A previous release built hyperkube using the debian-hyperkube-base@v1.0.0,
    which was updated to address a CVE in the CNI plugins.
    
    A side-effect of using this new image was that the networking packages
    (namely `iptables`) drifted from the versions used in the kube-proxy images.
  
    The following issues were filed on kube-proxy failures when using hyperkube:

* kube-apiserver: the `Priority` admission plugin is now enabled by default when using `--enable-admission-plugins`. If using `--admission-control` to fully specify the set of admission plugins, the `Priority` admission...

- The Daemonset controller creates replacements for terminal Pods, which can appear during VM preemptions or when using Pod finalizers. ([#118716](https://github.com/kubernetes/kubernetes/pull/118716), [@alculquicondor](https://github.com/alculquicondor))

    private final String toString;

    protected Stimulus(String toString) {
      this.toString = toString;
    }

    /**
     * Send this stimulus to both iterators and return normally only if both produce the same
     * response.
     */
    abstract void executeAndCompare(ListIterator<E> reference, T target);

    @Override
    public String toString() {
      return toString;

   * reconstructed using public factory methods. This ensures that the implementation types remain
   * as implementation details.
   *
   * <p>Since the bimap is immutable, ImmutableBiMap doesn't require special logic for keeping the
   * bimap and its inverse in sync during serialization, the way AbstractBiMap does.
   */
  @J2ktIncompatible // serialization

- OIDC authentication will now fail if the username asserted based on a CEL expression config is the empty string.  Previously the request would be authenticated with the username set to the empty string. ([#123568](https://github.com/kubernetes/kubernetes/pull/123568), [@enj](https://github.com/enj))

                super.parseProjectProperties(propFile.toPath());
            }

            @Override
            public File createTempFile(String prefix, String suffix) {
                try {
                    File tempFile = File.createTempFile(prefix, suffix);
                    tempFile.deleteOnExit();
                    return tempFile;

        // Then
        assertTrue(response instanceof ServerMessageBlock2Response);
        assertTrue(response instanceof ServerMessageBlock2);
    }

    @Test
    @DisplayName("Should not modify buffer during write operation")
    void testWriteDoesNotModifyBuffer() {
        // Given
        byte[] buffer = new byte[256];
        // Fill buffer with test pattern
        for (int i = 0; i < buffer.length; i++) {

* Add a SSHKey sync check to the master's healthz (when using SSHTunnels). ([#23167](https://github.com/kubernetes/kubernetes/pull/23167), [@cjcullen](https://github.com/cjcullen))
* Validate minimum CPU limits to be >= 10m ([#23143](https://github.com/kubernetes/kubernetes/pull/23143), [@vishh](https://github.com/vishh))

	})
	return setRestoreHeaderFn(oi, err)
}

// DecomTieredObject - moves tiered object to another pool during decommissioning.
func (er erasureObjects) DecomTieredObject(ctx context.Context, bucket, object string, fi FileInfo, opts ObjectOptions) error {
	if opts.UserDefined == nil {
		opts.UserDefined = make(map[string]string)
	}
	// overlay Erasure info for this set of disks
	storageDisks := er.getDisks()