- Kube API server accepts `Impersonate-Uid` header to impersonate a user with a specific UID, in the same way that you can currently use `Impersonate-User`, `Impersonate-Group` and `Impersonate-Extra`. ([#99961](https://github.com/kubernetes/kubernetes/pull/99961), [@margocrawf](https://github.com/margocrawf))

pkg syscall (darwin-arm64), type Credential struct, Groups []uint32
pkg syscall (darwin-arm64), type Credential struct, NoSetGroups bool
pkg syscall (darwin-arm64), type Credential struct, Uid uint32
pkg syscall (darwin-arm64), type Dirent struct
pkg syscall (darwin-arm64), type Dirent struct, Ino uint64
pkg syscall (darwin-arm64), type Dirent struct, Name [1024]int8

- Kubelet.exe on Windows now checks that the process running as administrator and the executing user account is listed in the built-in administrators group.  This is the equivalent to checking the process is running as uid 0. ([#96616](https://github.com/kubernetes/kubernetes/pull/96616), [@perithompson](https://github.com/perithompson)) [SIG Node and Windows]

- Fixed an issue where the API server did not send impersonated UID to authentication webhooks. ([#116681](https://github.com/kubernetes/kubernetes/pull/116681), [@stlaz](https://github.com/stlaz)) [SIG API Machinery and Auth]

- Fixes a regression in the pod binding subresource to honor the `metadata.uid` precondition.

- Fixed a bug where unwanted fields were being returned from a `create --dry-run`: uid and, if generateName was used, name. ([#107088](https://github.com/kubernetes/kubernetes/pull/107088), [@joejulian](https://github.com/joejulian))

## Changelog since v1.9.7

### Other notable changes

* Fix a bug in scheduler cache by using Pod UID as the cache key instead of namespace/name ([#61069](https://github.com/kubernetes/kubernetes/pull/61069), [@anfernee](https://github.com/anfernee))

- Fixes a regression in the pod binding subresource to honor the `metadata.uid` precondition.