- kube-dns add-on:
  - All containers are now being executed under more restrictive privileges.
  - Most of the containers now run as non-root user and has the root filesystem set as read-only.
  - The remaining container running as root only has the minimum Linux capabilities it requires to run.

- Fixed issue where `kubectl-convert` would fail when encountering resources that could not be converted to the specified api version. New behavior is to warn the user of the failed conversions and continue to convert the remaining resources. ([#117002](https://github.com/kubernetes/kubernetes/pull/117002), [@gxwilkerson33](https://github.com/gxwilkerson33))

* Fix scheduler cache panic when updating pod conditions. ([#56731](https://github.com/kubernetes/kubernetes/pull/56731), [@bsalamat](https://github.com/bsalamat))
* Add new Prometheus metric that monitors the remaining lifetime of certificates used to authenticate requests to the API server. ([#50387](https://github.com/kubernetes/kubernetes/pull/50387), [@jcbsmpsn](https://github.com/jcbsmpsn))

				if err = admClient.SRPeerBucketOps(ctx, bucket, madmin.PurgeDeletedBucketOp, nil); err != nil {
					return c.annotatePeerErr(peerName, deleteBucket, err)
				}
			}
		}
	}
	// Mark buckets deleted on remaining peers
	if deleteOp == MarkDelete {
		for _, dID := range withB {
			peerName := info.Sites[dID].Name
			if dID == globalDeploymentID() {
				err := c.PeerBucketDeleteHandler(ctx, bucket, DeleteBucketOptions{

going down on one knee as he spoke, `we were trying--'

  `I see!' said the Queen, who had meanwhile been examining the
roses.  `Off with their heads!' and the procession moved on,
three of the soldiers remaining behind to execute the unfortunate
gardeners, who ran to Alice for protection.

  `You shan't be beheaded!' said Alice, and she put them into a
large flower-pot that stood near.  The three soldiers wandered

  - `InTreePluginOpenStackUnregister`
  - `InTreePluginvSphereUnregister` ([#124815](https://github.com/kubernetes/kubernetes/pull/124815), [@carlory](https://github.com/carlory)) [SIG Storage]
- Removed the last remaining in-tree gcp cloud provider and credential provider.
  Please use the external cloud provider and credential provider from https://github.com/kubernetes/cloud-provider-gcp

items in the list which are not included in this list response. If the list request contained label or field selectors, then the number of remaining items is unknown and the field will be left unset and omitted during serialization. If the list is complete (either because it is not chunking or because this is the last chunk), then there are no more remaining items and this field will be left unset and omitted during serialization. Servers older than v1.15 do not set this field. The intended use of...

        "multiset.entrySet.retainAll(presentEntry) returned false",
        getMultiset().entrySet().retainAll(singleton(Multisets.immutableEntry(e0(), 1))));
    assertTrue(
        "multiset doesn't contains element after retaining its entry",
        getMultiset().contains(e0()));
  }

  @CollectionSize.Require(ONE)
  @CollectionFeature.Require(SUPPORTS_REMOVE)
  public void testEntrySet_retainAllAbsent() {
    assertTrue(

- Added `singleProcessOOMKill` flag to the kubelet configuration. Setting that to true enable single process OOM killing in cgroups v2. In this mode, if a single process is OOM killed within a container, the remaining processes will not be OOM killed. ([#126096](https://github.com/kubernetes/kubernetes/pull/126096), [@utam0k](https://github.com/utam0k)) [SIG API Machinery, Node, Testing and Windows]

disabilities.

Reporting Issues
----------------

If you experience or witness unacceptable behavior — or have any other concerns — please report it by
emailing [******@****.***][codeofconduct_at]. For more details, please see our Reporting
Guidelines below.

Thanks
------

Some of the ideas and wording for the statements and guidelines above were based on work by the