- If using cgroups v2, then the cgroup aware OOM killer will be enabled for container cgroups via  `memory.oom.group` .  This causes processes within the cgroup to be treated as a unit and killed simultaneously in the event of an OOM kill on any process in the cgroup. ([#117793](https://github.com/kubernetes/kubernetes/pull/117793), [@tzneal](https://github.com/tzneal)) [SIG Apps, Node and Testing]

A security issue was discovered in kube-apiserver that could allow an attacker controlled aggregated API server to redirect client traffic to any URL.  This could lead to the client performing unexpected actions as well as leaking the client's credentials to third parties. 

- Using `--log-file` is known to be problematic in 1.15. This presents as things being logged multiple times to the same file. The behaviour and details of this issue, as well as some preliminary attempts at fixing it are documented [here](https://github.com/kubernetes/kubernetes/issues/78734#issuecomment-501372131)

## Urgent Upgrade Notes

A security issue was discovered in kube-apiserver that could allow an attacker controlled aggregated API server to redirect client traffic to any URL.  This could lead to the client performing unexpected actions as well as leaking the client's credentials to third parties. 

- The endpointslice mirroring controller mirrors endpoints annotations and labels to the generated endpoint slices, it also ensures that updates on any of these fields on the endpoints are mirrored. 
  The well-known annotation endpoints.kubernetes.io/last-change-trigger-time is skipped and not mirrored. ([#100443](https://github.com/kubernetes/kubernetes/pull/100443), [@aojea](https://github.com/aojea)) [SIG Apps, Network and Testing]

pkg os, method (*File) WriteString(string) (int, error)
pkg os, method (*LinkError) Error() string
pkg os, method (*PathError) Error() string
pkg os, method (*Process) Kill() error
pkg os, method (*Process) Release() error
pkg os, method (*Process) Signal(Signal) error
pkg os, method (*Process) Wait() (*ProcessState, error)
pkg os, method (*ProcessState) Exited() bool

pkg syscall (netbsd-arm64-cgo), func Issetugid() bool
pkg syscall (netbsd-arm64-cgo), func Kevent(int, []Kevent_t, []Kevent_t, *Timespec) (int, error)
pkg syscall (netbsd-arm64-cgo), func Kill(int, Signal) error
pkg syscall (netbsd-arm64-cgo), func Kqueue() (int, error)
pkg syscall (netbsd-arm64-cgo), func Listen(int, int) error
pkg syscall (netbsd-arm64-cgo), func Lstat(string, *Stat_t) error

- Kubeadm: added the ControlPlaneKubeletLocalMode feature gate. It can be used to tell kubeadm to use the local kube-apiserver endpoint for the kubelet when creating a cluster with "kubeadm init" or when joining control plane nodes with "kubeadm join".  The "kubeadm join" workflow now includes two new experimental phases called "con...

while we don't commit to deterministic execution with respect // to the rand stream, we also don't apply MaybeReadByte, so per Hyrum's Law // it's probably relied upon by some. It's a tolerable promise because a // well-specified number of random bytes is included in the signature, in a // well-specified way. if saltLength < 0 { return nil, errors.New("crypto/rsa: salt length cannot be negative") } // FIPS 186-5, Section 5.4(g): "the length (in bytes) of the salt (sLen) // shall satisfy 0 ≤ sLen ≤ hLen"....

pkg syscall (freebsd-arm64), func Issetugid() bool
pkg syscall (freebsd-arm64), func Kevent(int, []Kevent_t, []Kevent_t, *Timespec) (int, error)
pkg syscall (freebsd-arm64), func Kill(int, Signal) error
pkg syscall (freebsd-arm64), func Kqueue() (int, error)
pkg syscall (freebsd-arm64), func Listen(int, int) error
pkg syscall (freebsd-arm64), func Lstat(string, *Stat_t) error