### Feature

- Kubernetes is now built with Golang 1.16.9 (#105672, @cpanato) [SIG Cloud Provider, Instrumentation, Release and Testing]

### Failing Test

- Backport: e2e.test now uses the secure port to retrieve metrics data to ensure compatibility with 1.21 and 1.22 (for upgrade tests) (#104328, @pohly) [SIG API Machinery, Instrumentation, Storage and Testing]

### Bug or Regression

/88290), [@tallclair](https://github.com/tallclair)) [SIG API Machinery and Node]

- `kubectl` no longer defaults to `http://localhost:8080`.  If you own one of these legacy clusters, you are *strongly- encouraged to secure your server.   If you cannot secure your server, you can set `KUBERNETES_MASTER` if you were relying on that behavior and you're client-go user. Set `--server`, `--kubeconfig` or `KUBECONFIG` to make it work in `kubectl`. ([#86173](https://github.com/kubernetes/ku...

- Completed pods lose logs across node upgrade ([#32324](https://github.com/kubernetes/kubernetes/issues/32324))
- Pods are deleted across node upgrade ([#32323](https://github.com/kubernetes/kubernetes/issues/32323))
- Secure master -> node communication ([#11816](https://github.com/kubernetes/kubernetes/issues/11816))
- upgrading master doesn't upgrade kubectl ([#32538](https://github.com/kubernetes/kubernetes/issues/32538))

* Support secure etcd cluster for centos provider. ([#42994](https://github.com/kubernetes/kubernetes/pull/42994), [@Shawyeok](https://github.com/Shawyeok))

pkg syscall (freebsd-riscv64), const SIGTTOU = 22 #53466
pkg syscall (freebsd-riscv64), const SIGTTOU Signal #53466
pkg syscall (freebsd-riscv64), const SIGURG = 16 #53466
pkg syscall (freebsd-riscv64), const SIGURG Signal #53466
pkg syscall (freebsd-riscv64), const SIGUSR1 = 30 #53466
pkg syscall (freebsd-riscv64), const SIGUSR1 Signal #53466
pkg syscall (freebsd-riscv64), const SIGUSR2 = 31 #53466

### CVE-2022-3294: Node address isn't always verified when proxying

A security issue was discovered in Kubernetes where users may have access to secure endpoints in the control plane network. Kubernetes clusters are only affected if an untrusted user can to modify Node objects and send requests proxying through them.

    t, inverse Gamma) now fully reparameterized.
*   Java: Experimental wrapper classes to make graph generation easier. Thanks
    @karllessard and @kbsriram
*   Build & link in secure gRPC components (switch from the insecure grpc
    dependency to secure grpc dependency).
*   Adding new endpoints for existing tensorflow symbols. These endpoints are
    going to be the preferred endpoints going forward and may replace some of

    <glob pattern="*.ez2"/>
  </mime-type>
  <mime-type type="application/vnd.ezpix-package">
    <glob pattern="*.ez3"/>
  </mime-type>
  <mime-type type="application/vnd.f-secure.mobile"/>
  <mime-type type="application/vnd.fdf">
    <acronym>FDF</acronym>
    <_comment>Forms Data Format</_comment>
    <tika:link>http://en.wikipedia.org/wiki/Forms_Data_Format</tika:link>

- kubeadm: consider --bind-address or --advertise-address and --secure-port for control plane components when the feature gate WaitForAllControlPlaneComponents is enabled. Use /livez for kube-apiserver and kube-scheduler, but continue using /healthz for kube-controller-manager until it supports /livez. ([#128474](ht...

- Added `kubeadm alpha certs certificate-key` command to generate secure random key to use on `kubeadm init --experimental-upload-certs` ([#77848](https://github.com/kubernetes/kubernetes/pull/77848), [@yagonobre](https://github.com/yagonobre))