- Add a `serving` and `terminating` condition to the EndpointSlice API.
  `serving` tracks the readiness of endpoints regardless of their terminating state. This is distinct from `ready` since `ready` is only true when pods are not terminating. 

* [alpha] kops now supports [running as a server](https://github.com/kubernetes/kops/blob/master/docs/api-server/README.md). ([#359](https://github.com/kubernetes/enhancements/issues/359), [@justinsb](https://github.com/justinsb))

    - [Container Images](#container-images-15)
  - [Changelog since v1.28.0](#changelog-since-v1280)
  - [Urgent Upgrade Notes](#urgent-upgrade-notes)
    - [(No, really, you MUST read this before you upgrade)](#no-really-you-must-read-this-before-you-upgrade)
  - [Changes by Kind](#changes-by-kind-15)
    - [Deprecation](#deprecation)
    - [API Change](#api-change-4)
    - [Feature](#feature-11)

This change is what supports the new features, read below. 🤓

### Dependencies with `yield`, `HTTPException` and Background Tasks

Dependencies with `yield` now can raise `HTTPException` and other exceptions after `yield`. 🎉

### CVE-2022-3162: Unauthorized read of Custom Resources

A security issue was discovered in Kubernetes where users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group they are not authorized to read.

**Affected Versions**:
  - kube-apiserver v1.25.0 - v1.25.3

### CVE-2022-3162: Unauthorized read of Custom Resources

A security issue was discovered in Kubernetes where users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group they are not authorized to read.

**Affected Versions**:
  - kube-apiserver v1.25.0 - v1.25.3

pkg debug/dwarf, const TagSkeletonUnit Tag
pkg debug/dwarf, method (*Data) AddSection(string, []uint8) error
pkg debug/dwarf, method (*LineReader) Files() []*LineFile
pkg debug/dwarf, method (*Reader) ByteOrder() binary.ByteOrder
pkg encoding/asn1, const TagBMPString = 30
pkg encoding/asn1, const TagBMPString ideal-int
pkg encoding/json, method (*Decoder) InputOffset() int64
pkg go/build, type Context struct, Dir string

- Containers which specify a `startupProbe` but not a `readinessProbe` were previously considered "ready" before the `startupProbe` completed, but are now considered "not-ready". ([#92196](https://github.com/kubernetes/kubernetes/pull/92196), [@thockin](https://github.com/thockin)) [SIG Node]

  <mime-type type="application/vnd.nokia.pcd+wbxml"/>
  <mime-type type="application/vnd.nokia.pcd+xml"/>
  <mime-type type="application/vnd.nokia.radio-preset">
    <glob pattern="*.rpst"/>
  </mime-type>
  <mime-type type="application/vnd.nokia.radio-presets">
    <glob pattern="*.rpss"/>
  </mime-type>
  <mime-type type="application/vnd.novadigm.edm">
    <glob pattern="*.edm"/>
  </mime-type>

    - [Additional Notable Feature Updates](#additional-notable-feature-updates)
  - [Known Issues](#known-issues)
  - [Urgent Upgrade Notes](#urgent-upgrade-notes)
    - [(No, really, you MUST read this before you upgrade)](#no-really-you-must-read-this-before-you-upgrade)
      - [API Machinery](#api-machinery)
      - [Apps](#apps)
      - [Auth](#auth)
      - [AWS](#aws)
      - [Azure](#azure)
      - [CLI](#cli)