wriggling down from the sky!  Ugh, Serpent!'

  `But I'm NOT a serpent, I tell you!' said Alice.  `I'm a--I'm
a--'

  `Well!  WHAT are you?' said the Pigeon.  `I can see you're
trying to invent something!'

  `I--I'm a little girl,' said Alice, rather doubtfully, as she
remembered the number of changes she had gone through that day.

  `A likely story indeed!' said the Pigeon in a tone of the

### API Change

	   annotation, you should delete any existing NetworkPolicy
	   objects. These would have had no effect before, but with v1
	   semantics they might cause some traffic to be blocked that you
	   didn't intend to be blocked.

### Other notable changes

* Added exponential backoff to Azure cloudprovider ([#46660](https://github.com/kubernetes/kubernetes/pull/46660), [@jackfrancis](https://github.com/jackfrancis))

	cache := store.lock()
	defer store.unlock()

	// Handle policy mapping removal.
	if policy == "" {
		if store.getUsersSysType() == LDAPUsersSysType {
			// Add a fallback removal towards previous content that may come back
			// as a ghost user due to lack of delete, this change occurred
			// introduced in PR #11840
			store.deleteMappedPolicy(ctx, name, regUser, false)
		}

- Resolves a spurious "Unknown discovery response content-type" error in client-go discovery requests by tolerating extra content-type parameters in API responses ([#117571](https://github.com/kubernetes/kubernetes/pull/117571), [@seans3](https://github.com/seans3)) [SIG API Machinery]

- Fixes a regression in v1beta1 PodDisruptionBudget handling of `strategic merge patch`-type API requests for the `selector` field. Prior to 1.21, these requests would merge `matchLabels` content and replace `matchExpressions` content. In 1.21, patch requests touching the `selector` field started replacing the entire selector. This is consistent with server-side apply and the v1 PodDisruptionBudget behavior, but should not have been changed for v1beta1. ([#...

- If a client makes an API streaming requests and specifies an `application/json;as=Table` content type, the API server now responds with a 406 (Not Acceptable) error.

wriggling down from the sky!  Ugh, Serpent!'

  `But I'm NOT a serpent, I tell you!' said Alice.  `I'm a--I'm
a--'

  `Well!  WHAT are you?' said the Pigeon.  `I can see you're
trying to invent something!'

  `I--I'm a little girl,' said Alice, rather doubtfully, as she
remembered the number of changes she had gone through that day.

  `A likely story indeed!' said the Pigeon in a tone of the

* When performing a GET then PUT, the kube-apiserver must write the canonical representation of the object to etcd if the current value does not match. That allows external agents to migrate content in etcd from one API version to another, across different storage types, or across varying encryption levels. This fixes a bug introduced in 1.5 where we unintentionally stopped writing the newest data. ([#48394](https://github.com/kubernetes/kub...

- Client-ca bundles for the all generic-apiserver based servers will dynamically reload from disk on content changes ([#83579](https://github.com/kubernetes/kubernetes/pull/83579), [@deads2k](https://github.com/deads2k))