- `kubectl create token` can now be used to request a service account token, and permission to request service account tokens is added to the `edit` and `admin` RBAC roles ([#107880](https://github.com/kubernetes/kubernetes/pull/107880), [@liggitt](https://github.com/liggitt))

- Drop additional rule requirement (cronjobs/finalizers) in the roles who use kubectl create cronjobs to be backwards compatible ([#124883](https://github.com/kubernetes/kubernetes/pull/124883), [@ardaguclu](https://github.com/ardaguclu)) [SIG CLI]

* Fix SelectorSpreadPriority scheduler to match all selectors when distributing pods. ([#72801](https://github.com/kubernetes/kubernetes/pull/72801), [@Ramyak](https://github.com/Ramyak))
* Add bootstrap service account & cluster roles for node-lifecycle-controller, cloud-node-lifecycle-controller, and cloud-node-controller.   ([#72764](https://github.com/kubernetes/kubernetes/pull/72764), [@andrewsykim](https://github.com/andrewsykim))

    <glob pattern="*.pen"/>
    <glob pattern="*.pod"/>
    <glob pattern="*.pom"/>
    <glob pattern="*.project"/>
    <glob pattern="*.rng"/>
    <glob pattern="*.rnx"/>
    <glob pattern="*.roles"/>
    <glob pattern="*.schemas"/>
    <glob pattern="*.tld"/>
    <glob pattern="*.types"/>
    <glob pattern="*.vm"/>
    <glob pattern="*.vsl"/>
    <glob pattern="*.wsdd"/>

### Bug or Regression

- Drop additional rule requirement (cronjobs/finalizers) in the roles who use kubectl create cronjobs to be backwards compatible ([#124883](https://github.com/kubernetes/kubernetes/pull/124883), [@ardaguclu](https://github.com/ardaguclu)) [SIG CLI]