* Update GCE ContainerVM deployment to container-vm-v20170117 to pick up CVE fixes in base image. ([#40094](https://github.com/kubernetes/kubernetes/pull/40094), [@zmerlynn](https://github.com/zmerlynn))

- Updated cAdvisor to v0.39.4 to pick up a kubelet fix where network metrics can be missing in some cases when used with containerd ([#111014](https://github.com/kubernetes/kubernetes/pull/111014), [@bobbypage](https://github.com/bobbypage)) [SIG Node]

## Dependencies

- Updates the following images to pick up CVE fixes:
  - `debian` to v1.8.0
  - `debian-iptables` to v1.6.5

pkg syscall (linux-arm-cgo), type Timex struct, Status int32
pkg syscall (linux-arm-cgo), type Timex struct, Stbcnt int32
pkg syscall (linux-arm-cgo), type Timex struct, Tai int32
pkg syscall (linux-arm-cgo), type Timex struct, Tick int32
pkg syscall (linux-arm-cgo), type Timex struct, Time Timeval
pkg syscall (linux-arm-cgo), type Timex struct, Tolerance int32
pkg syscall (linux-arm-cgo), type Tms struct

- Updates `debian-iptables` to v1.6.7 to pick up CVE fixes. ([#104970](https://github.com/kubernetes/kubernetes/pull/104970), [@PushkarJ](https://github.com/PushkarJ))
- Updates the following images to pick up CVE fixes:
  - `debian` to v1.9.0
  - `debian-iptables` to v1.6.6

## Changelog since v1.3.3

### Other notable changes

* NetworkPolicy cherry-pick 1.3 ([#29556](https://github.com/kubernetes/kubernetes/pull/29556), [@caseydavenport](https://github.com/caseydavenport))

* [GCE] Apiserver uses `InternalIP` as the most preferred kubelet address type by default. ([#59019](https://github.com/kubernetes/kubernetes/pull/59019), [@MrHohn](https://github.com/MrHohn))
* Use GCE metadata proxy v0.1.4-r1 to pick up security fixes. ([#60245](https://github.com/kubernetes/kubernetes/pull/60245), [@ihmccreery](https://github.com/ihmccreery))

			<-ctx.Done()
			return
		}
		duration := max(time.Duration(r.Float64()*float64(time.Minute)),
			// Make sure to sleep at least a second to avoid high CPU ticks.
			time.Second)
		time.Sleep(duration)
	}
}

// Loads bucket replication resync statuses into memory.

- Adds "volume.beta.kubernetes.io/migrated-to" annotation to PV's and PVC's when they are migrated to signal external provisioners to pick up those objects for Provisioning and Deleting. ([#87098](https://github.com/kubernetes/kubernetes/pull/87098), [@davidz627](https://github.com/davidz627)) [SIG  Storage]

                the OpenAPI version. But some tools, even though they might be
                compatible with OpenAPI 3.1.0, might not recognize it as a valid.

                So you could override this value to trick those tools into using
                the generated OpenAPI. Have in mind that this is a hack. But if you
                avoid using features added in OpenAPI 3.1.0, it might work for your
                use case.