Kubernetes supports node proxying, which allows clients of kube-apiserver to access endpoints of a Kubelet to establish connections to Pods, retrieve container logs, and more. While Kubernetes already validates the proxying address for Nodes, a bug in kube-apiserver made it possible to bypass this validation. Bypassing this validation could allow authenticated requests destined for Nodes to be redirected to the API Server through its private network.

- The `TerminationGracePeriodSeconds` on pod specs and container probes should not be negative. Negative values of `TerminationGracePeriodSeconds` will be treated as the value `1s` on the delete path. Immutable field validation will be relaxed in order to update negative values. In a future release, negative values will not be permitted. ([#98866](https://github.com/kubernetes/kubernetes/pull/98866), [@wzshiming](https://github.com/wzshiming))

have two inputs we test [0, q) on one side and a set of interesting // values on the other side. func interestingValues() []interestingValue { if testing.Short() { return []interestingValue{{v: q - 1, m: minusOne}} } var values []interestingValue for _, v := range []uint32{ 0, 1, 2, 3, q - 3, q - 2, q - 1, q / 2, (q + 1) / 2, } { m, _ := fieldToMontgomery(v) values = append(values, interestingValue{v: v, m: m}) // Also test values that have an interesting Montgomery representation. values = append(values,...