CVE-2023-39325 for the API server when the client is unauthenticated. The mitigation may be enabled by setting the `UnauthenticatedHTTP2DOSMitigation` feature gate to `true` (it is disabled by default). An API server fronted by an L7 load balancer that already mitigates these http/2 attacks may choose not to enable the kube-apiserver mitigation to avoid disrupting load balancer → kube-apiserver connections if http/2 requests from multiple clients share the same backend connection. An API server on a private...

If the capacity is zero or absent, the channel is unbuffered and communication
succeeds only when both a sender and receiver are ready. Otherwise, the channel
is buffered and communication succeeds without blocking if the buffer
is not full (sends) or not empty (receives).
A <code>nil</code> channel is never ready for communication.
</p>

<p>
A channel may be closed with the built-in function

    * setting `ENABLE_METADATA_CONCEALMENT=true` in kube-up will now set a `cloud.google.com/metadata-proxy-ready=true` label on new nodes. In v1.16, the metadata proxy add-on will switch to using that label as a node selector.
    * setting `KUBE_PROXY_DAEMONSET=true` in kube-up will now set a `node.kubernetes.io/kube-proxy-ds-ready=true` label on new nodes. In v1.16, the kube-proxy daemonset add-on will switch to using that label as a node selector.

*   Taint key `unreachable` is now in GA.
*   Taint key `notReady` is changed to `not-ready`, and is also now in GA.
*   These changes are automatically updated for taints. Tolerations for these taints must be updated manually. Specifically, you must:
    *   Change `node.alpha.kubernetes.io/notReady` to `node.kubernetes.io/not-ready`
    *   Change `node.alpha.kubernetes.io/unreachable` to  `node.kubernetes.io/unreachable`

objects and send requests proxying through them.

Kubernetes supports node proxying, which allows clients of kube-apiserver to access endpoints of a Kubelet to establish connections to Pods, retrieve container logs, and more. While Kubernetes already validates the proxying address for Nodes, a bug in kube-apiserver made it possible to bypass this validation. Bypassing this validation could allow authenticated requests destined for Nodes to be redirected to the API Server through its private network....

* Fixes an issue where Portworx volumes cannot be mounted if 9001 port is already in use on the host and users remap 9001 to another port. ([#70392](https://github.com/kubernetes/kubernetes/pull/70392), [@harsh-px](https://github.com/harsh-px))

- Node labels `beta.kubernetes.io/metadata-proxy-ready`, `beta.kubernetes.io/metadata-proxy-ready` and `beta.kubernetes.io/kube-proxy-ds-ready` are no longer added on new nodes.
  - ip-mask-agent addon starts to use the label `node.kubernetes.io/masq-agent-ds-ready` instead of `beta.kubernetes.io/masq-agent-ds-ready` as its node selector.

pkg syscall (darwin-arm64), const EADDRNOTAVAIL = 49
pkg syscall (darwin-arm64), const EAFNOSUPPORT = 47
pkg syscall (darwin-arm64), const EAGAIN = 35
pkg syscall (darwin-arm64), const EALREADY = 37
pkg syscall (darwin-arm64), const EAUTH = 80
pkg syscall (darwin-arm64), const EAUTH Errno
pkg syscall (darwin-arm64), const EBADARCH = 86
pkg syscall (darwin-arm64), const EBADARCH Errno

pkg syscall (netbsd-arm64-cgo), const EADDRNOTAVAIL = 49
pkg syscall (netbsd-arm64-cgo), const EAFNOSUPPORT = 47
pkg syscall (netbsd-arm64-cgo), const EAGAIN = 35
pkg syscall (netbsd-arm64-cgo), const EALREADY = 37
pkg syscall (netbsd-arm64-cgo), const EAUTH = 80
pkg syscall (netbsd-arm64-cgo), const EAUTH Errno
pkg syscall (netbsd-arm64-cgo), const EBADF = 9
pkg syscall (netbsd-arm64-cgo), const EBADMSG = 88