- PodLifecycleSleepAction is graduated to GA ([#128046](https://github.com/kubernetes/kubernetes/pull/128046), [@AxeZhan](https://github.com/AxeZhan)) [SIG Architecture, Node and Testing]
- Pods were allowed to use the `net.ipv4.tcp_rmem` and `net.ipv4.tcp_wmem` sysctl by default
  when the kernel version was 4.15 or higher. With the kernel 4.15 the sysctl became namespaced.

 *  Fix: Change `MockWebServer` to use the same logic as OkHttp when determining
    whether an HTTP request permits a body.
 *  Fix: `HttpUrl` now uses the canonical form for IPv6 addresses.
 *  Fix: Use `HttpUrl` internally.
 *  Fix: Recover from Android 4.2.2 EBADF crashes.
 *  Fix: Don't crash with an `IllegalStateException` if an HTTP/2 or SPDY

### Bug or Regression

- Fix a bug that caused to panic the apiserver when trying to allocate a Service with a dynamic ClusterIP and it has been configured with Service CIDRs with a /28 mask for IPv4 and a /124 mask for IPv6 ([#115334](https://github.com/kubernetes/kubernetes/pull/115334), [@aojea](https://github.com/aojea)) [SIG Network and Testing]

    // IPv6 colons don't interfere with port numbers or passwords.
    assertThat(parse("http://[::1]:8080/").port).isEqualTo(8080)
    assertThat(parse("http://user:password@[::1]/").password).isEqualTo("password")
    assertThat(parse("http://user:password@[::1]:8080/").host).isEqualTo("::1")

    // Permit the contents of IPv6 addresses to be percent-encoded...

ce.gov.br
ce.it
ce.leg.br
cechire.com
center
centralus.azurestaticapps.net
ceo
cern
certification.aero
cesena-forli.it
cesena-forlì.it
cesenaforli.it
cesenaforlì.it
cf
cf-ipfs.com
cfa
cfd
cfolks.pl
cg
ch
ch.eu.org
ch.it
ch.trendhosting.cloud
chambagri.fr
championship.aero
chanel
channel
channelsdvr.net
charity
charter.aero

- Fixed a regression in kube-proxy where it might refuse to start if given
  single-stack IPv6 configuration options on a node that has both IPv4 and
  IPv6 IPs. ([#121008](https://github.com/kubernetes/kubernetes/pull/121008), [@danwinship](https://github.com/danwinship)) [SIG Network]

    assertThat(get.headers["Host"]).isNull()
    assertThat(get.headers[":authority"]).isEqualTo("any-host-name:$port")
    assertThat(get.url).isEqualTo(url)
  }

  /** Use a proxy to fake IPv6 connectivity, even if localhost doesn't have IPv6.  */
  private fun configureClientAndServerProxies(http2: Boolean) {
    server.useHttps(handshakeCertificates.sslSocketFactory())
    server.protocols =
      when {

- Added support to the kube-proxy nodePortAddresses / --nodeport-addresses option to
  accept the value "primary", meaning to only listen for NodePort connections
  on the node's primary IPv4 and/or IPv6 address (according to the Node object).
  This is strongly recommended, if you were not previously using
  --nodeport-addresses, to avoid surprising behavior.

ce.gov.br
ce.it
ce.leg.br
cechire.com
center
centralus.azurestaticapps.net
ceo
cern
certification.aero
cesena-forli.it
cesena-forlì.it
cesenaforli.it
cesenaforlì.it
cf
cf-ipfs.com
cfa
cfd
cfolks.pl
cg
ch
ch.eu.org
ch.it
ch.trendhosting.cloud
chambagri.fr
championship.aero
chanel
channel
channelsdvr.net
charity
charter.aero

- Fix endpoints status out-of-sync when the pod state changes rapidly ([#125675](https://github.com/kubernetes/kubernetes/pull/125675), [@tnqn](https://github.com/tnqn)) [SIG Apps, Network and Testing]
- For statically provisioned PVs, if its volume source is CSI type or it has migrated annotation, when it's deleted, the PersisentVolume controller won't changes its phase to the Failed state.