### Pod resource metrics

On-demand metrics calculation is now available through `/metrics/resources`. [When enabled](
https://docs.k8s.io/concepts/cluster-administration/system-metrics#kube-scheduler-metrics), the endpoint will report the requested resources and the desired limits of all running pods.

### Introducing `RootCAConfigMap`

This release contains changes that address the following vulnerabilities:

### CVE-2022-3162: Unauthorized read of Custom Resources

A security issue was discovered in Kubernetes where users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group they are not authorized to read.

**Affected Versions**:
  - kube-apiserver v1.25.0 - v1.25.3

  // without the reference to unlimited queues.
  /**
   * Returns the number of additional elements that this queue can ideally (in the absence of memory
   * or resource constraints) accept without blocking. This is always equal to the initial capacity
   * of this queue less the current {@code size} of this queue.
   *

    private static final Pattern EMAIL_ADDRESS_PATTERN =
            Pattern.compile("[A-Z0-9._%+-]+@[A-Z0-9.-]+\\.[A-Z]{2,6}", Pattern.CASE_INSENSITIVE);

    /**
     * Cache for storing resource file modification timestamps to enable cache busting.
     * The cache expires after 10 minutes and has a maximum size of 1000 entries.
     */
    private static LoadingCache<String, Long> resourceHashCache =

```
{
  "version": "2012-10-17",
  "statement": [
    {
      "effect": "Allow",
      "action": [
        "s3:ListAllMyBuckets"
      ],
      "resource": [
        "arn:aws:s3:::*"
      ]
    }
  ]
}
```

## Authorization Flow

You could need to tell the client that:

* The client doesn't have enough privileges for that operation.
* The client doesn't have access to that resource.
* The item the client was trying to access doesn't exist.
* etc.

In these cases, you would normally return an **HTTP status code** in the range of **400** (from 400 to 499).

            final AcknowledgedResponse putMappingResponse = fesenClient.get(c -> {
                final String source = FileUtil.readText("mapping/" + mappingName + ".json");
                return c.admin().indices().preparePutMapping(index).setSource(source, XContentType.JSON).execute();
            });
            if (putMappingResponse.isAcknowledged()) {

- Kube-scheduler now retries scheduling Pods rejected by the PodTopologySpread plugin...

        this.maxReadSize = SMBUtil.readInt4(buffer, bufferIndex + 4);
        this.maxWriteSize = SMBUtil.readInt4(buffer, bufferIndex + 8);

        // Validate reasonable buffer sizes to prevent resource exhaustion
        if (this.maxTransactSize < 0 || this.maxTransactSize > 16777216) { // 16MB max
            throw new SMBProtocolDecodingException("Invalid maxTransactSize: " + this.maxTransactSize + " (must be 0-16777216)");

## Overview

Replication relies on immutability provided by versioning to sync objects between the configured source and replication target. Replication results in the object data, metadata, last modification time and version ID all being identical between the source and target. Thus version ordering is automatically guaranteed on the source and target clusters.

### Replication of object version and metadata