg syscall (darwin-arm64), const IP_DEFAULT_MULTICAST_TTL = 1
pkg syscall (darwin-arm64), const IP_DEFAULT_MULTICAST_TTL ideal-int
pkg syscall (darwin-arm64), const IP_DF = 16384
pkg syscall (darwin-arm64), const IP_DF ideal-int
pkg syscall (darwin-arm64), const IP_DROP_MEMBERSHIP = 13

* kubeadm init: fix a bug that prevented the --token-ttl flag and tokenTTL configuration value from working as expected for infinite (0) values. ([#54640](https://github.com/kubernetes/kubernetes/pull/54640), [@mattmoyer](https://github.com/mattmoyer))

- KubeletPluginsWatcher feature graduated to beta. ([#68200](https://github.com/kubernetes/kubernetes/pull/68200), [@RenaudWasTaken](https://github.com/RenaudWasTaken)) Courtesy of SIG Node, SIG Storage, and SIG Testing
- A TTL mechanism has been added to clean up Jobs after they finish. ([#66840](https://github.com/kubernetes/kubernetes/pull/66840), [@janetkuo](https://github.com/janetkuo)) Courtesy of SIG API Machinery, SIG Apps, SIG Architecture, and SIG Testing

  or `Secrets` when the `configMapAndSecretChangeDetectionStrategy` is set to `Cache`.
  The update interval is only affected by `node.alpha.kubernetes.io/ttl` node annotation." ([#120255](https://github.com/kubernetes/kubernetes/pull/120255), [@likakuli](https://github.com/likakuli))

- Migrated the “TTL after finished” controller (within `kube-controller-manager`)to use [contextual logging](https://k8s.io/docs/concepts/cluster-administration/system-logs/#contextual-logging). ([#113916](https://github.com/kubernetes/kubernetes/pull/113916), [@songx...