- `kubeadm upgrade` now renews all the certificates used by a component before upgrading the component itself, with the exception of certificates signed by external CAs. User can eventually opt-out of certificate renewal during upgrades by setting the new flag `--certificate-renewal` to false. ([#76862](https://github.com/kubernetes/kubernetes/pull/76862), [@fabriziopandini](https://github.com/fabriziopandini))

    * The body size limit does not apply to subresources like pods/proxy that proxy request content to another server.
* The apiserver, including both the kube-apiserver and apiservers built with the generic apiserver library, will now return 413 RequestEntityTooLarge error if a json patch contains more than 10,000 operations. ([#74000](https://github.com/kubernetes/kubernetes/pull/74000), [@caesarxuchao](https://github.com/caesarxuchao))

### Feature

- Kubeadm: generate CA certificates with a start time that is offset 5 minutes in the past relative to the current system time to workaround cases of clock desync.

pkg testing/quick, type Config struct, Rand *rand.Rand
pkg testing/quick, type Config struct, Values func([]reflect.Value, *rand.Rand)
pkg testing/quick, type Generator interface { Generate }
pkg testing/quick, type Generator interface, Generate(*rand.Rand, int) reflect.Value
pkg testing/quick, type SetupError string
pkg text/scanner, const Char ideal-int
pkg text/scanner, const Comment ideal-int