* The webhook admission plugin now works even if the API server and the nodes are in two separate networks,for example, in GKE.

   * are guarded by a lock and operations are applied in batches to avoid lock contention. The
   * penalty of applying the batches is spread across threads so that the amortized cost is slightly
   * higher than performing just the operation without enforcing the capacity constraint.
   *
   * This implementation uses a per-segment queue to record a memento of the additions, removals,

a compiler reports a type inference or other error),
and may explain why type inference fails in unusual code situations.
But by and large these rules can be ignored when writing Go code:
type inference is designed to mostly "work as expected",
and the unification rules are fine-tuned accordingly.
</p>

<p>
Type unification is controlled by a <i>matching mode</i>, which may
be <i>exact</i> or <i>loose</i>.

- Support for Windows Server 2019 for worker nodes and containers
- Support for out of tree networking with Azure-CNI, OVN-Kubernetes and Flannel
- Improved support for pods, service types, workload controllers and metrics/quotas to closely match the capabilities offered for Linux containers

- Added the feature gates `StrictCostEnforcementForVAP` and `StrictCostEnforcementForWebhooks` to enforce the strict cost calculation for CEL extended libraries. It is strongly recommended to turn on the feature gates as early as possible. ([#124675](https://github.com/kubernetes/kubernetes/pull/124675), [@cici37](https://github.com/cici37)) [SIG API Machinery, Auth,...

## Changelog since v1.28.1

## Changes by Kind

### API Change

- Fixed a bug where CEL expressions in CRD validation rules would incorrectly compute a high estimated cost for functions that return strings, lists or maps.

fipsSelfTest() // Random ECDSA is dangerous, because a failure of the RNG would immediately // leak the private key. Instead, we use a "hedged" approach, as specified // in draft-irtf-cfrg-det-sigs-with-noise-04, Section 4. This has also the // advantage of closely resembling Deterministic ECDSA. Z := make([]byte, len(priv.d)) if err := drbg.ReadWithReader(rand, Z); err != nil { return nil, err } // See https://github.com/cfrg/draft-irtf-cfrg-det-sigs-with-noise/issues/6 // for the FIPS compliance of this method....

* Audit policy supports matching subresources and resource names, but the top level resource no longer...

resources of running and terminating pods when deciding to accept new pods, since terminating pods are still holding on to those resources. This stricter handling may surface to end users as pod rejections when creating pods that are scheduled to mostly full nodes that have other terminating pods holding the resources the new pods need. The most likely error would be a pod set to `Failed` phase with reason set to `OutOfCpu` or `OutOfMemory`, but any resource on the node that has some fixed limit...

fipsSelfTest() // Random ECDSA is dangerous, because a failure of the RNG would immediately // leak the private key. Instead, we use a "hedged" approach, as specified // in draft-irtf-cfrg-det-sigs-with-noise-04, Section 4. This has also the // advantage of closely resembling Deterministic ECDSA. Z := make([]byte, len(priv.d)) if err := drbg.ReadWithReader(rand, Z); err != nil { return nil, err } // See https://github.com/cfrg/draft-irtf-cfrg-det-sigs-with-noise/issues/6 // for the FIPS compliance of this method....