* Running `kubectl taint` (alpha in 1.5) against a 1.5 server requires a kubectl version of 1.5
* Running `kubectl create secret` no longer accepts passing multiple values to a single --from-literal flag using comma separation
  * Update command invocations to pass separate --from-literal flags for each value

### RBAC

testingOnlyRejection func() // Signature is an ECDSA signature, where r and s are represented as big-endian // byte slices of the same length as the curve order. type Signature struct { R, S []byte } // Sign signs a hash (which shall be the result of hashing a larger message with // the hash function H) using the private key, priv. If the hash is longer than // the bit-length of the private key's curve order, the hash will be truncated // to that length. func Sign[P Point[P], H hash.Hash](c *Curve[P],...

- Avoid caching the Azure VMSS instances whose network profile is nil ([#100948](https://github.com/kubernetes/kubernetes/pull/100948), [@feiskyer](https://github.com/feiskyer)) [SIG Cloud Provider]

- Kube-apiserver: the alpha PodSecurity feature can be enabled by passing `--feature-gates=PodSecurity=true`, and enables controlling allowed pods using namespace labels. See https://git.k8s.io/enhancements/keps/sig-auth/2579-psp-replacement for more details. ([#103099](https://github.com/kubernetes/kubernetes/pull/103099),...

    }

    /**
     * Handle client move events
     */
    private void handleClientMove(WitnessNotification notification) {
        // Server is asking client to move to different node
        log.info("Client move requested for resource: {}", notification.getResourceName());

        List<WitnessNotification.WitnessIPAddress> newAddresses = notification.getNewIPAddresses();

* The AWS credential provider can now obtain ECR credentials even without the AWS cloud provider or being on an EC2 instance. Additionally, AWS credential provider caching has been improved to honor the ECR credential timeout. ([#75587](https://github.com/kubernetes/kubernetes/pull/75587), [@tiffanyfay](https://github.com/tiffanyfay))

	KSHIFTLW $196, K1, K5 // c4e3f932e9c4
	KSHIFTLD $0, K7, K0   // c4e37933c700
	KSHIFTLD $196, K1, K5 // c4e37933e9c4
	KSHIFTLQ $0, K7, K0   // c4e3f933c700
	KSHIFTLQ $196, K1, K5 // c4e3f933e9c4
	// EVEX: masking with K1-K7.
	VADDPD X2, X1, K1, X0            // 62f1f50958c2
	VADDPD X12, X1, K4, X10          // 6251f50c58d4
	VADDPD X22, X1, K7, X20          // 62a1f50f58e6
	VADDPD (AX), X1, K1, X1          // 62f1f5095808

    not send the `Expect: continue` request header.
 *  Fix: Do not count web sockets toward the dispatcher's per-host connection
    limit.
 *  Fix: Avoid using invalid HTTPS sessions. This prevents OkHttp from crashing
    with the error, `Unexpected TLS version: NONE`.
 *  Fix: Don't corrupt the response cache when a 304 (Not Modified) response
    overrides the stored "Content-Encoding" header.

### SIG Network

For 1.13, the areas of focus were in IPv6, DNS improvements and some smaller items:
CoreDNS is now the default cluster DNS passing all of the scale/resource usage tests
Node-local DNS cache feature is available in Alpha. This feature deploys a lightweight DNS caching Daemonset that avoids the conntrack and converts queries from UDP to more reliable TCP.
PodReady++ feature now has `kubectl` CLI support.

### Bug or Regression

- Avoid caching the Azure VMSS instances whose network profile is nil ([#100948](https://github.com/kubernetes/kubernetes/pull/100948), [@feiskyer](https://github.com/feiskyer)) [SIG Cloud Provider]