# Run this using build.sh.

ARG ubuntu=ubuntu
FROM $ubuntu:focal

RUN mkdir /boring
WORKDIR /boring

ENV LANG=C
ENV LANGUAGE=

# Following NIST submission draft dated July 3, 2021.
# This corresponds to boringssl.googlesource.com/boringssl tag fips-20210429.
ENV ClangV=12
RUN apt-get update && \

### Taints and Tolerations
* Add a manager to NodeController that is responsible for removing Pods from Nodes tainted with NoExecute Taints. This feature is beta (as the rest of taints) and enabled by default. It's gated by controller-manager enable-taint-manager flag. ([#40355](https://github.com/kubernetes/kubernetes/pull/40355), [@gmarek](https://github.com/gmarek))

	// ClusterTrustBundle allows a pod to access the `.spec.trustBundle` field
	// of ClusterTrustBundle objects in an auto-updating file.
	//
	// Alpha, gated by the ClusterTrustBundleProjection feature gate.
	//
	// ClusterTrustBundle objects can either be selected by name, or by the
	// combination of signer name and a label selector.
	//

A security issue was discovered in Kubernetes that could allow  Windows workloads to run as `ContainerAdministrator` even when those workloads set the `runAsNonRoot` option to `true `.

This issue has been rated low and assigned CVE-2021-25749

**Am I vulnerable?**

All Kubernetes clusters with following versions, running Windows workloads with `runAsNonRoot` are impacted

**Affected Versions**:

- Improved scheduling latency when many gated pods ([#124848](https://github.com/kubernetes/kubernetes/pull/124848), [@gabesaba](https://github.com/gabesaba)) [SIG Scheduling and Testing]

	"clusterTrustBundle":  "ClusterTrustBundle allows a pod to access the `.spec.trustBundle` field of ClusterTrustBundle objects in an auto-updating file.\n\nAlpha, gated by the ClusterTrustBundleProjection feature gate.\n\nClusterTrustBundle objects can either be selected by name, or by the combination of signer name and a label selector.\n\nKubelet performs aggressive normalization of the PEM contents written into...

- Improved scheduling latency when many gated pods ([#124849](https://github.com/kubernetes/kubernetes/pull/124849), [@gabesaba](https://github.com/gabesaba)) [SIG Scheduling and Testing]

  // ClusterTrustBundle allows a pod to access the `.spec.trustBundle` field
  // of ClusterTrustBundle objects in an auto-updating file.
  //
  // Alpha, gated by the ClusterTrustBundleProjection feature gate.
  //
  // ClusterTrustBundle objects can either be selected by name, or by the
  // combination of signer name and a label selector.
  //

results are retrieved.  The resulting list is identical to a list call that does not perform chunking, thanks to capabilities provided by etcd3.  This allows the server to use less memory and CPU when very large lists are returned. This feature is gated as APIListChunking and is not enabled by default. The 1.9 release will begin using this by default.([#48921](https://github.com/kubernetes/kubernetes/pull/48921))

* Pods that are marked for deletion and have exceeded their grace period,...

* add...