- Changed NodeToStatusMap from a map to a struct and exposed methods to access the entries. Added absentNodesStatus, which informs the status of nodes that are absent in the map. For developers of out-of-tree PostFilter plugins, ensure to update the usage of NodeToStatusMap. Additionally, NodeToStatusMap should eventually be renamed to NodeToStatusReader....

  for (int i = 0; i < results.return_nodes.size(); ++i) {
    tf_results->return_nodes[i] = ToOperation(results.return_nodes[i]);
  }

  // Populate missing unused map keys
  DCHECK(tf_results->missing_unused_key_names.empty());
  DCHECK(tf_results->missing_unused_key_indexes.empty());
  DCHECK(tf_results->missing_unused_key_names_data.empty());

   ([#122558](https://github.com/kubernetes/kubernetes/pull/122558), [@linxiulei](https://github.com/linxiulei))
- Fixed CEL estimated cost for expressions that perform operations on the result of `map()` operations (e.g., `.map(...).exists(...)` ) to have the correct estimated cost instead of an unbounded cost.
   ([#123562](https://github.com/kubernetes/kubernetes/pull/123562), [@jpbetz](https://github.com/jpbetz))

* The OpenID Connect authenticator can now use a custom prefix, or omit the default prefix, for username and groups claims through the --oidc-username-prefix and --oidc-groups-prefix flags. For example, the authenticator can map a user with the username "jane" to "google:jane" by supplying the "google:" username prefix. ([#50875](https://github.com/kubernetes/kubernetes/pull/50875), [@ericchiang](https://github.com/ericchiang))

pkg strings, func CutPrefix(string, string) (string, bool) #42537
pkg strings, func CutSuffix(string, string) (string, bool) #42537
pkg sync, method (*Map) CompareAndDelete(interface{}, interface{}) bool #51972
pkg sync, method (*Map) CompareAndSwap(interface{}, interface{}, interface{}) bool #51972
pkg sync, method (*Map) Swap(interface{}, interface{}) (interface{}, bool) #51972
pkg syscall (freebsd-386-cgo), const SYS_FSTAT = 551 #53280

- For raw block CSI volumes on Kubernetes, kubelet was incorrectly calling CSI NodeStageVolume for every single "map" (i.e. raw block "mount") operation for a volume already attached to the node. This PR ensures it is only called once per volume per node. ([#112403](https://github.com/kubernetes/kubernetes/pull/112403), [@akankshakumari393](https://github.com/akankshakumari393))...

* Don't recreate lb cloud resources on kcm restart ([#29082](https://github.com/kubernetes/kubernetes/pull/29082), [@bprashanth](https://github.com/bprashanth))
* List all nodes and occupy cidr map before starting allocations ([#29062](https://github.com/kubernetes/kubernetes/pull/29062), [@bprashanth](https://github.com/bprashanth))

## Changes by Kind

### Feature

- Kubernetes is now built with go 1.21.9
  - update debian-base/set-cap to bookworm-v1.0.2 ([#124198](https://github.com/kubernetes/kubernetes/pull/124198), [@cpanato](https://github.com/cpanato)) [SIG API Machinery, Architecture, Release and Testing]

### Bug or Regression

pkg syscall (netbsd-arm64-cgo), func Mkfifo(string, uint32) error
pkg syscall (netbsd-arm64-cgo), func Mknod(string, uint32, int) error
pkg syscall (netbsd-arm64-cgo), func Mmap(int, int64, int, int, int) ([]uint8, error)
pkg syscall (netbsd-arm64-cgo), func Munmap([]uint8) error
pkg syscall (netbsd-arm64-cgo), func Nanosleep(*Timespec, *Timespec) error

pkg archive/tar, const TypeGNUSparse = 83
pkg archive/tar, const TypeGNUSparse ideal-char
pkg archive/tar, type Header struct, Xattrs map[string]string
pkg compress/gzip, method (*Reader) Reset(io.Reader) error
pkg crypto/tls, const CurveP256 = 23
pkg crypto/tls, const CurveP256 CurveID
pkg crypto/tls, const CurveP384 = 24
pkg crypto/tls, const CurveP384 CurveID
pkg crypto/tls, const CurveP521 = 25
pkg crypto/tls, const CurveP521 CurveID