otsuki.kochi.jp
otsuki.yamanashi.jp
ott
ouchi.saga.jp
ouda.nara.jp
oum.gov.pl
oumu.hokkaido.jp
outsystemscloud.com
overhalla.no
ovh
ovre-eiker.no
owani.aomori.jp
owariasahi.aichi.jp
own.pm
ownip.net
ownprovider.com
ox.rs
oxa.cloud
oy.lc
oya.to
oyabe.toyama.jp
oyama.tochigi.jp
oyamazaki.kyoto.jp
oyer.no
oygarden.no
oyodo.nara.jp
oystre-slidre.no

selector information from requests in webhook authorization calls. Promoted `AuthorizeNodeWithSelectors` feature to beta, which changes node authorizer behavior to limit requests from node API clients, so that each Node can only get / list / watch its own Node API object, and can also only get / list / watch Pod API objects bound to that node. Clients using kubelet credentials to read other nodes or unrelated pods must change their authentication credentials (recommended), adjust their usage, or obtain...

- Executed API calls dispatched during pod scheduling asynchronously if the `SchedulerAsyncAPICalls` feature gate was enabled.
  Out-of-tree plugins used `APIDispatcher` and `APICacher` from the framework to dispatch their own calls. ([#132886](https://github.com/kubernetes/kubernetes/pull/132886), [@macsko](https://github.com/macsko)) [SIG Release, Scheduling and Testing]

- The dockershim container runtime now accepts the `docker` runtime handler from a RuntimeClass. ([#78323](https://github.com/kubernetes/kubernetes/pull/78323), [@tallclair](https://github.com/tallclair))
- The init container can now get its own field value as environment variable values using downwardAPI support. ([#75109](https://github.com/kubernetes/kubernetes/pull/75109), [@yuchengwu](https://github.com/yuchengwu))

- kubeadm: The kubeadm configuration now supports the definition of more than one control plane instances with their own APIEndpoint. The APIEndpoint for the "bootstrap" control plane instance should be defined using `InitConfiguration.APIEndpoint`, while the APIEndpoints for additional control plane instances should be added using `JoinConfiguration.APIEndpoint`. ([...

### (No, really, you MUST read this before you upgrade)

- ACTION REQUIRED: Switch core master base images (kube-controller-manager) from debian to distroless. If you need Flex Volumes support using scripts, please build your own image with required packages (like bash) ([#91329](https://github.com/kubernetes/kubernetes/pull/91329), [@dims](https://github.com/dims)) [SIG Cloud Provider, Release, Storage and Testing]

otsuki.kochi.jp
otsuki.yamanashi.jp
ott
ouchi.saga.jp
ouda.nara.jp
oum.gov.pl
oumu.hokkaido.jp
outsystemscloud.com
overhalla.no
ovh
ovre-eiker.no
owani.aomori.jp
owariasahi.aichi.jp
own.pm
ownip.net
ownprovider.com
ox.rs
oxa.cloud
oy.lc
oya.to
oyabe.toyama.jp
oyama.tochigi.jp
oyamazaki.kyoto.jp
oyer.no
oygarden.no
oyodo.nara.jp
oystre-slidre.no

- Updated pause image to version 3.5, which now runs per default as pseudo user and group `65535:65535`. This does not have any effect on remote container runtimes like CRI-O and containerd, which setup the pod sandbox user and group on their own. ([#100292](https://github.com/kubernetes/kubernetes/pull/100292), [@saschagrunert](https://github.com/saschagrunert))

    * The body size limit does not apply to subresources like pods/proxy that proxy request content to another server.
* Kustomize is developed in its own repo https://github.com/kubernetes-sigs/kustomize ([#73033](https://github.com/kubernetes/kubernetes/pull/73033), [@Liujingfang1](https://github.com/Liujingfang1))
    * This PR added a new subcommand `kustomize` in kubectl. 

* Bump version of all prometheus-to-sd images to v0.2.2. ([#54635](https://github.com/kubernetes/kubernetes/pull/54635), [@loburm](https://github.com/loburm))
* [fluentd-gcp addon] Fluentd now runs in its own network, not in the host one. ([#54395](https://github.com/kubernetes/kubernetes/pull/54395), [@crassirostris](https://github.com/crassirostris))