- Static pods were taking extra time to be restarted after being updated.  Static pods that are waiting to restart were not correctly counted in `kubelet_working_pods`. ([#116995](https://github.com/kubernetes/kubernetes/pull/116995), [@smarterclayton](https://github.com/smarterclayton)) [SIG Node]

* Improve efficiency of preemption logic in clusters with many pending pods. ([#72895](https://github.com/kubernetes/kubernetes/pull/72895), [@bsalamat](https://github.com/bsalamat))
* Fix scheduling starvation of pods in cluster with large number of unschedulable pods. ([#72619](https://github.com/kubernetes/kubernetes/pull/72619), [@everpeace](https://github.com/everpeace))

  terminationGracePeriodSeconds: 30

  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
  revision: ""

  # The customized CA address to retrieve certificates for the pods in the cluster.
  # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
  caAddress: ""

  # Used to locate istiod.
  istioNamespace: istio-system

      - "rbac.istio.io"
      - "telemetry.istio.io"
      - "extensions.istio.io"
    resources: ["*"]
    verbs: ["get", "list", "watch"]
  - apiGroups: [""]
    resources: ["endpoints", "pods", "services", "nodes", "replicationcontrollers", "namespaces", "secrets"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["networking.istio.io"]
    verbs: [ "get", "watch", "list" ]
    resources: [ "workloadentries" ]

      namespace: {{ .namespace }}
      path: "/inject"
    {{- end }}
  sideEffects: None
  rules:
    - operations: [ "CREATE" ]
      apiGroups: [""]
      apiVersions: ["v1"]
      resources: ["pods"]
  failurePolicy: Fail
  admissionReviewVersions: ["v1beta1", "v1"]
{{- end }}

apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  name: istio-revision-tag-default

- Kube-scheduler now retries scheduling Pods rejected by the PodTopologySpread plugin when related Pods are created, deleted, updated, or when a node matches the specified topologyKey. ([#122195](https://github.com/kubernetes/kubernetes/pull/122195), [@nayihz](https://github.com/nayihz))

  optional k8s.io.apimachinery.pkg.apis.meta.v1.GroupVersionKind kind = 2;

  // Resource is the fully-qualified resource being requested (for example, v1.pods)
  optional k8s.io.apimachinery.pkg.apis.meta.v1.GroupVersionResource resource = 3;

  // SubResource is the subresource being requested, if any (for example, "status" or "scale")
  // +optional

  optional k8s.io.apimachinery.pkg.apis.meta.v1.GroupVersionKind kind = 2;

  // Resource is the fully-qualified resource being requested (for example, v1.pods)
  optional k8s.io.apimachinery.pkg.apis.meta.v1.GroupVersionResource resource = 3;

  // SubResource is the subresource being requested, if any (for example, "status" or "scale")
  // +optional

  #
  # New fields should not use Values - it is a 'primary' config object, users should be able
  # to fine tune it or use it with kube-inject.
  config: |-
    # defaultTemplates defines the default template to use for pods that do not explicitly specify a template
    {{- if .Values.sidecarInjectorWebhook.defaultTemplates }}
    defaultTemplates:
{{- range .Values.sidecarInjectorWebhook.defaultTemplates}}
    - {{ . }}
{{- end }}

					return fmt.Errorf("not able to locate pod with selector %s: %v", istiodLabelSelector, err)
				}

				if len(pl.Items) < 1 {
					return errors.New("no pods found")
				}

				if len(pl.Items) > 1 {
					log.Warnf("more than 1 pods fits selector: %s; will use pod: %s", istiodLabelSelector, pl.Items[0].Name)
				}

				// only use the first pod in the list
				podName = pl.Items[0].Name