* New behavior:
      * Only `container_name`, `pod_name`, `namespace`, `id`, `image`, and `name` labels are exposed
      * no environment variables will be exposed ever via /metrics, even if whitelisted
* Filter duplicate network packets in promiscuous bridge mode (with ebtables) ([#28717](https://github.com/kubernetes/kubernetes/pull/28717), [@freehan](https://github.com/freehan))

  - [alpha] Kubelet launches container in a per pod cgroup hierarchy based on quality of service tier ([kubernetes/features#126](https://github.com/kubernetes/enhancements/issues/126))

kubeadm is used to deploy this component into your kubernetes cluster, it will be restricted (using `nodeSelectors`) to run only on nodes with that operating system. This ensures that in clusters which include Windows nodes, the scheduler will not ever attempt to place CoreDNS pods on these machines, reducing setup latency and enhancing initial cluster stability. ([#69940](https://github.com/kubernetes/kubernetes/pull/69940), [@MarcPow](https://github.com/MarcPow))

## External Dependencies...

- Fixed a bug which could prevent a provider ID from ever being set for node if an error occurred determining the provider ID when the node was added. ([#87043](https://github.com/kubernetes/kubernetes/pull/87043), [@zjs](https://github.com/zjs)) [SIG Apps and Cloud Provider]

     *     case of weak keys. If we create a new entry with a key that is null at construction time,
     *     we're not sure if entry will necessarily ever be garbage collected.
     * @param newNext entry in the same bucket
     * @param key the key to copy from the original entry to the new one. Use this in preference to
     *     {@code original.getKey()}.
     */

### Other (Cleanup or Flake)

- In GKE alpha clusters it will be possible to use the service annotation `cloud.google.com/network-tier: Standard` ([#88487](https://github.com/kubernetes/kubernetes/pull/88487), [@zioproto](https://github.com/zioproto)) [SIG Cloud Provider]

## Dependencies

### Added
_Nothing has changed._

### Changed

*   If a namespaced resource is owned by a cluster scoped resource, and the namespaced dependent is processed before the cluster scoped owner has ever been observed by the garbage collector, the dependent will be erroneously deleted.

  For more information, see [#54940](https://github.com/kubernetes/kubernetes/issues/54940)

## Deprecations

AAUC,GAGb,IAFA,IAAIC,EAAS,GAERvH,EAAI,EAAGA,EAAIV,EAAQU,IACpBuH,GAAUnC,EAAW+B,EAAMnH,IACrBmH,EAAMnH,GAAGnB,KAAKyI,EAAKjH,GACnB8G,EAAMnH,GAEhB,OAAOuH,GAYoBC,CAAmBnH,GAE3CmG,EAAgBnG,GAAQM,IAPpBA,EAAEqG,aAAaS,cAU9B,SAASP,EAAa7G,EAAQC,GAC1B,IAAIN,EAAI,EAER,SAAS0H,EAA4BlJ,GACjC,OAAO8B,EAAOqH,eAAenJ,IAAUA,EAI3C,IADA+H,EAAsBqB,UAAY,EACtB,GAAL5H,GAAUuG,EAAsBsB,KAAKxH,IACxCA,EAASA,EAAOgH,QACZd,EACAmB,GAEJnB,EAAsBqB,UAAY,IAClC5H,EAGJ,OAAOK,EAkFX,IAAIyH,EAAU,GAEd,SAASC,EAAaC,EAAMC,GACxB,IAAIC,EAAYF,EAAKG,c...

- Fix: set nil cache entry based on old cache ([#87593](https://github.com/kubernetes/kubernetes/pull/87593), [@aramase](https://github.com/aramase)) [SIG Cloud Provider]
- Fixed a bug which could prevent a provider ID from ever being set for node if an error occurred determining the provider ID when the node was added. ([#87043](https://github.com/kubernetes/kubernetes/pull/87043), [@zjs](https://github.com/zjs)) [SIG Apps and Cloud Provider]
- Fixed the following 

        layers in order to work, where the Keras symbolic shape inference proves
        insufficient.
    *   Code that tries manually walking a `tf.keras.Model` layer by layer and
        assumes layers only ever have one positional argument. This assumption
        doesn't hold true before TF 2.4 either, but is more likely to cause
        issues now.
    *   Code that manually enters `keras.backend.get_graph()` before building a