administrators of Kubernetes may want to control that new Service CIDRs added to the cluster do not overlap with other networks on the cluster, that only belong to a specific range of IPs. Administrators may also prefer to retain the existing behavior of only having one ServiceCIDR per cluster. You can use `ValidatingAdmissionPolicy` to achieve this. ([#128971](https://github.com/kubernetes/kubernetes/pull/128971), [@aojea](https://github.com/aojea)) [SIG Apps, Architecture, Auth, CLI, Etcd, Network, Release...

  
  For developers of out-of-tree PostFilter plugins, note that the semantics of NodeToStatusMap are changing: A node with an absent value in the NodeToStatusMap should be interpreted as having an UnschedulableAndUnresolvable status. ([#125197](https://github.com/kubernetes/kubernetes/pull/125197), [@gabesaba](https://github.com/gabesaba))

	err = c.validateIDPSettings(ctx, sites)
	if err != nil {
		return madmin.ReplicateAddStatus{}, err
	}

	// For this `add` API, either all clusters must be empty or the local
	// cluster must be the only one having some buckets.
	if localHasBuckets && nonLocalPeerWithBuckets != "" {
		return madmin.ReplicateAddStatus{}, errSRInvalidRequest(errors.New("only one cluster may have data when configuring site replication"))
	}

        * `workqueue_work_duration_seconds`
        * `workqueue_unfinished_work_seconds`
        * `workqueue_longest_running_processor_seconds`
        * `workqueue_retries_total`
* Fix inability to use k8s with dockerd having default IPC mode set to private. ([#70826](https://github.com/kubernetes/kubernetes/pull/70826), [@kolyshkin](https://github.com/kolyshkin))

- PersistentVolumeClaim objects...

  * [stable] [containerd](https://github.com/containerd/containerd): containerd v1.1 natively supports CRI v1alpha2 now, so users can use Kubernetes v1.10 with containerd v1.1 directly, without having to use the intermediate cri-containerd daemon. [All Kubernetes 1.10 tests passed](https://k8s-testgrid.appspot.com/sig-node-containerd). [@Random-Liu]

* ActiveDeadlineSeconds is validated in workload controllers now, make sure it's not set anywhere (it shouldn't be set by default and having it set means your controller will restart the Pods at some point) ([#38741](https://github.com/kubernetes/kubernetes/pull/38741), [@sandflee](https://github.com/sandflee))

1FADC..1FADF  ; disallowed                             # NA   <reserved-1FADC>..<reserved-1FADF>
1FAE0..1FAE7  ; valid                  ;      ; NV8    # 14.0 MELTING FACE..BUBBLES
1FAE8         ; valid                  ;      ; NV8    # 15.0 SHAKING FACE
1FAE9..1FAEF  ; disallowed                             # NA   <reserved-1FAE9>..<reserved-1FAEF>
1FAF0..1FAF6  ; valid                  ;      ; NV8    # 14.0 HAND WITH INDEX FINGER AND THUMB CROSSED..HEART HANDS

func rr(m *Modulus) *Nat { rr := NewNat().ExpandFor(m) n := uint(len(rr.limbs)) mLen := uint(m.BitLen()) logR := _W * n // We start by computing R = 2^(_W * n) mod m. We can get pretty close, to // 2^⌊log₂m⌋, by setting the highest bit we can without having to reduce. rr.limbs[n-1] = 1 << ((mLen - 1) % _W) // Then we double until we reach 2^(_W * n). for i := mLen - 1; i < logR; i++ { rr.Add(rr, m) } // Next we need to get from R to 2^(_W * n) R mod m (aka from one to R in // the Montgomery domain, meaning...