HTTPStatusCode: http.StatusForbidden,
	},
	ErrAdminResourceInvalidArgument: {
		Code:           "XMinioInvalidResource",
		Description:    "Policy, user or group names are not allowed to begin or end with space characters",
		HTTPStatusCode: http.StatusBadRequest,
	},
	ErrAdminAccountNotEligible: {
		Code:           "XMinioInvalidIAMCredentials",

## Changelog since v1.7.0-alpha.3

### Action Required

* `kubectl create role` and `kubectl create clusterrole` no longer allow specifying multiple resource names as comma-separated arguments. Use repeated `--resource-name` arguments to specify multiple resource names.  ([#44950](https://github.com/kubernetes/kubernetes/pull/44950), [@xilabao](https://github.com/xilabao))

### Other notable changes

	letterIdxMask = 1<<letterIdxBits - 1 // All 1-bits, as many as letterIdxBits
	letterIdxMax  = 63 / letterIdxBits   // # of letter indices fitting in 63 bits
)

// Random number state.
// We generate random temporary file names so that there's a good
// chance the file doesn't exist yet.
var (
	randN  uint32
	randmu sync.Mutex
)

// Temp files created in default Tmp dir
var globalTestTmpDir = os.TempDir()

`--encryption-provider-config` file is now loaded with strict deserialization, which fails if the config file contains duplicate or unknown fields. This protects against accidentally running with config files that are malformed, mis-indented, or have typos in field names, and getting unexpected behavior. When `--encryption-provider-config-automatic-reload` is used, new encryption config files that contain typos after the kube-apiserver is running are treated as invalid and the last valid config is used. ([#124912]...

pkg go/types, method (*Scope) Len() int
pkg go/types, method (*Scope) Lookup(string) Object
pkg go/types, method (*Scope) LookupParent(string, token.Pos) (*Scope, Object)
pkg go/types, method (*Scope) Names() []string
pkg go/types, method (*Scope) NumChildren() int
pkg go/types, method (*Scope) Parent() *Scope
pkg go/types, method (*Scope) Pos() token.Pos
pkg go/types, method (*Scope) String() string

`apiserver_webhooks_x509_missing_san_total`. This metric measures a number of connections to webhooks/aggregated API servers that use certificates without Subject Alternative Names. It being non-zero is a warning sign that these connections will stop functioning in the future since Golang is going to deprecate x509 certificate subject Common Names for server hostname verification. ([#95396](https://github.com/kubernetes/kubernetes/pull/95396), [@stlaz](https://github.com/stlaz)) [SIG API Machinery, Auth and...

	RET R0					   // 00005fd6
	RET R6					   // c0005fd6
	RET R27					   // 60035fd6
	RET R30					   // c0035fd6
	RET	foo(SB)

// B/BL/B.cond cases, and canonical names JMP, CALL.
	BL	1(PC)      // CALL 1(PC)
	BL	(R2)       // CALL (R2)
	BL	foo(SB)    // CALL foo(SB)
	BL	bar<>(SB)  // CALL bar<>(SB)
	B	foo(SB)    // JMP foo(SB)
	BEQ	1(PC)
	BEQ	2(PC)
	TBZ	$1, R1, 2(PC)

- Revised scheduling behavior to correctly handle nominated node changes. Trigger rescheduling of pods 
if necessary when pods with nominated node names got deleted or nominated on a different node. ([#129058](https://github.com/kubernetes/kubernetes/pull/129058), [@dom4ha](https://github.com/dom4ha)) [SIG Scheduling, Storage and Testing]

## Changelog since v1.15.6

### Other notable changes

- Fixed an issue where the `vsphere` cloud provider would not trust a certificate if:
  - The issuer of the certificate was unknown (`x509.UnknownAuthorityError`)
  - The requested name did not match the set of authorized names (`x509.HostnameError`)