## Changelog since v1.7.0-alpha.4

### Action Required

* kube-apiserver: a new authorization mode (`--authorization-mode=Node`) authorizes nodes to access secrets, configmaps, persistent volume claims and persistent volumes related to their pods. ([#46076](https://github.com/kubernetes/kubernetes/pull/46076), [@liggitt](https://github.com/liggitt))

- Made kubelet's /metrics/slis endpoint always available. ([#128430](https://github.com/kubernetes/kubernetes/pull/128430), [@richabanker](https://github.com/richabanker)) [SIG Architecture, Instrumentation and Node]

    algorithms. When this is enabled, the algorithm selection procedure itself
    is also deterministic.

## Breaking Changes

*   Many backwards incompatible API changes have been made to clean up the APIs
    and make them more consistent.
*   Toolchains:

    *   TensorFlow 2.0.0 is built using devtoolset7 (GCC7) on Ubuntu 16. This
        may lead to ABI incompatibilities with extensions built against earlier

Russ Cox <******@****.***> 1328732807 -0500

     * changing any bin. The operations must not take any action that could even momentarily
     * cause a concurrent read operation to see inconsistent data. This is made easier by the
     * nature of the read operations in Map. For example, no operation can reveal that the table
     * has grown but the threshold has not yet been updated, so there are no atomicity requirements

consequence, all volume mounts in containers are now `rslave` on Linux by default. To make this default work in all Linux environments the entire mount tree should be marked as shareable, e.g. via `mount --make-rshared /`. All Linux distributions that use systemd already have the root directory mounted as rshared and hence they need not do anything. In Linux environments without systemd we recommend running `mount --make-rshared /` during boot before docker is started, ([@jsafrane](https://github.com/jsafrane))...

- `kubectl auth reconcile` now outputs details about what changes are being made ([#71564](https://github.com/kubernetes/kubernetes/pull/71564), [@liggitt](https://github.com/liggitt))

### Network
- The official kube-proxy image (used by kubeadm, among other things) is now compatible with systems running iptables 1.8 in "nft" mode, and will autodetect which mode it should use. ([#82966](https://github.com/kubernetes/kubernetes/pull/82966), [@danwinship](https://github.com/danwinship))

    )
    val url = server.url("/a")
    assertThat(get(url).body.string()).isEqualTo("a")
    val i: Iterator<String> = cache.urls()
    cache.evictAll()

    // The URL was evicted before hasNext() made any promises.
    assertThat(i.hasNext()).isFalse()
    assertFailsWith<NoSuchElementException> {
      i.next()
    }
  }

  /** Test https://github.com/square/okhttp/issues/1712.  */
  @Test

* Remove outdated net.experimental.kubernetes.io/proxy-mode and net.beta.kubernetes.io/proxy-mode annotations from kube-proxy. ([#40585](https://github.com/kubernetes/kubernetes/pull/40585), [@cblecker](https://github.com/cblecker))