* The audit log file defaults to JSON encoding when using the advanced auditing feature gate.
  * An audit policy file without either an `apiVersion` or a `kind` field may be treated as invalid.
  * The webhook and log file now output the `v1beta1` event format.

    For more details, see [Advanced audit](https://kubernetes.io/docs/tasks/debug-application-cluster/audit/#advanced-audit).

        .Builder()
        .heldCertificate(heldCertificate)
        .addTrustedCertificate(heldCertificate.certificate)
        .build()

    // Use that certificate on the server and trust it on the client.
    server.useHttps(handshakeCertificates.sslSocketFactory())
    client =
      client
        .newBuilder()
        .sslSocketFactory(
          handshakeCertificates.sslSocketFactory(),

- The `storageVersionHash` feature is now beta. `StorageVersionHash` is a field in the discovery document of each resource. It enables clients to detect whether the storage version of that resource has changed. Its value must be treated as opaque by clients. Only equality comparison on the value is valid. ([#78325](https://github.com/kubernetes/kubernetes/pull/78325), [@caesarxuchao](https://github.com/caesarxuchao))

* Conformance tests are added for the DaemonSet kinds in the apps/v1 group version. Deprecated versions of DaemonSet will not be tested for conformance, and conformance is only applicable to release 1.10 and later. ([#60456](https://github.com/kubernetes/kubernetes/pull/60456), [@kow3ns](https://github.com/kow3ns))

A security issue was discovered in Kubernetes where users may have access to secure endpoints in the control plane network. Kubernetes clusters are only affected if an untrusted user can to modify Node objects and send requests proxying through them.

trentinsuedtirol.it
trentinsüd-tirol.it
trentinsüdtirol.it
trento.it
treviso.it
trieste.it
troandin.no
trogstad.no
troitsk.su
tromsa.no
tromso.no
tromsø.no
trondheim.no
trust
trv
try-snowplow.com
trycloudflare.com
trysil.no
træna.no
trøgstad.no
ts.it
ts.net
tselinograd.su
tsk.tr
tsu.mie.jp
tsubame.niigata.jp
tsubata.ishikawa.jp

- Slow container runtime initialization no longer causes the System WatchDog to kill the kubelet. The Device Manager was treated as unhealthy until it began listening on its port. ([#135153](https://github.com/kubernetes/kubernetes/pull/135153), [@SergeyKanzhelev](https://github.com/SergeyKanzhelev))

- Updated the control plane's trust anchor publisher to create and manage a new ClusterTrustBundle object, associated with the `kubernetes.io/kube-apiserver-serving` X.509 certificate signer. This ClusterTrustBundle contains a PEM bundle in its payload that you can use to verify kube-apiserver...

* Mirror pods must now indicate the nodeName they are bound to on creation. The mirror pod annotation is now treated as immutable and cannot be added to an existing pod, removed from a pod, or modified. ([#45775](https://github.com/kubernetes/kubernetes/pull/45775), [@liggitt](https://github.com/liggitt))

trentinsuedtirol.it
trentinsüd-tirol.it
trentinsüdtirol.it
trento.it
treviso.it
trieste.it
troandin.no
trogstad.no
troitsk.su
tromsa.no
tromso.no
tromsø.no
trondheim.no
trust
trv
try-snowplow.com
trycloudflare.com
trysil.no
træna.no
trøgstad.no
ts.it
ts.net
tselinograd.su
tsk.tr
tsu.mie.jp
tsubame.niigata.jp
tsubata.ishikawa.jp