A security issue was discovered in Kubernetes where a large number of container checkpoint requests made to the unauthenticated kubelet read-only HTTP endpoint may cause a Node Denial of Service by filling the Node's disk.

**Affected Versions**:
  - kubelet kubelet v1.30.0 to v1.30.9
  - kubelet v1.31.0 to v1.31.5
  - kubelet v1.32.0 to v1.32.1

**Fixed Versions**:
  - kubelet 1.29.14
  - kubelet 1.30.10

### Bug or Regression

- Add `/sys/devices/virtual/powercap` to default masked paths. It avoids the potential security risk that the ability to read these files may offer a power-based sidechannel attack against any workloads running on the same kernel. ([#125970](https://github.com/kubernetes/kubernetes/pull/125970), [@carlory](https://github.com/carlory)) [SIG Node]

- Disabled reading of disk geometry before calling expansion for ext and xfs filesystems. ([#131568](https://github.com/kubernetes/kubernetes/pull/131568), [@gnufied](https://github.com/gnufied))

### Bug or Regression

- Fix component status calling etcd health endpoint over http which exposed kubernetes to the risk of complete watch starvation and is inconsistent with other etcd probing done by kube-apiserver. ([#119039](https://github.com/kubernetes/kubernetes/pull/119039), [@serathius](https://github.com/serathius)) [SIG API Machinery]

      This is a callback function wrapper that will be executed to determine how
      tensors will be split into shards when the saver writes the checkpoint
      shards to disk. `tf.train.experimental.ShardByTaskPolicy` is the default
      sharding behavior, but `tf.train.experimental.MaxShardSizePolicy` can be
      used to shard the checkpoint with a maximum shard file size. Users with

Licensing](https://min.io/pricing) is the best option for applications that trigger AGPLv3 obligations (e.g. open sourcing your application). Applications using MinIO - or any other OSS-licensed code - without validating their usage do so at their own risk....

The AGPLv3 provides no obligation by any party to support, maintain, or warranty the original or any modified work.

			if ch, ok := val.(chan struct{}); ok && ch != nil {
				// Close previous non-nil channel.
				xioutil.SafeClose(ch)
			}
		}
		globalServiceFreezeCnt = 0 // Don't risk going negative.
	}
	globalServiceFreezeMu.Unlock()

		exitReader: make(chan struct{}),
	}
	r.onReaderExit = func() {
		close(r.decoded)
		readCloser.Close()
		for range r.input {
			// Read until EOF trickles through.
			// Otherwise, we risk the decoder hanging.
		}
		r.readerWg.Done()
	}

	// We cannot reuse as we are sending parsed objects elsewhere.
	simdjson.ParseNDStream(readCloser, r.input, nil)
	r.readerWg.Add(1)
	go r.startReader()

    img: https://fastapi.tiangolo.com/img/sponsors/dribia.png
bronze:
  - url: https://www.exoflare.com/open-source/?utm_source=FastAPI&utm_campaign=open_source
    title: Biosecurity risk assessments made easy.
    img: https://fastapi.tiangolo.com/img/sponsors/exoflare.png
  # - url: https://testdriven.io/courses/tdd-fastapi/
  #   title: Learn to build high-quality web apps with best practices