- Add auth API to get self subject attributes (new selfsubjectreviews API is added). 
  The corresponding command for kubctl is provided - `kubectl auth whoami`. ([#111333](https://github.com/kubernetes/kubernetes/pull/111333), [@nabokihms](https://github.com/nabokihms)) [SIG API Machinery, Auth, CLI and Testing]

}

func ValidateEndpointsSpecificAnnotations(annotations map[string]string, fldPath *field.Path) field.ErrorList {
	allErrs := field.ErrorList{}
	return allErrs
}

// ValidateNameFunc validates that the provided name is valid for a given resource type.
// Not all resources have the same validation rules for names. Prefix is true
// if the name will have a value appended to it.  If the name is not valid,

- The `CertificateSigningRequest.certificates.k8s.io` API supports an optional expirationSeconds field to allow the client to request a particular duration for the issued certificate.  The default signer implementations provided by the Kubernetes controller manager will honor this field as long as it does not exceed the --cluster-signing-duration flag. ([#99494](https://github.com/kubernetes/kubernetes/pull/99494), [@enj](https://github.com/enj))

- If a watch with the `progressNotify` option set is to be created, and the registry hasn't provided a `newFunc`, return an error. ([#120212](https://github.com/kubernetes/kubernetes/pull/120212), [@p0lyn0mial](https://github.com/p0lyn0mial)) [SIG API Machinery]

- CEL regex patterns in x-kubernetes-valiation rules are compiled when CRDs are created/updated if the pattern is provided as a string constant in the expression. Any regex compile errors are reported as a CRD create/update validation error. ([#108617](https://github.com/kubernetes/kubernetes/pull/108617), [@jpbetz](https://github.com/jpbetz))

	// Configure the mesh networks to be used by the Split Horizon EDS.
	//
	// The following example defines two networks with different endpoints association methods.
	// For `network1` all endpoints that their IP belongs to the provided CIDR range will be
	// mapped to network1. The gateway for this network example is specified by its public IP
	// address and port.
	// The second network, `network2`, in this example is defined differently with all endpoints

- [`KT-65571`](https://youtrack.jetbrains.com/issue/KT-65571) Support VirtualFile inputs to Analysis API modules
- [`KT-66485`](https://youtrack.jetbrains.com/issue/KT-66485) Substituted types are not provided for callable references
- [`KT-66498`](https://youtrack.jetbrains.com/issue/KT-66498) Analysis API: 'KtFe10SymbolDeclarationOverridesProvider' considers a class to be a subclass of itself

                  (GTSM) which protects against spoofed packets by ignoring received
                  packets with a smaller than expected TTL value. The provided value
                  is the number of hops (edges) between the peers.
                type: integer
            type: object
        type: object
    served: true
    storage: true
status:

				},
			},
			errors: []validationMatch{
				invalid("spec", "conversion", "webhookClientConfig", "service", "port"),
			},
		},
		{
			name: "webhookconfig: both service and URL provided",
			resource: &apiextensions.CustomResourceDefinition{
				ObjectMeta: metav1.ObjectMeta{Name: "plural.group.com"},
				Spec: apiextensions.CustomResourceDefinitionSpec{
					Group: "group.com",

- The "value" part in the `wait --for=jsonpath='{expression}'[=value]` is now
  optional. If the value is not provided i.e., the command looks like `wait --for=jsonpath='{expression}'`
  then the wait condition is interpreted as matched when the expression returns