- The default delegating authorization options now allow unauthenticated access to healthz, readyz, and livez.  A system:masters user connecting to an authz delegator will not perform an authz check. ([#98325](https://github.com/kubernetes/kubernetes/pull/98325), [@deads2k](https://github.com/deads2k)) [SIG API Machinery, Auth, Cloud Provider and Scheduling]

* Add conntrack as a dependency of kubelet and kubeadm when building rpms and debs. Both require conntrack to handle cleanup of connections. ([#71540](https://github.com/kubernetes/kubernetes/pull/71540), [@mauilion](https://github.com/mauilion))
* UDP connections now support graceful termination in IPVS mode ([#71515](https://github.com/kubernetes/kubernetes/pull/71515), [@lbernail](https://github.com/lbernail))

## Changelog since v1.13.5

### Other notable changes

* Connections from Pods to Services with 0 endpoints will now ICMP reject immediately, rather than blackhole and timeout. ([#72534](https://github.com/kubernetes/kubernetes/pull/72534), [@thockin](https://github.com/thockin))

      }
    }
    return null
  }

  fun put(connection: RealConnection) {
    connection.assertLockHeld()

    connections.add(connection)
//    connection.queueEvent { connectionListener.connectEnd(connection) }
    scheduleCloser()
  }

  /**
   * Notify this pool that [connection] has become idle. Returns true if the connection has been
   * removed from the pool and should be closed.

        URLConnection connection1 = handler.openConnection(url1);
        URLConnection connection2 = handler.openConnection(url2);

        assertNotNull(connection1, "First connection should not be null.");
        assertNotNull(connection2, "Second connection should not be null.");
        assertTrue(connection1 instanceof NtlmHttpURLConnection, "First connection should be wrapped.");

    connection: Connection,
    route: Route,
    call: Call,
  ) {}

  /**
   * Invoked when a connection is released as no longer required.
   */
  open fun connectionClosed(connection: Connection) {}

  /**
   * Invoked when a call is assigned a particular connection.
   */
  open fun connectionAcquired(
    connection: Connection,
    call: Call,
  ) {}

  /**

- Packets considered INVALID by conntrack are now dropped. In particular, this fixes
a problem where spurious retransmits in a long-running TCP connection to a service
IP could result in the connection being closed with the error "Connection reset by
peer" ([#74840](https://github.com/kubernetes/kubernetes/pull/74840), [@anfernee](https://github.com/anfernee))

## Changelog since v1.12.7

### Other notable changes

* Connections from Pods to Services with 0 endpoints will now ICMP reject immediately, rather than blackhole and timeout. ([#72534](https://github.com/kubernetes/kubernetes/pull/72534), [@thockin](https://github.com/thockin))

    HTTP/2 to 16 MiB of unacknowledged data per connection. With this fix there is a limit of 16 MiB
    of unacknowledged data per stream and no per-connection limit.

 *  Fix: Don't operate on a connection after it's been returned to the pool. This race occurred
    on failed web socket connection attempts.

 *  Upgrade: [Okio 3.6.0][okio_3_6_0].

 *  Upgrade: [Kotlin 1.8.21][kotlin_1_8_21].

    .url("https://publicobject.com/helloworld.txt")
    .build();

System.out.println("REQUEST 1 (new connection)");
try (Response response = client.newCall(request).execute()) {
  // Consume and discard the response body.
  response.body().source().readByteString();
}

System.out.println("REQUEST 2 (pooled connection)");
try (Response response = client.newCall(request).execute()) {
  // Consume and discard the response body.