- The synthetic "Bookmark" event for the watch stream requests will now include a new annotation: `kubernetes.io/initial-events-list-blueprint`. THe annotation contains an empty, versioned list that is encoded in the requested format (such as protobuf, JSON, or CBOR), then base64-encoded and stored as a string. ([#127587](https://github.com/kubernetes/kubernetes/pull/127587), [@p0lyn0mial](https://github.com/p0lyn0mial)) [SIG API Machinery]

	expiresStr := req.Header.Get("Expires")
	if expiresStr == "" {
		expiresStr = strconv.FormatInt(epochExpires, 10)
		req.Header.Set("Expires", expiresStr)
	}

	// url.RawPath will be valid if path has any encoded characters, if not it will
	// be empty - in which case we need to consider url.Path (bug in net/http?)
	encodedResource := req.URL.RawPath
	encodedQuery := req.URL.RawQuery
	if encodedResource == "" {

	VREV32	V5.B16, V5.B16                  // a508206e
	VREV64	V2.S2, V3.S2                    // 4308a00e
	VREV64	V2.S4, V3.S4                    // 4308a04e

// logical ops
//
// make sure constants get encoded into an instruction when it could
	AND	R1@>33, R2
	AND	$(1<<63), R1                        // AND	$-9223372036854775808, R1       // 21004192

	// first instruction is an invisible stack pointer adjustment).
	JMP	start					// JMP	2

	JMP	2(PC)					// 6f008000
	JMP	(X5)					// 67800200
	JMP	4(X5)					// 67804200

	// CALL and JMP to symbol are encoded as JAL (using LR or ZERO
	// respectively), with a R_RISCV_JAL relocation. The linker resolves
	// the real address and updates the immediate, using a trampoline in
	// the case where the address is not directly reachable.

- Kubeadm: external etcd endpoints passed in the `ClusterConfiguration` that have Unicode characters are no longer IDNA encoded (converted to Punycode). They are now just URL encoded as per Go's implementation of RFC-3986, have duplicate "/" removed from the URL paths, and passed like that directly to the `kube-apiserver` `--etcd-servers` flag. If you have etcd endpoints that have Unicode characters,...

0xa2, 0xc4, 0x3b, 0xad, 0x54, 0x6f, 0xbe, 0x8c, 0xfe, 0xbc, } hash := sha1.New() hash.Write(msg) hashed := hash.Sum(nil) encoded, err := emsaPSSEncode(hashed, 1023, salt, sha1.New()) if err != nil { t.Errorf("Error from emsaPSSEncode: %s\n", err) } if !bytes.Equal(encoded, expected) { t.Errorf("Bad encoding. got %x, want %x", encoded, expected) } if err = emsaPSSVerify(hashed, encoded, 1023, len(salt), sha1.New()); err != nil { t.Errorf("Bad verification: %s", err) } } golang.org/fips140@v1.0.0-c209...

0xa2, 0xc4, 0x3b, 0xad, 0x54, 0x6f, 0xbe, 0x8c, 0xfe, 0xbc, } hash := sha1.New() hash.Write(msg) hashed := hash.Sum(nil) encoded, err := emsaPSSEncode(hashed, 1023, salt, sha1.New()) if err != nil { t.Errorf("Error from emsaPSSEncode: %s\n", err) } if !bytes.Equal(encoded, expected) { t.Errorf("Bad encoding. got %x, want %x", encoded, expected) } if err = emsaPSSVerify(hashed, encoded, 1023, len(salt), sha1.New()); err != nil { t.Errorf("Bad verification: %s", err) } } golang.org/fips140@v1.1.0-rc1/...

([#64248](https://github.com/kubernetes/kubernetes/pull/64248), [@feiskyer](https://github.com/feiskyer))

### SIG CLI

* You can now use the `base64decode` function in kubectl go templates to decode base64-encoded data, such as `kubectl get secret SECRET -o go-template='{{ .data.KEY | base64decode }}'`. ([#60755](https://github.com/kubernetes/kubernetes/pull/60755), [@glb](https://github.com/glb))

* Websocket requests may now authenticate to the API server by passing a bearer token in a websocket subprotocol of the form `base64url.bearer.authorization.k8s.io.<base64url-encoded-bearer-token>`. ([#47740](https://github.com/kubernetes/kubernetes/pull/47740), [@liggitt](https://github.com/liggitt))

- '`kubeadm`: added validation to verify that the `CertificateKey` is a valid hex
  encoded AES key.' ([#120064](https://github.com/kubernetes/kubernetes/pull/120064), [@SataQiu](https://github.com/SataQiu))
- A customizable `OrderedScoreFuncs()` function was introduced. Out-of-tree plugins