- Better detection of installed CRI.
  - Better output for image pull errors.
- Improved air-gapped and offline support
  - kubeadm now handles air-gapped environments by using the local client version as a fallback.
  - Some kubeadm commands are now allowed to work in a completely offline mode.
- Certificate handling improvements:
  - Renew certs as part of upgrade.

append($return, max($value, 0));\n    } @else {\n      $return: append($return, $value);\n    }\n  }\n  @return $return;\n}\n\n@mixin border-radius($radius: $border-radius, $fallback-border-radius: false) {\n  @if $enable-rounded {\n    border-radius: valid-radius($radius);\n  }\n  @else if $fallback-border-radius != false {\n    border-radius: $fallback-border-radius;\n  }\n}\n\n@mixin border-top-radius($radius) {\n  @if $enable-rounded {\n    border-top-left-radius: valid-radius($radius);\n    border-top-right-radius:...

- Kubeadm: remove the deprecated / NO-OP phase `update-cluster-status`...

- Faster mount detection for linux kernel 5.10+ using openat2 speeding up pod churn rates. On Kernel versions less 5.10, it will fallback to using the original way of detecting mount points i.e by parsing /proc/mounts. ([#109217](https://github.com/kubernetes/kubernetes/pull/109217), [@manugupt1](https://github.com/manugupt1))

to invoke the KMA instruction. func BlockKey(c *Block) []byte { return c.key } func encryptBlock(c *Block, dst, src []byte) { if c.fallback != nil { encryptBlockGeneric(c.fallback, dst, src) } else { cryptBlocks(c.function, &c.key[0], &dst[0], &src[0], BlockSize) } } func decryptBlock(c *Block, dst, src []byte) { if c.fallback != nil { decryptBlockGeneric(c.fallback, dst, src) } else { // The decrypt function code is equal to the function code + 128. cryptBlocks(c.function+128, &c.key[0], &dst[0],...

* kube-scheduler now fallbacks to emitting events using core/v1 Events when events.k8s.io/v1beta1 is disabled. ([#83692](https://github.com/kubernetes/kubernetes/pull/83692), [@yastij](https://github.com/yastij))

to invoke the KMA instruction. func BlockKey(c *Block) []byte { return c.key } func encryptBlock(c *Block, dst, src []byte) { if c.fallback != nil { encryptBlockGeneric(c.fallback, dst, src) } else { cryptBlocks(c.function, &c.key[0], &dst[0], &src[0], BlockSize) } } func decryptBlock(c *Block, dst, src []byte) { if c.fallback != nil { decryptBlockGeneric(c.fallback, dst, src) } else { // The decrypt function code is equal to the function code + 128. cryptBlocks(c.function+128, &c.key[0], &dst[0],...

- E2e: tests can now register callbacks with `ginkgo.BeforeEach`, `ginkgo.AfterEach` or `ginkgo.DeferCleanup` directly after creating a framework instance and are guaranteed that their code is called after the framework is initialized and before it gets cleaned up. `ginkgo.DeferCleanup`...

  that provide new subcommands. Refer to the documentation for more information.

- `kubectl rollout` and `rollback` now support StatefulSet.

- `kubectl scale` now uses the Scale subresource for kinds in the apps/v1beta2 group.

- `kubectl create configmap` and `kubectl create secret` subcommands now support

- Bump the KubeletCgroupDriverFromCRI feature gate to beta and true by default. The kubelet will continue to use its KubeletConfiguration field as a fallback if the CRI implementation doesn't support this feature. ([#125828](https://github.com/kubernetes/kubernetes/pull/125828), [@haircommander](https://github.com/haircommander)) [SIG Node]