- Enhanced the daemonset sync logic to avoid a problem where pods are thought to be unavailable when the controller's clock is slower than the node's clock. ([#77208](https://github.com/kubernetes/kubernetes/pull/77208), [@DaiHao](https://github.com/DaiHao))

- github.com/Azure/go-autorest: [v14.2.0+incompatible](https://github.com/Azure/go-autorest/tree/v14.2.0)
- github.com/a8m/tree: [10a5fd5](https://github.com/a8m/tree/tree/10a5fd5)
- github.com/benbjohnson/clock: [v1.1.0](https://github.com/benbjohnson/clock/tree/v1.1.0)
- github.com/danwinship/knftables: [v0.0.13](https://github.com/danwinship/knftables/tree/v0.0.13)
- github.com/dnaeon/go-vcr: [v1.2.0](https://github.com/dnaeon/go-vcr/tree/v1.2.0)

     * it will match that many characters <i>or less</i>.
     * <p>
     * Wildcard expressions will not filter workgroup names or server names.
     *
     * <blockquote><pre>
     * winnt> ls c?o*
     * clock.avi                  -rw--      82944 Mon Oct 14 1996 1:38 AM
     * Cookies                    drw--          0 Fri Nov 13 1998 9:42 PM
     * 2 items in 5ms
     * </pre></blockquote>
     *

- github.com/Microsoft/hcsshim: [5eafd15 → v0.8.22](https://github.com/Microsoft/hcsshim/compare/5eafd15...v0.8.22)
- github.com/benbjohnson/clock: [v1.0.3 → v1.1.0](https://github.com/benbjohnson/clock/compare/v1.0.3...v1.1.0)
- github.com/bketelsen/crypt: [5cbc8cc → v0.0.4](https://github.com/bketelsen/crypt/compare/5cbc8cc...v0.0.4)

#### Photon
* Fix photon controller plugin to construct with correct PdID ([#37167](https://github.com/kubernetes/kubernetes/pull/37167), [@luomiao](https://github.com/luomiao))

#### rbd
* force unlock rbd image if the image is not used ([#41597](https://github.com/kubernetes/kubernetes/pull/41597), [@rootfs](https://github.com/rootfs))

#### vSphere

### Feature

- Kubeadm: generate CA certificates with a start time that is offset 5 minutes in the past relative to the current system time to workaround cases of clock desync.
  client-go: allow to set NotBefore in NewSelfSignedCACert() ([#119113](https://github.com/kubernetes/kubernetes/pull/119113), [@champtar](https://github.com/champtar)) [SIG API Machinery, Auth and Cluster Lifecycle]

Guaranteed pods with integer CPU requests on nodes with static CPU & Memory policy configured is not allowed for the beta release of in-place resize. The feature gate `InPlacePodVerticalScalingExclusiveCPUs` defaults to `false`, but can be enabled to unblock development on ([#127262](https://github.com/kubernetes/kubernetes/issues/127262), [@tallclair](https://github.com/tallclair)) [SIG Node]. ([#128287](https://github.com/kubernetes/kubernetes/pull/128287), [@esotsal](https://github.com/esotsal)) [SIG...

pkg syscall (freebsd-arm64), type Rusage struct, Nswap int64
pkg syscall (freebsd-arm64), type Rusage struct, Nvcsw int64
pkg syscall (freebsd-arm64), type Rusage struct, Oublock int64
pkg syscall (freebsd-arm64), type Rusage struct, Stime Timeval
pkg syscall (freebsd-arm64), type Rusage struct, Utime Timeval
pkg syscall (freebsd-arm64), type SockaddrDatalink struct

pkg syscall (netbsd-arm64-cgo), type Rusage struct, Nswap int64
pkg syscall (netbsd-arm64-cgo), type Rusage struct, Nvcsw int64
pkg syscall (netbsd-arm64-cgo), type Rusage struct, Oublock int64
pkg syscall (netbsd-arm64-cgo), type Rusage struct, Stime Timeval
pkg syscall (netbsd-arm64-cgo), type Rusage struct, Utime Timeval
pkg syscall (netbsd-arm64-cgo), type SockaddrDatalink struct

    *   AutoGraph error messages now exclude frames corresponding to APIs
        internal to AutoGraph.
    *   Improve shape inference for `tf.function` input arguments to unlock more
        Grappler optimizations in TensorFlow 2.x.
    *   Improve automatic control dependency management of resources by allowing
        resource reads to occur in parallel and synchronizing only on writes.