KAAK6T,QAAc,OAA0B,IAAjB7T,KAAK6T,QAAgB,IAAM,OACxD,OAGRoB,QAAS,WACL,MACI,WACgB,EAAfjV,KAAK6T,QAAc,OAA0B,IAAjB7T,KAAK6T,QAAgB,IAAM,OACxD,OAGRqB,SAAU,WACN,OAAQlV,KAAKqT,OACT,KAAK,EACD,MACI,uBACgB,EAAfrT,KAAK6T,QACA,OACiB,IAAjB7T,KAAK6T,QACL,IACA,OACN,MAER,QACI,MACI,uBACgB,EAAf7T,KAAK6T,QACA,OACiB,IAAjB7T,KAAK6T,QACL,IACA,OACN,QAIhBsB,SAAU,KAEdQ,aAAc,CACVC,OAAQ,SACRC,KAAM,QACNnI,EAAG,iBACHoI,GAAI,aACJpT,EAAG,YACHqT,GAAI,YACJC,EAAG,SACHC,GAAI,SACJxD,EAAG,YACHyD,GAAI,YACJC,EAAG,gBACHC,GAAI,eACJC,EAAG,...

* Adds an approval work flow to the certificate approver that will approve certificate signing requests from kubelets that meet all the criteria of kubelet server certificates. ([#46884](https://github.com/kubernetes/kubernetes/pull/46884), [@jcbsmpsn](https://github.com/jcbsmpsn))

* Adds an approval work flow to the certificate approver that will approve certificate signing requests from kubelets that meet all the criteria of kubelet server certificates. ([#46884](https://github.com/kubernetes/kubernetes/pull/46884), [@jcbsmpsn](https://github.com/jcbsmpsn))

- If `kubeadm reset` finds no etcd member ID for the peer it removes during the `remove-etcd-member` phase, it continues immediately to other phases, instead of retrying the phase for up to 3 minutes before continuing. ([#117948](https://github.com/kubernetes/kubernetes/pull/117948), [@dlipovetsky](https...

s/kubernetes/pull/57902), [@kawych](https://github.com/kawych))

* On cluster provision or upgrade, kubeadm now generates certs and secures all connections to the etcd static-pod with mTLS. This includes the etcd serving cert, the etcd peer cert, and the apiserver etcd client cert. Flags and hostMounts are added to the etcd and apiserver static-pods to load these certs. For connections to etcd, https is now used in favor of http. ([#57415](https://github.com/kubernetes/kubernetes/pull/57415),...

- If `kubeadm reset` finds no etcd member ID for the peer it removes during the `remove-etcd-member` phase, it continues immediately to other phases, instead of retrying the phase for up to 3 minutes before continuing. ([#118057](https://github.com/kubernetes/kubernetes/pull/118057), [@dlipovetsky](https...

- If `kubeadm reset` finds no etcd member ID for the peer it removes during the `remove-etcd-member` phase, it continues immediately to other phases, instead of retrying the phase for up to 3 minutes before continuing. ([#117916](https://github.com/kubernetes/kubernetes/pull/117916), [@dlipovetsky](https...

- If `kubeadm reset` finds no etcd member ID for the peer it removes during the `remove-etcd-member` phase, it continues immediately to other phases, instead of retrying the phase for up to 3 minutes before continuing. ([#118192](https://github.com/kubernetes/kubernetes/pull/118192), [@dlipovetsky](https...