- Kubeadm: ensured waiting for apiserver uses a local client that doesn't reach to the control plane endpoint and instead reaches directly to the local API server endpoint. ([#134270](https://github.com/kubernetes/kubernetes/pull/134270), [@neolit123](https://github.com/neolit123)) [SIG Cluster Lifecycle]

Suppose a function <code>G</code> defers a function <code>D</code> that calls
<code>recover</code> and a panic occurs in a function on the same goroutine in which <code>G</code>
is executing.
When the running of deferred functions reaches <code>D</code>,
the return value of <code>D</code>'s call to <code>recover</code> will be the value passed to the call of <code>panic</code>.
If <code>D</code> returns normally, without starting a new

32 bits must be an encoding of the module name, and the last 64 bits // must be a counter. The starting value of the counter is set on the first call // to Seal, and each subsequent call must increment it as a big-endian uint64. // If the counter reaches the starting value minus one, Seal will panic. // // This complies with FIPS 140-3 IG C.H Scenario 3. func NewGCMWithCounterNon(cipher *aes.Block) (*GCMWithCounterNonce, error) { g, err := newGCM(&GCM{}, cipher, gcmStandardNonceSize, gcmTagSize) if...