- Secure serving on port 10258 to cloud-controller-manager (configurable via `--secure-port`) is now enabled. Delegated authentication and authorization are to be configured using the same flags as for aggregated API servers. Without configuration, the secure port...

          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - all
          readOnlyRootFilesystem: true
        volumeMounts:
        - mountPath: /tmp/k8s-webhook-server/serving-certs
          name: cert
          readOnly: true
      nodeSelector:
        kubernetes.io/os: linux
      securityContext:
        fsGroup: 65534
        runAsNonRoot: true

   * elements.
   *
   * <p>If the mapped keys contain duplicates (according to the comparator), the values are merged
   * using the specified merging function. Entries will appear in the encounter order of the first
   * occurrence of the key.
   *
   * @since 33.2.0 (available since 21.0 in guava-jre)
   */
  @SuppressWarnings("Java7ApiChecker")

Node.  There is an open PR ([#48189](https://github.com/kubernetes/kubernetes/pull/48189)) to resolve this issue, but as this issue also exists in 1.6, and as we do not wish to risk release stability by merging it directly prior to a release without sufficient testing, we have decided to defer merging the PR until the next point release for each minor version ([#48190](https://github.com/kubernetes/kubernetes/pull/48190)).

* Protobuf serialization does not distinguish between `[]` and `null`....

 *
 * Because they don't attempt canonical form, these classes are surprisingly difficult to use
 * securely. Suppose you're building a webservice that checks that incoming paths are prefixed
 * "/static/images/" before serving the corresponding assets from the filesystem.
 *
 * ```java
 * String attack = "http://example.com/static/images/../../../../../etc/passwd";
 * System.out.println(new URL(attack).getPath());

   * elements.
   *
   * <p>If the mapped keys contain duplicates (according to the comparator), the values are merged
   * using the specified merging function. Entries will appear in the encounter order of the first
   * occurrence of the key.
   *
   * @since 21.0
   */
  public static <T extends @Nullable Object, K, V>

*   `Estimator.export_savedmodel()` now includes all valid serving signatures
    that can be constructed from the Serving Input Receiver and all available
    ExportOutputs. For instance, a classifier may provide regression- and
    prediction-flavored outputs, in addition to the classification-flavored one.
    Building signatures from these allows TF Serving to honor requests using the

- Kube-apiserver: fixes a potential crash serving CustomResourceDefinitions that combine an invalid schema and CEL validation rules. ([#126167](https://github.com/kubernetes/kubernetes/pull/126167), [@cici37](https://github.com/cici37)) [SIG API Machinery and Testing]

- Add a `serving` and `terminating` condition to the EndpointSlice API.
  `serving` tracks the readiness of endpoints regardless of their terminating state. This is distinct from `ready` since `ready` is only true when pods are not terminating. 

## Changelog since v1.22.5

## Changes by Kind

### Feature