* After a kubelet rotates its client cert, it now closes its connections to the API server to force a handshake using the new cert. Previously, the kubelet could keep its existing connection open, even if the cert used for that connection was expired and rejected by the API server. ([#49899](https://github.com/kubernetes/kubernetes/pull/49899), [@ericchiang](https://github.com/ericchiang))

#### **Audit**

*   Fixed a bug so that `kube-apiserver` now waits for open connections to finish before exiting. This fix provides graceful shutdown and ensures that the audit backend no longer drops events on shutdown. ([#53695](https://github.com/kubernetes/kubernetes/pull/53695),[ @hzxuzhonghu](https://github.com/hzxuzhonghu))

by default). An API server fronted by an L7 load balancer that already mitigates these http/2 attacks may choose not to enable the kube-apiserver mitigation to avoid disrupting load balancer → kube-apiserver connections if http/2 requests from multiple clients share the same backend connection. An API server on a private network may choose not to enable the kube-apiserver mitigation to prevent performance regressions for unauthenticated clients. Authenticated requests rely on the fix in golang.org/x/net...

    // flow-control window is fully depleted.
    if (!flushHeaders) {
      withLock {
        flushHeaders = (connection.writeBytesTotal >= connection.writeBytesMaximum)
      }
    }

    connection.writeHeaders(id, outFinished, responseHeaders)

    if (flushHeaders) {
      connection.flush()
    }
  }

- When the `PreferSameTrafficDistribution` feature gate is enabled, a new `trafficDistribution` value `PreferSameNode` is available, which attempts to always route Service connections to an endpoint on the same node as the client. Additionally, `PreferSameZone` is introduced as an alias for `PreferClose`. ([#130844](https://github.com/kubernetes/kubernetes/pull/130844), [@danwinship](https://github.com/danwinship)) [SIG API Machinery,...

    /**
     * Get the value for the key 'search_engine.http.ssl.certificate_authorities'. <br>
     * The value is, e.g.  <br>
     * comment: Path to SSL certificate authorities for secure HTTP connections.
     * @return The value of found property. (NotNull: if not found, exception but basically no way)
     */
    String getSearchEngineHttpSslCertificateAuthorities();

    /**

  override fun connectionConnectEnd(
    connection: Connection,
    route: Route,
  ) {
    poolConnectionListener.connectEnd(connection, route, call)
  }

  override fun connectionAcquired(connection: Connection) {
    eventListener.connectionAcquired(call, connection)
  }

  override fun acquireConnectionNoEvents(connection: RealConnection) {
    call.acquireConnectionNoEvents(connection)
  }

          }
        } else {
          exchange.noRequestBody()
          if (!exchange.connection.isMultiplexed) {
            // If the "Expect: 100-continue" expectation wasn't met, prevent the HTTP/1 connection
            // from being reused. Otherwise we're still obligated to transmit the request body to
            // leave the connection in a consistent state.
            exchange.noNewExchangesOnConnection()
          }
        }

    // Play it back.
    val connection = connect(peer)
    connection.newStream(headerEntries("a", "android"), false)
    connection.withLock {
      if (!connection.isHealthy(System.nanoTime())) {
        throw ConnectionShutdownException()
      }
    }
    connection.writePing()
    connection.shutdown(ErrorCode.PROTOCOL_ERROR)
    assertThat(connection.openStreamCount()).isEqualTo(1)

	"github.com/minio/minio/internal/grid"
)

// lockRESTClient is authenticable lock REST client
type lockRESTClient struct {
	connection *grid.Connection
}

// IsOnline - returns whether REST client failed to connect or not.
func (c *lockRESTClient) IsOnline() bool {
	return c.connection.State() == grid.StateConnected
}

// Not a local locker
func (c *lockRESTClient) IsLocal() bool {
	return false
}