### Deploy a more secure control plane with kubeadm

A new alpha feature allows running the kubeadm control plane components as non-root users. This is a long requested security measure in kubeadm. To try it you must enable the kubeadm-specific `RootlessControlPlane` feature gate. When you deploy a cluster using this alpha feature, your control plane runs with lower privileges.

intellectual property infringement. In order to qualify, an Indemnified
Contributor must: a) promptly notify the Commercial Contributor in
writing of such claim, and b) allow the Commercial Contributor to control,
and cooperate with the Commercial Contributor in, the defense and any
related settlement negotiations. The Indemnified Contributor may
participate in any such claim at its own expense.

    - [kubeadm](#kubeadm-1)
    - [Other Deprecations](#other-deprecations)
  - [Changes to API Resources](#changes-to-api-resources)
    - [ABAC](#abac)
    - [Admission Control](#admission-control)
    - [Authentication](#authentication)
    - [Authorization](#authorization)
    - [Autoscaling](#autoscaling-1)
    - [Certificates](#certificates)
    - [ConfigMap](#configmap)

    private DocMetaCQ docMetaCQ;

    // ===================================================================================
    //                                                                             Control
    //                                                                             =======
    public DocMetaCQ docMeta() {
        if (docMetaCQ == null) {
            docMetaCQ = new DocMetaCQ();
        }

    private DocMetaCQ docMetaCQ;

    // ===================================================================================
    //                                                                             Control
    //                                                                             =======
    public DocMetaCQ docMeta() {
        if (docMetaCQ == null) {
            docMetaCQ = new DocMetaCQ();
        }

  - Make "kubeadm upgrade apply" add the "node-role.kubernetes.io/control-plane" label on existing nodes that only have the "node-role.kubernetes.io/master" label during upgrade.
  - Please adapt your tooling built on top of kubeadm to use the "node-role.kubernetes.io/control-plane" label.
  - The taint applied to control-plane nodes "node-role.kubernetes.io/master:NoSchedule" is now deprecated and will be removed in a future release after a GA deprecation period.

        assertNotNull(exception);
        assertNull(exception.getMessage());
        assertNull(exception.getCause());
    }

    /**
     * Test protected constructor with suppression and stack trace control
     */
    public void test_protectedConstructor_withSuppressionAndStackTrace() throws Exception {
        // Access protected constructor via reflection
        Constructor<CrawlerSystemException> constructor =

- kubeadm: Promoted the feature gate `ControlPlaneKubeletLocalMode` to Beta. By default, kubeadm will use the local kube-apiserver endpoint for the kubelet when creating a cluster with `kubeadm init` or when joining control plane nodes with `kubeadm join`. Enabling the feature gate also affects...

    *   Deprecate `tf.contrib.learn`. Please check contrib/learn/README.md for
        instructions on how to convert existing code.
    *   `tf.contrib.data`
    *   Remove deprecated `tf.contrib.data.Dataset`, `tf.contrib.data.Iterator`,
        `tf.contrib.data.FixedLengthRecordDataset`,
        `tf.contrib.data.TextLineDataset`, and `tf.contrib.data.TFRecordDataset`
        classes.

`kubeadm` (N-3). This aligns with the recent change made by SIG Architecture that extends the support skew between the control plane and kubelets. Tolerate this new kubelet skew for the commands `init`, `join` and `upgrade`. Note that if the `kubeadm` user applies a control plane version that is older than the `kubeadm` version (N-1 maximum) then the skew between the kubelet and control plane would become a maximum of N-2. ([#120825](https://github.com/kubernetes/kubernetes/pull/120825), [@pacoxu](h...