- Fixed file permission issues that happened during update of Secret/ConfigMap/projected volume when fsGroup is used. The problem caused a race condition where application gets intermittent permission denied error when reading files that were just updated, before the correct permissions were applied. ([#114728](https://github.com/kubernetes/kubernetes/pull/114728), [@furkatgofurov7](https://github.com/furkatgofurov7)) [SIG...

- Kubeadm: remove the "ephemeral_storage" request from the etcd static pod that kubeadm deploys on stacked etcd control plane nodes. This request has caused sporadic failures on some setups due to a problem in the kubelet with cadvisor and the LocalStorageCapacityIsolation feature gate. See this issue for more details: https://github.com/kubernetes/kubernetes/issues/99305 ([#102673](https://github.com/kubernetes/kubernetes/pull/102673),...

- Fix a bug on the endpoints controller that does not reconcile the Endpoint object after this is truncated (it gets more than 1000 endpoints addresses) ([#127417](https://github.com/kubernetes/kubernetes/pull/127417), [@aojea](https://github.com/aojea)) [SIG Apps, Network and Testing]

gehirn.ne.jp geisei.kochi.jp gemological.museum gen.in gen.mi.us gen.ng gen.nz gen.tr genkai.saga.jp genoa.it genova.it gent gentapps.com genting gentlentapis.com geo.br geology.museum geometre-expert.fr george georgia.museum georgia.su getmyip.com gets-it.net gf gg gg.ax ggee ggf.br gh ghost.io gi giehtavuoatna.no giessen.museum gift gifts gifu.gifu.jp gifu.jp giize.com gildeskal.no gildeskål.no ginan.gifu.jp ginowan.okinawa.jp ginoza.okinawa.jp girlfriend.jp girly.jp giske.no git-pages.rit.edu...

- Fixed a bug that caused a DaemonSet rolling update to hang when its pod gets stuck at terminating.  ([#77773](https://github.com/kubernetes/kubernetes/pull/77773), [@DaiHao](https://github.com/DaiHao))

    *   distribute.experimental.rpc package introduces APIs to create a GRPC
        based server to register tf.function methods and a GRPC client to invoke
        remote registered methods. RPC APIs are intended for multi-client setups
        i.e. server and clients are started in separate binaries independently.

    *   Example usage to create server: ```python server =
        tf.distribute.experimental.rpc.Server.create("grpc", "127.0.0.1:1234")

- Kubeadm: increase robustness for "kubeadm join" when adding etcd members on slower setups ([#90645](https://github.com/kubernetes/kubernetes/pull/90645), [@neolit123](https://github.com/neolit123)) [SIG Cluster Lifecycle]

Kubeadm: Automate certificate copy between control planes in HA setups

- Joining control plane nodes to a HA cluster can now be simplified by enabling the optional automatic copy of certificates from an existing control plane node.

        * At Metadata audit level or higher, an annotation with key "mutation.webhook.admission.k8s.io/round_{round idx}_index_{order idx}" gets logged with JSON payload indicating a webhook gets invoked for given request and whether it mutated the object or not.

- Fix a bug on the endpoints controller that does not reconcile the Endpoint object after this is truncated (it gets more than 1000 endpoints addresses) ([#127417](https://github.com/kubernetes/kubernetes/pull/127417), [@aojea](https://github.com/aojea)) [SIG Apps, Network and Testing]