- If upgrading Cluster Federation components from 1.3.x, please ensure your cluster name is a valid DNS label (#30956, @nikhiljindal)

- CCM server will not listen insecurely if secure port is specified ([#68982](https://github.com/kubernetes/kubernetes/pull/68982), [@aruneli](https://github.com/aruneli))

 * address, as shown above, and transmit it in an IPv6 packet header. However, Java's InetAddress
 * creation methods appear to adhere doggedly to the original intent of the "mapped" address: all
 * "mapped" addresses return {@link Inet4Address} objects.
 *
 * <p>For added safety, it is common for IPv6 network operators to filter all packets where either

* Allow kube- and cloud-controller-manager to listen on ports up to 65535. ([#65860](https://github.com/kubernetes/kubernetes/pull/65860), [@sttts](https://github.com/sttts))
* Allow kube-scheduler to listen on ports up to 65535. ([#65833](https://github.com/kubernetes/kubernetes/pull/65833), [@sttts](https://github.com/sttts))

g??y&golonys,srab,??a&g?n!.&reh.togrof,sih.togrof,???em?irp?orhc?w??n!goloc?i&lno!.&egats-oree,oree,redliubetisbew,ysrab,??w??o!.ecivres,hp?latipac?ts&der?e&gdirb?rif???z!.&amil,tikcats,???ruoblem??om?p!.&bog?gro?lim?mo&c?n??ten?ude??irg?yks??r!.&bilten,moc?nac,ossa??a&c!htlaeh??pmoc?wtfos??bc?eh?if?ots!.&e&rawpohs,saberots,?y&flles,srab,???taeht?u&ces?sni?t&inruf?necca??za???s!.&a!disnim321,?b!ibnal?rofmok??c!a??d!b?n&arb?ubroflanummok???e?f?g!ro??h!f??i!trap??k!shf??l?m!oc,t??n!mygskurbrutan??...

      boolean expression,
      /*
       * TODO(cpovirk): Consider removing @Nullable here, as we've done with the other methods'
       * errorMessageTemplate parameters: It is unlikely that callers intend for their string
       * template to be null (though we do handle that case gracefully at runtime). I've left this
       * one as it is because one of our users has defined a wrapper API around Preconditions,

- github.com/go-kit/log: [v0.1.0](https://github.com/go-kit/log/tree/v0.1.0)
- github.com/gofrs/uuid: [v4.0.0+incompatible](https://github.com/gofrs/uuid/tree/v4.0.0)
- github.com/josharian/intern: [v1.0.0](https://github.com/josharian/intern/tree/v1.0.0)
- github.com/jpillora/backoff: [v1.0.0](https://github.com/jpillora/backoff/tree/v1.0.0)
- github.com/nxadm/tail: [v1.4.4](https://github.com/nxadm/tail/tree/v1.4.4)

- Communication between the etcd server and kube-apiserver on master is now overridden to use HTTPS instead of HTTP when mTLS is enabled in GCE. ([#74690](https://github.com/kubernetes/kubernetes/pull/74690), [@wenjiaswe](htt...

- This PR sets the --cluster-dns flag value to kube-dns service IP whether or not NodeLocal DNSCache is enabled. NodeLocal DNSCache will listen on both the link-local as well as the service IP. ([#84383](https://github.com/kubernetes/kubernetes/pull/84383), [@prameshj](https://github.com/prameshj))
- kube-dns add-on:

- Add --permit-address-sharing flag to `kube-apiserver` to listen with `SO_REUSEADDR`. While allowing to listen on wildcard IPs like 0.0.0.0 and specific IPs in parallel, it avoids waiting for the kernel to release socket in `TIME_WAIT` state, and hence, considerably reducing `kube-apiserver` restart times under certain conditions. (...