show/hide actions based on the end user, and for users to quickly reason about their own permissions.

* [alpha] Building on the 1.7 work to allow encryption of resources such as secrets, a mechanism to store resource encryption keys in external Key Management Systems (KMS) was introduced. This complements the original file-based storage and allows integration with multiple KMS. A Google Cloud KMS plugin was added and will be usable once the Google side of the integration is complete....

- kube-controller-manager
  - The deprecated `--insecure-experimental-approve-all-kubelet-csrs-for-group` flag has been removed.
- kubelet
  - The deprecated `--google-json-key` flag has been removed. Remove the `--google-json-key` flag from kubelet invocations before upgrading. ([#69354](https://github.com/kubernetes/kubernetes/pull/69354), [@yujuhong](https://github.com/yujuhong))

- Fixes a 1.30.0 regression in openapi descriptions of imagePullSecrets and hostAliases fields to mark the fields used as keys in those lists as either defaulted or required. ([#124694](https://github.com/kubernetes/kubernetes/pull/124694),...

	//
	// Examples:
	// podAntiAffinityLabelSelector:
	//   - key: security
	//     operator: In
	//     values: S1,S2
	//     topologyKey: "kubernetes.io/hostname"
	//     This pod anti-affinity rule says that the pod requires not to be scheduled
	//     onto a node if that node is already running a pod with label having key
	//     “security” and value “S1”.
	//

  <mime-type type="application/x-x509-key">
  </mime-type>
  <mime-type type="application/x-x509-key;format=pem">
    <sub-class-of type="application/x-x509-key"/>
    <magic priority="50">
      <match value="-----BEGIN PRIVATE KEY-----" type="string" offset="0"/>
      <match value="-----BEGIN PUBLIC KEY-----" type="string" offset="0"/>
      <match value="-----BEGIN KEY-----" type="string" offset="0"/>

- Kubeadm: during execution of the "check expiration" command, treat the etcd CA as external if there is a missing etcd CA key file (etcd/ca.key) and perform the proper validation on certificates signed by the...

    * --docker_only
    * --docker-tls
    * --docker-tls-ca
    * --docker-tls-cert
    * --docker-tls-key
    * --enable_load_reader
    * --event_storage_age_limit
    * --event_storage_event_limit
    * --global_housekeeping_interval
    * --google-json-key
    * --log_cadvisor_usage
    * --machine_id_file
    * --storage_driver_user
    * --storage_driver_password

- [`KT-65518`](https://youtrack.jetbrains.com/issue/KT-65518) Memory leak in buildMap and in Wasm/Js/Native (Linked)HashMap
- [`KT-65525`](https://youtrack.jetbrains.com/issue/KT-65525) JS: Wrong return value of HashMap.keys.remove
- [`KT-63397`](https://youtrack.jetbrains.com/issue/KT-63397) kotlin-test should declare runtime dependency on "org.junit.platform:junit-platform-launcher"