* If ExperimentalCriticalPodAnnotation=True flag gate is set, kubelet will ensure that pods with `scheduler.alpha.kubernetes.io/critical-pod` annotation will be admitted even under resource pressure, will not be evicted, and are reasonably protected from system OOMs. ([#41052](https://github.com/kubernetes/kubernetes/pull/41052), [@vishh](https://github.com/vishh))

* If ExperimentalCriticalPodAnnotation=True flag gate is set, kubelet will ensure that pods with `scheduler.alpha.kubernetes.io/critical-pod` annotation will be admitted even under resource pressure, will not be evicted, and are reasonably protected from system OOMs. ([#41052](https://github.com/kubernetes/kubernetes/pull/41052), [@vishh](https://github.com/vishh))

- Fixed a bug where kube-apiserver could emit a subsequent watch event even if the previous event failed to decrypt and was not emitted. ([#131020](https://github.com/kubernetes/kubernetes/pull/131020), [@wojtek-t](https://github.com/wojtek-t)) [SIG API Machinery and Etcd]

1 Update 1, Section 4.1. // // It produces a 256-bit output, and accepts a 8-bit Label and a 96-bit Context. // It uses a counter of 16 bits placed before the fixed data. The fixed data is // the sequence Label || 0x00 || Context. The L field is omitted, since the // output key length is fixed. // // It's optimized for use in XAES-256-GCM (https://c2sp.org/XAES-256-GCM), // rather than for exposing it to applications as a stand-alone KDF. type CounterKDF struct { mac CMAC } // NewCounterKDF creates...

    * With this feature, users can config kube-addon-manager to whitelist those resources to fix this issue.

## Changelog since v1.30.11

## Changes by Kind

### Bug or Regression

- Fix a bug where kube-apiserver could emit an further watch even even if decryption failed for earlier event and it was not emitted. ([#131161](https://github.com/kubernetes/kubernetes/pull/131161), [@wojtek-t](https://github.com/wojtek-t)) [SIG API Machinery]

## Changelog since v1.31.7

## Changes by Kind

### Bug or Regression

- Fix a bug where kube-apiserver could emit an further watch even even if decryption failed for earlier event and it was not emitted. ([#131160](https://github.com/kubernetes/kubernetes/pull/131160), [@wojtek-t](https://github.com/wojtek-t)) [SIG API Machinery and Etcd]

1 Update 1, Section 4.1. // // It produces a 256-bit output, and accepts a 8-bit Label and a 96-bit Context. // It uses a counter of 16 bits placed before the fixed data. The fixed data is // the sequence Label || 0x00 || Context. The L field is omitted, since the // output key length is fixed. // // It's optimized for use in XAES-256-GCM (https://c2sp.org/XAES-256-GCM), // rather than for exposing it to applications as a stand-alone KDF. type CounterKDF struct { mac CMAC } // NewCounterKDF creates...

- Fixed a race condition on API server startup ensuring previously created webhook configurations are effective before the first write request is admitted. ([#95783](https://github.com/kubernetes/kubernetes/pull/95783), [@roycaihw](https://github.com/roycaihw)) [SIG API Machinery]

    * `kubectl rollout undo` no longer uses the deprecated extensions/v1beta1 rollback API, which means that Events are no longer emitted when rolling back a deployment