### API Change

- Kubeadm: the deprecated kube-dns is no longer supported as an option. If "ClusterConfiguration.dns.type" is set to "kube-dns" kubeadm will now throw an error. ([#99646](https://github.com/kubernetes/kubernetes/pull/99646), [@rajansandeep](https://github.com/rajansandeep)) [SIG Cluster Lifecycle]

- `kube-proxy`: Added an option/flag for configuring the `nf_conntrack_tcp_be_liberal` sysctl (in the kernel's netfilter conntrack subsystem).  When enabled, `kube-proxy` will not install the `DROP` rule for invalid conntrack states, which currently breaks users of asymmetric routing. ([#120354](https://github.com/kubernetes/kubernetes/pull/120354), [@aroradaman](https://github.com/aroradaman))...

                          type: string
                        options:
                          additionalProperties:
                            description: AnnotationValue is the value of an annotation
                              in Gateway API. This is used for validation of maps
                              such as TLS options. This roughly matches Kubernetes

	// Controls whether the WebhookConfiguration resource(s) should be created. The current behavior
	// of Istiod is to manage its own webhook configurations.
	// When this option is set to true, Istio Operator, instead of webhooks, manages the
	// webhook configurations. When this option is set as false, webhooks manage their
	// own webhook configurations.

	Searches []string
	// A list of DNS resolver options.
	// This will be merged with the base options generated from DNSPolicy.
	// Duplicated entries will be removed. Resolution options given in Options
	// will override those that appear in the base DNSPolicy.
	// +optional
	Options []PodDNSConfigOption
}

// PodDNSConfigOption defines DNS resolver options of a pod.
type PodDNSConfigOption struct {
	// Required.

			allErrs = append(allErrs, ValidateDNS1123Subdomain(search, fldPath.Child("searches").Index(i))...)
		}
		// Validate options.
		for i, option := range dnsConfig.Options {
			if len(option.Name) == 0 {
				allErrs = append(allErrs, field.Required(fldPath.Child("options").Index(i), "must not be empty"))
			}
		}
	}
	return allErrs
}

  // A list of DNS resolver options.
  // This will be merged with the base options generated from DNSPolicy.
  // Duplicated entries will be removed. Resolution options given in Options
  // will override those that appear in the base DNSPolicy.
  // +optional
  repeated PodDNSConfigOption options = 3;
}

// PodDNSConfigOption defines DNS resolver options of a pod.
message PodDNSConfigOption {

- Added new annotation `batch.kubernetes.io/cronjob-scheduled-timestamp` to Job objects scheduled from CronJobs. ([#118137](https://github.com/kubernetes/kubernetes/pull/118137), [@helayoty](https://github.com/helayoty))

- Added a `--topology-manager-policy-options` flag to the kubelet to support fine tuning the topology manager policies. The first policy option, `prefer-closest-numa-nodes`, allows these policies to favor sets of NUMA nodes with shorter distance between nodes when making admission decisions. ([#112914](https://github.com/kubernetes/kubernetes/pull/112914),...