- Kube-apiserver: redirect responses are no longer returned from backends by default. Set `--aggregator-reject-forwarding-redirect=false` to continue forwarding redirect responses. ([#112331](https://github.com/kubernetes/kubernetes/pull/112331), [@enj](https://github.com/enj)) [SIG API Machinery]

* kubelet: Fix bug where `runAsUser: MustRunAsNonRoot` strategy didn't reject a pod with a non-numeric `USER`. ([#56708](https://github.com/kubernetes/kubernetes/pull/56708), [@php-coder](https://github.com/php-coder))
* Add iptables rules to allow Pod traffic even when default iptables policy is to reject. ([#52569](https://github.com/kubernetes/kubernetes/pull/52569), [@tmjd](https://github.com/tmjd))

- Scheduler volumebinding: leveraged `PreFilterResult` to reduce down to only
  eligible node(s) for pod with bound claim(s) to local `PersistentVolume(s)` ([#109877](https://github.com/kubernetes/kubernetes/pull/109877), [@yibozhuang](https://github.com/yibozhuang))

specified by `--legacy-service-account-token-clean-up-period` (defaulting to one year), **and** are referenced from the `.secrets` list of a ServiceAccount object, **and**  are not referenced from pods. This label causes the authentication layer to reject use of the credentials. After being labeled as invalid, if the time specified by `--legacy-service-account-token-clean-up-period` (defaulting to one year) passes without the credential being used, the secret is automatically deleted. Secrets labeled...

pkg syscall (netbsd-arm64-cgo), const RTF_PROTO2 = 16384
pkg syscall (netbsd-arm64-cgo), const RTF_PROTO2 ideal-int
pkg syscall (netbsd-arm64-cgo), const RTF_REJECT = 8
pkg syscall (netbsd-arm64-cgo), const RTF_REJECT ideal-int
pkg syscall (netbsd-arm64-cgo), const RTF_SRC = 65536
pkg syscall (netbsd-arm64-cgo), const RTF_SRC ideal-int
pkg syscall (netbsd-arm64-cgo), const RTF_STATIC = 2048

pkg syscall (darwin-arm64), const RTF_PROTO3 ideal-int
pkg syscall (darwin-arm64), const RTF_PROXY = 134217728
pkg syscall (darwin-arm64), const RTF_PROXY ideal-int
pkg syscall (darwin-arm64), const RTF_REJECT = 8
pkg syscall (darwin-arm64), const RTF_REJECT ideal-int
pkg syscall (darwin-arm64), const RTF_ROUTER = 268435456
pkg syscall (darwin-arm64), const RTF_ROUTER ideal-int
pkg syscall (darwin-arm64), const RTF_STATIC = 2048

- Kube-apiserver: redirect responses are no longer returned from backends by default. Set `--aggregator-reject-forwarding-redirect=false` to continue forwarding redirect responses. ([#112330](https://github.com/kubernetes/kubernetes/pull/112330), [@enj](https://github.com/enj)) [SIG API Machinery]

## Dependencies

### Added

</pre>

<p>
the variable <code>s</code> of type <code>Slice</code> must be assignable to
the function parameter type <code>S</code> for the program to be valid.
To reduce complexity, type inference ignores the directionality of assignments,
so the type relationship between <code>Slice</code> and <code>S</code> can be
expressed via the (symmetric) type equation <code>Slice ≡<sub>A</sub> S</code>

- Reduce delay when processing jobs after a transient API error ([#118759](https://github.com/kubernetes/kubernetes/pull/118759), [@mimowo](https://github.com/mimowo)) [SIG Apps]