- Added `UserNamespacesPodSecurityStandards` feature gate to enable user namespace support for Pod Security Standards.
  Enabling this feature will modify all Pod Security Standard rules to allow setting: `spec[.*].securityContext.[runAsNonRoot,runAsUser]`.
  This feature gate should only be enabled if all nodes in the cluster support the user namespace feature and have it enabled.

    <root-XML localName="map" namespaceURI="http://docs.oasis-open.org/namespace"/>
    <glob pattern="*.ditamap"/>
  </mime-type>
  <mime-type type="application/dita+xml;format=topic">
    <sub-class-of type="application/dita+xml"/>
    <_comment>DITA Topic</_comment>
    <root-XML localName="topic"/>
    <root-XML localName="topic" namespaceURI="http://docs.oasis-open.org/namespace"/>

- Fixed an issue to not drain all the pods in a namespace when an empty-selector i.e. "{}" is specified in a Pod Disruption Budget (PDB) ([#121132](https://github.com/kubernetes/kubernetes/pull/121132), [@sairameshv](https://github.com/sairameshv)) [SIG Apps]

// this is local because it's not fully fleshed out enough for general use.
func makePod(name string, ips ...string) api.Pod {
	p := api.Pod{
		ObjectMeta: metav1.ObjectMeta{
			Name:      name,
			Namespace: metav1.NamespaceDefault,
		},
		Spec: api.PodSpec{
			RestartPolicy: api.RestartPolicyAlways,
			DNSPolicy:     api.DNSDefault,