- Bind metadata-agent containers to linux nodes to avoid Windows scheduling on kubernetes cluster includes linux nodes and windows nodes ([#83363](https://github.com/kubernetes/kubernetes/pull/83363), [@wawa0210](https://github.com/wawa0210)) [SIG Cluster Lifecycle, Instrumentation and Windows]

* Add iptables rules to allow Pod traffic even when default iptables policy is to reject. ([#52569](https://github.com/kubernetes/kubernetes/pull/52569), [@tmjd](https://github.com/tmjd))

no-ip.co.uk
no-ip.info
no-ip.net
no-ip.org
no.eu.org
no.it
nobeoka.miyazaki.jp
noboribetsu.hokkaido.jp
nobushi.jp
noda.chiba.jp
noda.iwate.jp
nodes.k8s.fr-par.scw.cloud
nodes.k8s.nl-ams.scw.cloud
nodes.k8s.pl-waw.scw.cloud
nog.community
nogata.fukuoka.jp
nogi.tochigi.jp
noheji.aomori.jp
noho.st
nohost.me
noip.me
noip.us
nokia
nom.ag
nom.co

<!-- BEGIN MUNGE: GENERATED_TOC -->

- [v1.34.0](#v1340)
  - [Downloads for v1.34.0](#downloads-for-v1340)
    - [Source Code](#source-code)
    - [Client Binaries](#client-binaries)
    - [Server Binaries](#server-binaries)
    - [Node Binaries](#node-binaries)
    - [Container Images](#container-images)
  - [Changelog since v1.33.0](#changelog-since-v1330)
  - [Urgent Upgrade Notes](#urgent-upgrade-notes)

  // Graph copy methods

  /**
   * Returns the subgraph of {@code graph} induced by {@code nodes}. This subgraph is a new graph
   * that contains all of the nodes in {@code nodes}, and all of the {@link Graph#edges() edges}
   * from {@code graph} for which both nodes are contained by {@code nodes}.
   *
   * @throws IllegalArgumentException if any element in {@code nodes} is not a node in the graph
   */

  // Graph copy methods

  /**
   * Returns the subgraph of {@code graph} induced by {@code nodes}. This subgraph is a new graph
   * that contains all of the nodes in {@code nodes}, and all of the {@link Graph#edges() edges}
   * from {@code graph} for which both nodes are contained by {@code nodes}.
   *
   * @throws IllegalArgumentException if any element in {@code nodes} is not a node in the graph
   */

more. While Kubernetes already validates the proxying address for Nodes, a bug in kube-apiserver made it possible to bypass this validation. Bypassing this validation could allow authenticated requests destined for Nodes to be redirected to the API Server through its private network.

The merged fix enforces validation against the proxying address for a Node. In some cases, the fix can break clients that depend on the `nodes/proxy` subresource, specifically if a kubelet advertises a localhost...

  - [Important Security Information](#important-security-information-2)
    - [CVE-2024-9042: Command Injection affecting Windows nodes via nodes/*/logs/query API](#cve-2024-9042-command-injection-affecting-windows-nodes-via-nodeslogsquery-api)
  - [Changes by Kind](#changes-by-kind-7)
    - [API Change](#api-change)
    - [Feature](#feature-4)
    - [Bug or Regression](#bug-or-regression-7)
  - [Dependencies](#dependencies-7)

  @Override
  @Test
  public void nodes_checkReturnedSetMutability() {
    assume().that(graphIsMutable()).isTrue();

    Set<Integer> nodes = graph.nodes();
    assertThrows(UnsupportedOperationException.class, () -> nodes.add(N2));
    addNode(N1);
    assertThat(graph.nodes()).containsExactlyElementsIn(nodes);
  }

  @Override
  @Test
  public void adjacentNodes_checkReturnedSetMutability() {

  val tagClass: Int,
  /** The tag this adapter expects, or -1 to match any tag. */
  val tag: Long,
  /** Encode and decode the value once tags are handled. */
  private val codec: Codec<T>,
  /** True if the default value should be used if this value is absent during decoding. */
  val isOptional: Boolean = false,
  /** The value to return if this value is absent. Undefined unless this is optional. */