* The kubelet uses a new release 3.1 of the pause container with the Docker runtime. This version will clean up orphaned zombie processes that it inherits. ([#57517](https://github.com/kubernetes/kubernetes/pull/57517), [@verb](https://github.com/verb))

    arguments/keyword arguments comes from a keras input. Previously the
    functional api would only work if all of the elements in the first argument
    to the layer came from a keras input.
*   Clean up `BatchNormalization` layer's `trainable` property to act like
    standard python state when it's used inside `tf.functions` (frozen at
    tracing time), instead of acting like a pseudo-variable whose updates *kind

were learning to draw, you know--'

  `What did they draw?' said Alice, quite forgetting her promise.

  `Treacle,' said the Dormouse, without considering at all this
time.

  `I want a clean cup,' interrupted the Hatter:  `let's all move
one place on.'

  He moved on as he spoke, and the Dormouse followed him:  the
March Hare moved into the Dormouse's place, and Alice rather

- Add CSI Migration Shim for VerifyVolumesAreAttached and BulkVolumeVerify ([#80443](https://github.com/kubernetes/kubernetes/pull/80443), [@davidz627](https://github.com/davidz627))
- Promotes VolumePVCDataSource (Cloning) feature to beta for 1.16 release ([#81792](https://github.com/kubernetes/kubernetes/pull/81792), [@j-griffith](https://github.com/j-griffith))

In particular, the following storage features are moving to GA in Kubernetes 1.18:
- Raw Block Support: Allow volumes to be surfaced as block devices inside containers instead of just mounted filesystems.
- Volume Cloning: Duplicate a PersistentVolumeClaim and underlying storage volume using the Kubernetes API via CSI.
- CSIDriver Kubernetes API Object: Simplifies CSI driver discovery and allows CSI Drivers to customize Kubernetes behavior.

### Bug or Regression

- ## Changelog
  
  ### General
  - Fix priority expander falling back to a random choice even though there is a higher priority option to choose
  - Clone `kubernetes/kubernetes` in `update-vendor.sh` shallowly, instead of fetching all revisions
  - Speed up binpacking by reducing the number of PreFilter calls (call once per pod instead of #pods*#nodes times)

16B78..16B7C  ; disallowed                             # NA   <reserved-16B78>..<reserved-16B7C>
16B7D..16B8F  ; valid                                  # 7.0  PAHAWH HMONG CLAN SIGN TSHEEJ..PAHAWH HMONG CLAN SIGN VWJ
16B90..16E3F  ; disallowed                             # NA   <reserved-16B90>..<reserved-16E3F>
16E40         ; mapped                 ; 16E60         # 11.0 MEDEFAIDRIN CAPITAL LETTER M

  controller loop removes service account token secrets that have not been used
  in the time specified by `--legacy-service-account-token-clean-up-period` (defaulting
  to one year), **and are** referenced from the `.secrets` list of a ServiceAccount

pkg crypto/tls, method (*Conn) Close() error
pkg crypto/tls, method (*Conn) ConnectionState() ConnectionState
pkg crypto/tls, method (*Conn) Handshake() error
pkg crypto/tls, method (*Conn) LocalAddr() net.Addr
pkg crypto/tls, method (*Conn) OCSPResponse() []uint8
pkg crypto/tls, method (*Conn) Read([]uint8) (int, error)
pkg crypto/tls, method (*Conn) RemoteAddr() net.Addr

- DRA kubelet: Fixed the kubelet to also clean up `ResourceSlices` in some additional failure scenarios (driver was removed forcibly or crashed and did not restart). ([#132058](https://github.com/kubernetes/kubernetes/pull/132058), [@pohly](https://github.com/pohly)) [SIG Node and Testing]