- Kubeadm: warn but do not error out on missing "ca.key" files for root CA, front-proxy CA and etcd CA, during "kubeadm join --control-plane" if the user has provided all certificates, keys and kubeconfig files which require signing with the given CA keys. ([#94988](https://github.com/kubernetes/kubernetes/pull/94988), [@neolit123](https://github.com/neolit123)) [SIG Cluster Lifecycle]

### **Cluster Lifecycle**

*   You must either specify the `--discovery-token-ca-cert-hash` flag to `kubeadm join`, or opt out of the CA pinning feature using `--discovery-token-unsafe-skip-ca-verification`.
*   The default `auto-detect` behavior of the kubelet's `--cloud-provider` flag is removed.

        .cache(cache)
        .build()

    // Store a response in the cache.
    val url = server.url("/")
    val request1SentAt = System.currentTimeMillis()
    executeSynchronously("/", "Accept-Language", "fr-CA", "Accept-Charset", "UTF-8")
      .assertCode(200)
      .assertBody("A")
    val request1ReceivedAt = System.currentTimeMillis()
    assertThat(server.takeRequest().headers["If-None-Match"]).isNull()

- Kubeadm: during execution of the "check expiration" command, treat the etcd CA as external if there is a missing etcd CA key file (etcd/ca.key) and perform the proper validation on certificates signed by...

    String QUERY_GSA_DEFAULT_PREFERENCE = "query.gsa.default.preference";

    /** The key of the configuration. e.g. ar=ar<br>
     * bg=bg<br>
     * bn=bn<br>
     * ca=ca<br>
     * ckb-iq=ckb-iq<br>
     * ckb_IQ=ckb-iq<br>
     * cs=cs<br>
     * da=da<br>
     * de=de<br>
     * el=el<br>
     * en=en<br>
     * en-ie=en-ie<br>
     * en_IE=en-ie<br>

return this.utcOffset()>this.clone().month(0).utcOffset()||this.utcOffset()>this.clone().month(5).utcOffset()},yt.isLocal=function(){return!!this.isValid()&&!this._isUTC},yt.isUtcOffset=function(){return!!this.isValid()&&this._isUTC},yt.isUtc=Ca,yt.isUTC=Ca,yt.zoneAbbr=function(){return this._isUTC?"UTC":""},yt.zoneName=function(){return this._isUTC?"Coordinated Universal Time":""},yt.dates=t("dates accessor is deprecated. Use date instead.",lt),yt.months=t("months accessor is deprecated. Use month...

"aici", "al", "ăla", "ale", "alea", "ălea", "altceva", "altcineva", "am", "ar", "are", "aş", "aşadar", "asemenea", "asta", "ăsta", "astăzi", "astea", "ăstea", "ăştia", "asupra", "aţi", "au", "avea", "avem", "aveţi", "azi", "bine", "bucur", "bună", "ca", "că", "căci", "când", "care", "cărei", "căror", "cărui", "cât", "câte", "câţi", "către", "câtva", "ce", "cel", "ceva", "chiar", "cînd", "cine", "cineva", "cît", "cîte", "cîţi", "cîtva", "contra", "cu", "cum", "cumva", "curând", "curînd", "da", "dă",...

"aici", "al", "ăla", "ale", "alea", "ălea", "altceva", "altcineva", "am", "ar", "are", "aş", "aşadar", "asemenea", "asta", "ăsta", "astăzi", "astea", "ăstea", "ăştia", "asupra", "aţi", "au", "avea", "avem", "aveţi", "azi", "bine", "bucur", "bună", "ca", "că", "căci", "când", "care", "cărei", "căror", "cărui", "cât", "câte", "câţi", "către", "câtva", "ce", "cel", "ceva", "chiar", "cînd", "cine", "cineva", "cît", "cîte", "cîţi", "cîtva", "contra", "cu", "cum", "cumva", "curând", "curînd", "da", "dă",...

- Kube-apiserver: Made sure that when `--requestheader-client-ca-file` and `--client-ca-file` contain overlapping certificates, `--requestheader-allowed-names` must be specified so that regular client certificates cannot set authenticating proxy headers for arbitrary users. ([#131411](https://github.com/kubernetes/kubernetes/pull/131411),...

* Fix an issue that pods using hostNetwork keep increasing. ([#67456](https://github.com/kubernetes/kubernetes/pull/67456), [@Huang-Wei](https://github.com/Huang-Wei))
* Allows extension API server to dynamically discover the requestheader CA certificate when the core API server doesn't use certificate based authentication for it's clients ([#66394](https://github.com/kubernetes/kubernetes/pull/66394), [@rtripat](https://github.com/rtripat))