* Fixes an issue where the resourceVersion of an object in a DELETE watch event was not the resourceVersion of the delete itself, but of the last update to the object. This could disrupt the ability of clients clients to re-establish watches properly. ([#58547](https://github.com/kubernetes/kubernetes/pull/58547), [@liggitt](https://github.com/liggitt))

* Fixes an issue where the resourceVersion of an object in a DELETE watch event was not the resourceVersion of the delete itself, but of the last update to the object. This could disrupt the ability of clients clients to re-establish watches properly. ([#58547](https://github.com/kubernetes/kubernetes/pull/58547), [@liggitt](https://github.com/liggitt))

* Fixes an issue where the resourceVersion of an object in a DELETE watch event was not the resourceVersion of the delete itself, but of the last update to the object. This could disrupt the ability of clients clients to re-establish watches properly. ([#58547](https://github.com/kubernetes/kubernetes/pull/58547), [@liggitt](https://github.com/liggitt))

Kubernetes clusters are only affected if an untrusted user can to modify Node objects and send requests proxying through them.

Kubernetes supports node proxying, which allows clients of kube-apiserver to access endpoints of a Kubelet to establish connections to Pods, retrieve container logs, and more. While Kubernetes already validates the proxying address for Nodes, a bug in kube-apiserver made it possible to bypass this validation. Bypassing this validation could allow authenticated requests...

Kubernetes clusters are only affected if an untrusted user can to modify Node objects and send requests proxying through them.

Kubernetes supports node proxying, which allows clients of kube-apiserver to access endpoints of a Kubelet to establish connections to Pods, retrieve container logs, and more. While Kubernetes already validates the proxying address for Nodes, a bug in kube-apiserver made it possible to bypass this validation. Bypassing this validation could allow authenticated requests...

Kubernetes clusters are only affected if an untrusted user can to modify Node objects and send requests proxying through them.

Kubernetes supports node proxying, which allows clients of kube-apiserver to access endpoints of a Kubelet to establish connections to Pods, retrieve container logs, and more. While Kubernetes already validates the proxying address for Nodes, a bug in kube-apiserver made it possible to bypass this validation. Bypassing this validation could allow authenticated requests...

Kubernetes clusters are only affected if an untrusted user can to modify Node objects and send requests proxying through them.

Kubernetes supports node proxying, which allows clients of kube-apiserver to access endpoints of a Kubelet to establish connections to Pods, retrieve container logs, and more. While Kubernetes already validates the proxying address for Nodes, a bug in kube-apiserver made it possible to bypass this validation. Bypassing this validation could allow authenticated requests...

        private byte[] signingKey;
        private boolean established;
        private String nbName;
        private ASN1ObjectIdentifier[] supportedMechs;
        private int flags;
        private boolean integrity;
        private boolean disposed;

        DummySSPContext(byte[] signingKey, boolean established, String nbName, ASN1ObjectIdentifier[] supportedMechs, int flags,

            log.debug("TCP RDMA connection established to {}", remoteAddress);

        } catch (IOException e) {
            state = RdmaConnectionState.ERROR;
            throw new IOException("TCP RDMA connection failed", e);
        }
    }

    @Override
    public void send(ByteBuffer data, RdmaMemoryRegion region) throws IOException {
        if (state != RdmaConnectionState.ESTABLISHED && state != RdmaConnectionState.CONNECTED) {

    void testStateTransitions() {
        assertEquals(ChannelState.DISCONNECTED, channelInfo.getState());
        assertFalse(channelInfo.isHealthy());

        channelInfo.setState(ChannelState.ESTABLISHED);
        assertEquals(ChannelState.ESTABLISHED, channelInfo.getState());
        assertTrue(channelInfo.isHealthy());

        channelInfo.setState(ChannelState.ACTIVE);
        assertTrue(channelInfo.isHealthy());