https://kubernetes.io/docs/concepts/containers/runtime-class/ ## runtimeClassName: "" ## Set default rootUser, rootPassword ## AccessKey and secretKey is generated when not set ## Distributed MinIO ref: https://min.io/docs/minio/linux/operations/install-deploy-manage/deploy-minio-multi-node-multi-drive.html ## rootUser: "" rootPassword: "" ## Use existing Secret that store following variables: ## ## | Chart var | .data.<key> in Secret | ## |:-------- ## | rootUser | rootUser | ## | rootPassword | rootPassword...

* Advanced audit policy now supports matching subresources and resource names, but the top level resource no longer matches the subresouce. For example "pods" no longer matches requests to the logs subresource of pods. Use "pods/logs" to match subresources. ([#48836](https://github.com/kubernetes/kubernetes/pull/48836), [@ericchiang](https://github.com/ericchiang))

## Changes to API Resources
### ABAC
* ABAC policies using `"user":"*"` or `"group":"*"` to match all users or groups will only match authenticated requests. To match unauthenticated requests, ABAC policies must explicitly specify `"group":"system:unauthenticated"` ([#38968](https://github.com/kubernetes/kubernetes/pull/38968), [@liggitt](https://github.com/liggitt))

11C70..11C71  ; valid                  ;      ; NV8    # 9.0  MARCHEN HEAD MARK..MARCHEN MARK SHAD
11C72..11C8F  ; valid                                  # 9.0  MARCHEN LETTER KA..MARCHEN LETTER A
11C90..11C91  ; disallowed                             # NA   <reserved-11C90>..<reserved-11C91>
11C92..11CA7  ; valid                                  # 9.0  MARCHEN SUBJOINED LETTER KA..MARCHEN SUBJOINED LETTER ZA

* Audit policy supports matching subresources and resource names, but the top level resource no longer matches the subresouce. For example "pods" no longer matches requests to the logs subresource of pods. Use "pods/logs" to match subresources. ([#48836](https://github.com/kubernetes/kubernetes/pull/48836), [@ericchiang](https://github.com/ericchiang))

Go values created by calling new, by taking the address of a composite
literal, or by taking the address of a local variable may also have their
memory pinned using [runtime.Pinner]. This type may be used to manage
the duration of the memory's pinned status, potentially beyond the
duration of a C function call. Memory may be pinned more than once and
must be unpinned exactly the same number of times it has been pinned.

- Updated cAdvisor to v0.47.2 - Fix metrics in cri-o when a container restarts ([#118774](https://github.com/kubernetes/kubernetes/pull/118774), [@harche](https://github.com/harche)) [SIG Node]

  - [beta] In order to preserve safety guarantees the cluster no longer force deletes pods on un-responsive nodes and users are now warned if they try to force delete pods via the CLI. ([docs](http://kubernetes.io/docs/tasks/manage-stateful-set/scale-stateful-set/)) ([kubernetes/features#119](https://github.com/kubernetes/enhancements/issues/119))
- **Auth**

https://kubernetes.io/docs/concepts/containers/runtime-class/ ## runtimeClassName: "" ## Set default rootUser, rootPassword ## AccessKey and secretKey is generated when not set ## Distributed MinIO ref: https://min.io/docs/minio/linux/operations/install-deploy-manage/deploy-minio-multi-node-multi-drive.html ## rootUser: "" rootPassword: "" ## Use existing Secret that store following variables: ## ## | Chart var | .data.<key> in Secret | ## |:-------- ## | rootUser | rootUser | ## | rootPassword | rootPassword...

	// A src.Int63() generates 63 random bits, enough for letterIdxMax characters!
	for i, cache, remain := n-1, src.Int63(), letterIdxMax; i >= 0; {
		if remain == 0 {
			cache, remain = src.Int63(), letterIdxMax
		}
		if idx := int(cache & letterIdxMask); idx < len(letterBytes) {
			b[i] = letterBytes[idx]
			i--
		}
		cache >>= letterIdxBits
		remain--
	}

	return *(*string)(unsafe.Pointer(&b))
}