- ServiceAccount metadata.annotations[kubernetes.io/enforce-mountable-secrets]: deprecated since v1.32; no removal deadline. Prefer separate namespaces to isolate access to mounted secrets. ([#128396](https://github.com/kubernetes/kubernetes/pull/128396), [@ritazh](https://github.com/ritazh)) [SIG API Machinery, Apps, Auth, CLI and Testing]

pkg go/constant, func MakeString(string) Value
pkg go/constant, func MakeUint64(uint64) Value
pkg go/constant, func MakeUnknown() Value
pkg go/constant, func Num(Value) Value
pkg go/constant, func Real(Value) Value
pkg go/constant, func Shift(Value, token.Token, uint) Value
pkg go/constant, func Sign(Value) int
pkg go/constant, func StringVal(Value) string
pkg go/constant, func Uint64Val(Value) (uint64, bool)

no longer registered into the global gogo type registry. Kubernetes API Go types were not suitable for use with the `google.golang.org/protobuf` library, and no longer implement `ProtoMessage()` by default to avoid accidental incompatible use. If removal of these marker methods impacts your use, it can be re-enabled for one more release with a `kubernetes_protomessage_one_more_release` build tag, but will be removed in `v1.36`. ([#134256](https://github.com/kubernetes/kubernetes/pull/134256), [@l...

pkg syscall (freebsd-386-cgo), type RtMetrics struct, Recvpipe uint32
pkg syscall (freebsd-386-cgo), type RtMetrics struct, Rtt uint32
pkg syscall (freebsd-386-cgo), type RtMetrics struct, Rttvar uint32
pkg syscall (freebsd-386-cgo), type RtMetrics struct, Sendpipe uint32
pkg syscall (freebsd-386-cgo), type RtMetrics struct, Ssthresh uint32
pkg syscall (freebsd-386-cgo), type RtMetrics struct, Weight uint32

* Resolves forbidden error when accessing replicasets and daemonsets via the apps API group ([#54309](https://github.com/kubernetes/kubernetes/pull/54309), [@liggitt](https://github.com/liggitt))
* kubelet: prevent removal of default labels from Node API objects on startup ([#54073](https://github.com/kubernetes/kubernetes/pull/54073), [@liggitt](https://github.com/liggitt))

## Deprecations

This section provides an overview of deprecated API versions, options, flags, and arguments. Deprecated means that we intend to remove the capability from a future release. After removal, the capability will no longer work. The sections are organized by SIGs.

### **API Machinery**

* `--output-version` is ignored for all commands except `kubectl convert`.  This is consistent with the generic nature of `kubectl` CRUD commands and the previous removal of `--api-version`.  Specific versions can be specified in the resource field: `resource.version.group`, `jobs.v1.batch`. ([#41576](https://github.com/kubernetes/kubernetes/pull/41576), [@deads2k](https://github.com/deads2k))

## What's New (Major Themes)

### Deprecation of PodSecurityPolicy

 - Fix: get attach disk error due to missing item in max count table ([#89768](https://github.com/kubernetes/kubernetes/pull/89768), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider and Storage]
 - Fix: support removal of nodes backed by deleted non VMSS instances on Azure ([#91184](https://github.com/kubernetes/kubernetes/pull/91184), [@bpineau](https://github.com/bpineau)) [SIG Cloud Provider]

* Fixes bug in DaemonSetController causing it to stop processing some DaemonSets for 5 minutes after node removal. ([#76060](https://github.com/kubernetes/kubernetes/pull/76060), [@krzysztof-jastrzebski](https://github.com/krzysztof-jastrzebski))