- Introduced new kubelet metrics for the Ensure Secret Pulled Images KEP, including:
      - `kubelet_imagemanager_ondisk_pullintents` for tracking pull intent records on disk
      - `kubelet_imagemanager_ondisk_pulledrecords` for tracking pulled image records on disk

- Kubeadm: fixed a bug where an image is not pulled if there is an error with the sandbox image from CRI. ([#129607](https://github.com/kubernetes/kubernetes/pull/129607), [@neol...

	if err != nil {
		writeErrorResponse(ctx, w, toAPIError(ctx, err), r.URL)
		return
	}

	objTags := srcInfo.UserTags
	// If x-amz-tagging-directive header is REPLACE, get passed tags.
	if isDirectiveReplace(r.Header.Get(xhttp.AmzTagDirective)) {
		objTags = r.Header.Get(xhttp.AmzObjectTagging)
		if _, err := tags.ParseObjectTags(objTags); err != nil {

significantly. Instead of hard-coding the parameters for the kubelet in the dropin, a structured configuration file for the kubelet is used, and is expected to be present in `/var/lib/kubelet/config.yaml`. For runtime-detected, instance-specific configuration values, a environment file with dynamically-generated flags at `kubeadm init` or `kubeadm join` run time is used. Finally, if you want to override something specific for the kubelet that can't be done via the kubeadm Configuration file (which is...

plugin and the `kubernetes.io/enforce-mountable-secrets` annotation are used together with ephemeral containers.

**Note**: This only impacts the cluster if the ServiceAccount admission plugin is used (most cluster should have this on by default as recommended in https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#serviceaccount), the `kubernetes.io/enforce-mountable-secrets` annotation is used by a service account (this annotation is not added by default), and...

            Indicates the dependency is optional for use of this library. While the
            version of the dependency will be taken into account for dependency calculation if the
            library is used elsewhere, it will not be passed on transitively. Note: While the type
            of this field is {@code String} for technical reasons, the semantic type is actually
            {@code Boolean}. Default value is {@code false}.

- Kubeadm: fixed a bug where an image is not pulled if there is an error with the sandbox image from CRI. ([#129608](https://github.com/kubernetes/kubernetes/pull/129608), [@neolit123](https://github.com/neolit123)) [SIG Cluster Lifecycle]

1F62D         ; valid                  ;      ; NV8    # 6.0  LOUDLY CRYING FACE
1F62E..1F62F  ; valid                  ;      ; NV8    # 6.1  FACE WITH OPEN MOUTH..HUSHED FACE
1F630..1F633  ; valid                  ;      ; NV8    # 6.0  FACE WITH OPEN MOUTH AND COLD SWEAT..FLUSHED FACE
1F634         ; valid                  ;      ; NV8    # 6.1  SLEEPING FACE
1F635..1F640  ; valid                  ;      ; NV8    # 6.0  DIZZY FACE..WEARY CAT FACE

- Introduces a new GCE specific cluster creation variable KUBE_PROXY_DISABLE. When set to true, this will skip over the creation of kube-proxy (whether the daemonset or static pod). This can be used to control the lifecycle of kube-proxy separately from the lifecycle...

* ACTION REQUIRED: Azure cloud provider could now be configured by Kubernetes secrets and a...