- Kubeadm now forwards the IPv6DualStack feature gate using the kubelet component config, instead of the kubelet command line ([#90840](https://github.com/kubernetes/kubernetes/pull/90840), [@rosti](https://github.com/rosti)) [SIG Cluster Lifecycle]

            backwards. See PR
            [47925](https://github.com/tensorflow/tensorflow/pull/47925).
        *   `tf.image.crop_and_resize` gradient w.r.t. either `image` or
            `boxes`. See PR
            [48905](https://github.com/tensorflow/tensorflow/pull/48905).
        *   `tf.sparse.sparse_dense_matmul` forwards. See PR

## Dependencies

### Added

### Other (Cleanup or Flake)

* Update to go 1.12.10 ([#83139](https://github.com/kubernetes/kubernetes/pull/83139), [@cblecker](https://github.com/cblecker))
* Use ipv4 in wincat port forward. ([#83036](https://github.com/kubernetes/kubernetes/pull/83036), [@liyanhui1228](https://github.com/liyanhui1228))

like having a game of play with a cart-horse, and expecting every
moment to be trampled under its feet, ran round the thistle
again; then the puppy began a series of short charges at the
stick, running a very little way forwards each time and a long
way back, and barking hoarsely all the while, till at last it sat
down a good way off, panting, with its tongue hanging out of its
mouth, and its great eyes half shut.

images. The old registry (`k8s.gcr.io`) will continue to be supported for the foreseeable future, but the new name should perform better because it frontends equivalent mirrors in other clouds.  Please point your clusters to the new registry going forward. \n\nAdmission/Policy integrations that have an allowlist of registries need to include `registry.k8s.io` alongside `k8s.gcr.io`.\nAir-gapped environments and image garbage-collection configurations will need to update to pre-pull and preserve required...

- Kubectl port-forward service will now properly exit when the attached pod dies (#103526, @brianpursley) [SIG API Machinery]
- Kubelet: fixes a file descriptor leak in log rotation (#106382, @rphillips) [SIG Node]

The following diagram illustrates the flow of unauthenticated traffic with a `PERMISSIVE` policy:

```mermaid
graph TD;
src[src pod]-->|plaintext port|ztunnel{"ztunnel (L4 policy applied here)"}
ztunnel{ztunnel}-->|TLS|wp{waypoint}
wp-->|mTLS|ztunnel
ztunnel-->|plaintext|dst[dst pod]
```

        location / {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

            proxy_connect_timeout 300;
            # Default is HTTP/1, keepalive is only enabled in HTTP/1.1
            proxy_http_version 1.1;