- client-go releases will no longer have bootstrap (k8s.io/client-go/tools/bootstrap) related code. Any reference to it will break. Please redirect all references to k8s.io/bootstrap instead. ([#67356](https://github.com/kubernetes/kubernetes/pull/67356), [@yliaog](https://github.com/yliaog))

- Kube-apiserver: redirect responses are no longer returned from backends by default. Set `--aggregator-reject-forwarding-redirect=false` to continue forwarding redirect responses. ([#112331](https://github.com/kubernetes/kubernetes/pull/112331), [@enj](https://github.com/enj)) [SIG API Machinery]

pkg syscall (darwin-386), func RawSyscall6(uintptr, uintptr, uintptr, uintptr, uintptr, uintptr, uintptr) (uintptr, uintptr, Errno)
pkg syscall (darwin-386), func Read(int, []uint8) (int, error)
pkg syscall (darwin-386), func ReadDirent(int, []uint8) (int, error)
pkg syscall (darwin-386), func Recvfrom(int, []uint8, int) (int, Sockaddr, error)
pkg syscall (darwin-386), func Recvmsg(int, []uint8, []uint8, int) (int, int, int, Sockaddr, error)

* Fix issue where masquerade rules are flushed in GCE k8s clusters. ([#56729](https...

* Add OAuth2 redirect page for Swagger UI. This allows having delegated authentication in the Swagger UI docs. For this to work, you need to add `{your_origin}/docs/oauth2-redirect` to the allowed callbacks in your OAuth2 provider (in Auth0, Facebook, Google, etc).
    * For example, during development, it could be `http://localhost:8000/docs/oauth2-redirect`.

pkg syscall (netbsd-arm64-cgo), func RawSyscall(uintptr, uintptr, uintptr, uintptr) (uintptr, uintptr, Errno)
pkg syscall (netbsd-arm64-cgo), func ReadDirent(int, []uint8) (int, error)
pkg syscall (netbsd-arm64-cgo), func Read(int, []uint8) (int, error)
pkg syscall (netbsd-arm64-cgo), func Recvfrom(int, []uint8, int) (int, Sockaddr, error)

- Handle slow CronJob lister in CronJob controller v2 and improve memory footprint. ([#96443](https://github.com/kubernetes/kubernetes/pull/96443), [@alaypatel07](https://github.com/alaypatel07)) [SIG Apps]
- --redirect-container-streaming is no longer functional. The flag will be removed in v1.22 ([#95935](https://github.com/kubernetes/kubernetes/pull/95935), [@tallclair](https://github.com/tallclair)) [SIG Node]

pkg syscall (freebsd-arm64), func RawSyscall6(uintptr, uintptr, uintptr, uintptr, uintptr, uintptr, uintptr) (uintptr, uintptr, Errno)
pkg syscall (freebsd-arm64), func Read(int, []uint8) (int, error)
pkg syscall (freebsd-arm64), func ReadDirent(int, []uint8) (int, error)
pkg syscall (freebsd-arm64), func Recvfrom(int, []uint8, int) (int, Sockaddr, error)
pkg syscall (freebsd-arm64), func Recvmsg(int, []uint8, []uint8, int) (int, int, int, Sockaddr, error)

pkg syscall (darwin-arm64), func RawSyscall6(uintptr, uintptr, uintptr, uintptr, uintptr, uintptr, uintptr) (uintptr, uintptr, Errno)
pkg syscall (darwin-arm64), func Read(int, []uint8) (int, error)
pkg syscall (darwin-arm64), func ReadDirent(int, []uint8) (int, error)
pkg syscall (darwin-arm64), func Recvfrom(int, []uint8, int) (int, Sockaddr, error)
pkg syscall (darwin-arm64), func Recvmsg(int, []uint8, []uint8, int) (int, int, int, Sockaddr, error)

### (No, really, you MUST read this before you upgrade)

- The StreamingProxyRedirects feature and `--redirect-container-streaming` flag are deprecated, and will be removed in a future release. The default behavior (proxy streaming requests through the kubelet) will be the only supported option.