pkg crypto/tls, const TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 = 52393
pkg crypto/tls, const TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 uint16
pkg crypto/tls, const TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 = 52392
pkg crypto/tls, const TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 uint16
pkg crypto/tls, func CipherSuiteName(uint16) string
pkg crypto/tls, func CipherSuites() []*CipherSuite
pkg crypto/tls, func InsecureCipherSuites() []*CipherSuite

- TLS Server Name overrides can now be specified in a kubeconfig file and via --tls-server-name in kubectl ([#88769](https://github.com/kubernetes/kubernetes/pull/88769), [@deads2k](https://github.com/deads2k)) [SIG API Machinery, Auth and CLI]

#### Metrics:

pkg crypto/cipher, func NewGCMWithTagSize(Block, int) (AEAD, error)
pkg crypto/rsa, method (*PrivateKey) Size() int
pkg crypto/rsa, method (*PublicKey) Size() int
pkg crypto/tls, method (*ConnectionState) ExportKeyingMaterial(string, []uint8, int) ([]uint8, error)
pkg database/sql, method (IsolationLevel) String() string
pkg database/sql, type DBStats struct, Idle int
pkg database/sql, type DBStats struct, InUse int

- Kubeadm increased to 5 minutes its timeout for the TLS bootstrapping process to complete upon join ([#89735](https://github.com/kubernetes/kubernetes/pull/89735), [@rosti](https://github.com/rosti)) [SIG Cluster Lifecycle]
- hyperkube: Use debian-hyperkube-base@v1.1.0 image
  

pkg crypto/tls, type ConnectionState struct, TLSUnique //deprecated
pkg debug/elf, const R_PPC64_SECTOFF_LO_DS = 61
pkg encoding/json, method (*RawMessage) MarshalJSON() ([]uint8, error)

  * Add `kubectl rollout status`
* Security/Auth
  * L7 LB controller and disk attach controllers run on master, so nodes do not need those privileges.
  * Setting TLS1.2 minimum
  * `kubectl create secret tls` command
  * Webhook Token Authenticator
  * **beta** PodSecurityPolicy objects limits use of security-sensitive features by pods.
* Kubectl
  * Display line number on JSON errors
  * Add flag -t as shorthand for --tty

      labels:
        app: metallb
        component: controller
    spec:
      containers:
      - args:
        - --port=7472
        - --log-level=info
        - --tls-min-version=VersionTLS12
        env:
        - name: METALLB_ML_SECRET_NAME
          value: memberlist
        - name: METALLB_DEPLOYMENT
          value: controller

### kubeadm
* **[beta]** Introduces an API for clients to request TLS certificates from the API server. See the [tutorial](https://kubernetes.io/docs/tasks/tls/managing-tls-in-a-cluster).

- kube-controller-manager currently needs a writable `--cert-dir` (default is `/var/run/kubernetes`) for generating self-signed certificates, when no `--tls-cert-file` or `--tls-private-key-file` are provided.

- github.com/mesos/mesos-go: [v0.0.9](https://github.com/mesos/mesos-go/tree/v0.0.9)
- github.com/mitchellh/go-ps: [4fdf99a](https://github.com/mitchellh/go-ps/tree/4fdf99a)
- github.com/mozilla/tls-observatory: [8791a20](https://github.com/mozilla/tls-observatory/tree/8791a20)
- github.com/nbutton23/zxcvbn-go: [eafdab6](https://github.com/nbutton23/zxcvbn-go/tree/eafdab6)