### Quality of Service for memory resources

*   A new priority function ResourceLimitsPriorityMap (disabled by default and behind alpha feature gate and not part of the scheduler's default priority functions list) that assigns a lowest possible score of 1 to a node that satisfies one or both of input pod's cpu and memory limits, mainly to break ties between nodes with same scores. ([#55906](https://github.com/kubernetes/kubernetes/pull/55906),[ @aveshagarwal](https://g...

- Fixes a regression in the pod binding subresource to honor the `metadata.uid` precondition.
  This allows kube-scheduler to ensure it is assigns node names to the same instances of pods it made scheduling decisions for. ([#116776](https://github.com/kubernetes/kubernetes/pull/116776), [@alculquicondor](https://github.com/alculquicondor)) [SIG API Machinery and Testing]

    - [Node binaries](#node-binaries-13)
  - [Changelog since v1.19.2](#changelog-since-v1192)
  - [Changes by Kind](#changes-by-kind-13)
    - [Feature](#feature-7)
    - [Design](#design)
    - [Bug or Regression](#bug-or-regression-12)
    - [Other (Cleanup or Flake)](#other-cleanup-or-flake-4)
  - [Dependencies](#dependencies-13)
    - [Added](#added-13)
    - [Changed](#changed-13)

		if testCase.metadataGarbage {
			reqV2.Header.Set("X-Amz-Metadata-Directive", "Unknown")
		}

		err = signRequestV2(reqV2, testCase.accessKey, testCase.secretKey)
		if err != nil {
			t.Fatalf("Failed to V2 Sign the HTTP request: %v.", err)
		}
		// Since `apiRouter` satisfies `http.Handler` it has a ServeHTTP to execute the logic of the handler.
		// Call the ServeHTTP to execute the handler.
		apiRouter.ServeHTTP(recV2, reqV2)

(The jury all brightened up again.)

  `Please your Majesty,' said the Knave, `I didn't write it, and
they can't prove I did:  there's no name signed at the end.'

  `If you didn't sign it,' said the King, `that only makes the
matter worse.  You MUST have meant some mischief, or else you'd
have signed your name like an honest man.'

  There was a general clapping of hands at this:  it was the

### Signing Release Artifacts

Release artifacts are [signed](https://github.com/kubernetes/enhancements/issues/3031) using [cosign](https://github.com/sigstore/cosign)
signatures
and there is experimental support for [verifying image signatures](https://kubernetes.io/docs/tasks/administer-cluster/verify-signed-images/).

(The jury all brightened up again.)

  `Please your Majesty,' said the Knave, `I didn't write it, and
they can't prove I did:  there's no name signed at the end.'

  `If you didn't sign it,' said the King, `that only makes the
matter worse.  You MUST have meant some mischief, or else you'd
have signed your name like an honest man.'

  There was a general clapping of hands at this:  it was the

pkg crypto/ed25519, func NewKeyFromSeed([]uint8) PrivateKey
pkg crypto/ed25519, func Sign(PrivateKey, []uint8) []uint8
pkg crypto/ed25519, func Verify(PublicKey, []uint8, []uint8) bool
pkg crypto/ed25519, method (PrivateKey) Public() crypto.PublicKey
pkg crypto/ed25519, method (PrivateKey) Seed() []uint8
pkg crypto/ed25519, method (PrivateKey) Sign(io.Reader, []uint8, crypto.SignerOpts) ([]uint8, error)
pkg crypto/ed25519, type PrivateKey []uint8

  - `--service-account-key-file`, set to one or more files containing one or more public keys used to verify tokens.