- In clusters where the DryRun feature is enabled, dry-run requests...

- Added counter metric "apiserver_request_self" to count API server self-requests with labels for verb, resource, and subresource. ([#94288](https://github.com/kubernetes/kubernetes/pull/94288), [@LogicalShark](https://github.com/LogicalShark)) [SIG API Machinery, Auth, Instrumentation and Scheduling]

The merged fix enforces validation against the proxying address for a Node. In some cases, the fix can break clients that depend on the `nodes/proxy` subresource, specifically if a kubelet advertises a localhost or link-local address to the Kubernetes control plane. Configuring an egress proxy for egress to the cluster network can also mitigate this vulnerability.

**Affected Versions**:

### Authorization
* The authorization.k8s.io API group was promoted to v1 ([#40709](https://github.com/kubernetes/kubernetes/pull/40709), [@liggitt](https://github.com/liggitt))
* The SubjectAccessReview API now passes subresource and resource name information to the authorizer to answer authorization queries. ([#40935](https://github.com/kubernetes/kubernetes/pull/40935), [@liggitt](https://github.com/liggitt))

### Autoscaling

* Addresses vSphere Volume Attach limits ([#29881](https://github.com/kubernetes/kubernetes/pull/29881), [@dagnello](https://github.com/dagnello))
* allow restricting subresource access ([#29988](https://github.com/kubernetes/kubernetes/pull/29988), [@deads2k](https://github.com/deads2k))

* The SubjectAccessReview API passes subresource and resource name information to the authorizer to answer authorization queries. ([#40935](https://github.com/kubernetes/kubernetes/pull/40935), [@liggitt](https://github.com/liggitt))

    class InterfaceContractTests {

        @Test
        @DisplayName("SmbResource should extend AutoCloseable")
        void testInterfaceInheritance() {
            // Then
            assertTrue(AutoCloseable.class.isAssignableFrom(SmbResource.class), "SmbResource should extend AutoCloseable");
        }

        @Test
        @DisplayName("SmbResource should have all required methods")

import jcifs.ResourceFilter;
import jcifs.SmbConstants;
import jcifs.SmbResource;

class ShareEnumIterator implements CloseableIterator<SmbResource> {

    private static final Logger log = LoggerFactory.getLogger(ShareEnumIterator.class);

    private final Iterator<FileEntry> delegate;
    private final ResourceFilter filter;
    private final SmbResource parent;
    private SmbResource next;

    /**
     * @param parent

- Fixed a bug where `Services` using finalizers may hold onto `ClusterIP` and/or `NodePort` allocated resources for longer than expected if the finalizer is removed using the status subresource. ([#120623](https://github.com/kubernetes/kubernetes/pull/120623), [@aojea](https://github.com/aojea))

import jcifs.ResourceFilter;
import jcifs.SmbResource;

abstract class FileEntryAdapterIterator implements CloseableIterator<SmbResource> {

    private static final Logger log = LoggerFactory.getLogger(FileEntryAdapterIterator.class);

    private final CloseableIterator<FileEntry> delegate;
    private final ResourceFilter filter;
    private final SmbResource parent;
    private SmbResource next;

    /**
     * @param parent