- The `BalancedAllocation` plugin now skips all best-effort (zero-requested) pods. ([#130260](https://github.com/kubernetes/kubernetes/pull/130260), [@Bowser1704](https://github.com/Bowser1704))
- The following roles have had `Watch` added to them (prefixed with `system:controller:`):
  
  - `cronjob-controller`
  - `endpoint-controller`
  - `endpointslice-controller`
  - `endpointslicemirroring-controller`

- Dropped the additional rule requirement (cronjobs/finalizers) for roles
  using kubectl create cronjobs to ensure backward compatibility. ([#124883](https://github.com/kubernetes/kubernetes/pull/124883), [@ardaguclu](https://github.com/ardaguclu))

- Warn instead of fail when creating Roles and ClusterRoles with custom verbs via kubectl ([#92492](https://github.com/kubernetes/kubernetes/pull/92492), [@eddiezane](https://github.com/eddiezane)) [SIG CLI]

* Fix SelectorSpreadPriority scheduler to match all selectors when distributing pods. ([#72801](https://github.com/kubernetes/kubernetes/pull/72801), [@Ramyak](https://github.com/Ramyak))
* Add bootstrap service account & cluster roles for node-lifecycle-controller, cloud-node-lifecycle-controller, and cloud-node-controller.   ([#72764](https://github.com/kubernetes/kubernetes/pull/72764), [@andrewsykim](https://github.com/andrewsykim))

- `kubectl create token` can now be used to request a service account token, and permission to request service account tokens is added to the `edit` and `admin` RBAC roles ([#107880](https://github.com/kubernetes/kubernetes/pull/107880), [@liggitt](https://github.com/liggitt))

   * that gets messy here, and we already have null tests for Range.
   */

  /*
   * These generators also rely on consecutive integer inputs (not necessarily in order, but no
   * holes).
   */

  // SetCreationTester has some tests that pass in duplicates. Dedup them.
  private static <E extends Comparable<? super E>> SortedSet<E> nullCheckedTreeSet(E[] elements) {
    SortedSet<E> set = newTreeSet();

        FLAGS[prefixFlag or frameFlag or FLAG_PADDED] =
          FLAGS[prefixFlag] + '|'.toString() + FLAGS[frameFlag] + "|PADDED"
      }
    }

    for (i in FLAGS.indices) { // Fill in holes with binary representation.
      if (FLAGS[i] == null) FLAGS[i] = BINARY[i]
    }
  }

  /**
   * Returns a human-readable representation of HTTP/2 frame headers.
   *
   * The format is:
   *

   * that gets messy here, and we already have null tests for Range.
   */

  /*
   * These generators also rely on consecutive integer inputs (not necessarily in order, but no
   * holes).
   */

  // SetCreationTester has some tests that pass in duplicates. Dedup them.
  private static <E extends Comparable<? super E>> SortedSet<E> nullCheckedTreeSet(E[] elements) {
    SortedSet<E> set = newTreeSet();

    <glob pattern="*.pen"/>
    <glob pattern="*.pod"/>
    <glob pattern="*.pom"/>
    <glob pattern="*.project"/>
    <glob pattern="*.rng"/>
    <glob pattern="*.rnx"/>
    <glob pattern="*.roles"/>
    <glob pattern="*.schemas"/>
    <glob pattern="*.tld"/>
    <glob pattern="*.types"/>
    <glob pattern="*.vm"/>
    <glob pattern="*.vsl"/>
    <glob pattern="*.wsdd"/>

// deals with sparseDatas.
//
// However, the external API uses sparseHoles instead of sparseDatas because the
// zero value of sparseHoles logically represents a normal file (i.e., there are
// no holes in it). On the other hand, the zero value of sparseDatas implies
// that the file has no data in it, which is rather odd.
//
// As an example, if the underlying raw file contains the 10-byte data:
//