- Fixed a bug in `kube-proxy` `nftables` mode (GA as of `v1.33`) which fails to determine if traffic originates from a local source on the node. The issue was caused by using the wrong meta `iif` instead of `iifname` for name based matches. ([#134024](https://github.com/kubernetes/kubernetes/pull/134024), [@jack4it](https://github.com/jack4it))

    to strings.
*   Add `string_to_index_table`, which returns a lookup table that matches
    strings to indices.
*   Add a `ParallelForWithWorkerId` function.
*   Add `string_to_index_table`, which returns a lookup table that matches
    strings to indices.
*   Support restore session from checkpoint files in v2 in
    `contrib/session_bundle`.

	public fun equals (Ljava/lang/Object;)Z
	public final fun expiresAt ()J
	public fun hashCode ()I
	public final fun hostOnly ()Z
	public final fun httpOnly ()Z
	public final fun matches (Lokhttp3/HttpUrl;)Z
	public final fun name ()Ljava/lang/String;
	public final fun newBuilder ()Lokhttp3/Cookie$Builder;
	public static final fun parse (Lokhttp3/HttpUrl;Ljava/lang/String;)Lokhttp3/Cookie;

### Bug or Regression

- EndpointSlice IP validation now matches Endpoints IP validation. ([#101084](https://github.com/kubernetes/kubernetes/pull/101084), [@robscott](https://github.com/robscott)) [SIG Apps and Network]

		writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrAddUserInvalidArgument), r.URL)
		return
	}

	if (cred.IsTemp() || cred.IsServiceAccount()) && cred.ParentUser == accessKey {
		// Incoming access key matches parent user then we should
		// reject password change requests.
		writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrAddUserInvalidArgument), r.URL)
		return
	}

* Audit policy supports matching subresources and resource names, but the top level resource no longer matches the subresouce. For example "pods" no longer matches requests to the logs subresource of pods. Use "pods/logs" to match subresources. ([#48836](https://github.com/kubernetes/kubernetes/pull/48836), [@ericchiang](https://github.com/ericchiang))

One of the integer part or the fractional part may be elided; the radix point may be elided as well,
but the exponent part is required. (This syntax matches the one given in IEEE 754-2008 §5.12.3.)
An exponent value exp scales the mantissa (integer and fractional part) by 2<sup>exp</sup>
[<a href="#Go_1.13">Go 1.13</a>].
</p>

<p>

- Fixed a bug in kube-proxy nftables mode (GA as of 1.33) that fails to determine if traffic originates from a local source on the node. The issue was caused by using the wrong meta `iif` instead of `iifname` for name based matches. ([#134118](https://github.com/kubernetes/kubernetes/pull/134118), [@jack4it](https://github.com/jack4it)) [SIG Network]

*.my.canva.site
*.my.canvasite.cn
*.nagoya.jp
*.nodebalancer.linode.com
*.nom.br
*.northflank.app
*.np
*.oci.customer-oci.com
*.ocp.customer-oci.com
*.ocs.customer-oci.com
*.on-acorn.io
*.on-k3s.io
*.on-rancher.cloud
*.on-rio.io
*.oraclecloudapps.com
*.oraclegovcloudapps.com
*.oraclegovcloudapps.uk
*.otap.co
*.owo.codes
*.paywhirl.com
*.pg
*.platformsh.site
*.private.repost.aws

* Adding ImagePolicyWebhook admission controller. ([#30631](https://github.com/kubernetes/kubernetes/pull/30631), [@ecordell](https://github.com/ecordell))
* Validate involvedObject.Namespace matches event.Namespace ([#30533](https://github.com/kubernetes/kubernetes/pull/30533), [@liggitt](https://github.com/liggitt))