* The {@link Iterators} analog to this method is {@link Iterators#getNext}.
   *
   * <p>If no default value is desired (and the caller instead wants a {@link
   * NoSuchElementException} to be thrown), it is recommended that {@code
   * iterable.iterator().next()} is used instead.
   *
   * <p>To get the only element in a single-element {@code Iterable}, consider using {@link

- The certificate signer no longer accepts ca.key passwords via the `CFSSL_CA_PK_PASSWORD` environment variable. This capability was not prompted by user request, never advertised, and recommended against in the security audit. ([#84677](https://github.com/kubernetes/kubernetes/pull/84677), [@mikedanese](https://github.com/mikedanese))

    - [Server Binaries](#server-binaries-11)
    - [Node Binaries](#node-binaries-11)
  - [1.9 Release Notes](#19-release-notes)
  - [WARNING: etcd backup strongly recommended](#warning-etcd-backup-strongly-recommended)
  - [Introduction to 1.9.0](#introduction-to-190)
  - [Major themes](#major-themes)
    - [API Machinery](#api-machinery)
    - [Apps](#apps)
    - [Auth](#auth)
    - [AWS](#aws)

   * string literal is of the form {@code "http://[2001:db8::1]:8888/index.html"}.
   *
   * <p>Use of either {@link InetAddresses#toAddrString}, {@link InetAddress#getHostAddress()}, or
   * this method is recommended over {@link InetAddress#toString()} when an IP address string
   * literal is desired. This is because {@link InetAddress#toString()} prints the hostname and the
   * IP address string joined by a "/".
   *

- [v1.6.0](#v160)
  - [Downloads for v1.6.0](#downloads-for-v160)
    - [Client Binaries](#client-binaries-13)
    - [Server Binaries](#server-binaries-13)
  - [WARNING: etcd backup strongly recommended](#warning-etcd-backup-strongly-recommended)
  - [Major updates and release themes](#major-updates-and-release-themes)
  - [Action Required](#action-required-1)
    - [Certificates API](#certificates-api)

   * [host] is an IP address or is considered a public suffix by the public suffix list.
   *
   * In general this method **should not** be used to test whether a domain is valid or routable.
   * Instead, DNS is the recommended source for that information.
   *
   * | URL                           | `topPrivateDomain()` |
   * | :---------------------------- | :------------------- |
   * | `http://google.com`           | `"google.com"`       |

 *
 * <h3>Non-preconditions</h3>
 *
 * <p>It is of course possible to use the methods of this class to check for invalid conditions
 * which are <i>not the caller's fault</i>. Doing so is <b>not recommended</b> because it is
 * misleading to future readers of the code and of stack traces. See <a
 * href="https://github.com/google/guava/wiki/ConditionalFailuresExplained">Conditional failures

- API paging is now enabled by default in k8s.io/apiserver recommended options, and in k8s.io/sample-apiserver ([#77278](https://github.com/kubernetes/kubernetes/pull/77278), [@liggitt](https://github.com/liggitt))

## Changes by Kind

### API Change

- Added the feature gates `StrictCostEnforcementForVAP` and `StrictCostEnforcementForWebhooks` to enforce the strct cost calculation for CEL extended libraries. It is strongly recommended to turn on the feature gates as early as possible. ([#124676](https://github.com/kubernetes/kubernetes/pull/124676), [@cici37](https://github.com/cici37)) [SIG API Machinery, Auth, Node and Testing]

    * If you are not switching kube-proxy between different modes, this change should not require any action....