- Pod spread constraints have been added in alpha. You can use these constraints to control how Pods are spread across the cluster among failure-domains. ([#77327](https://github.com/kubernetes/kubernetes/pull/77327), [#77760](https://github.com/kubernetes/kubernetes/pull/77760), [#77828](https://github.com/...

pkg syscall (freebsd-arm64), const CFLUSH ideal-int
pkg syscall (freebsd-arm64), const CLOCAL = 32768
pkg syscall (freebsd-arm64), const CLOCAL ideal-int
pkg syscall (freebsd-arm64), const CREAD = 2048
pkg syscall (freebsd-arm64), const CREAD ideal-int
pkg syscall (freebsd-arm64), const CS5 = 0
pkg syscall (freebsd-arm64), const CS5 ideal-int
pkg syscall (freebsd-arm64), const CS6 = 256
pkg syscall (freebsd-arm64), const CS6 ideal-int

pkg syscall (darwin-arm64), const CFLUSH ideal-int
pkg syscall (darwin-arm64), const CLOCAL = 32768
pkg syscall (darwin-arm64), const CLOCAL ideal-int
pkg syscall (darwin-arm64), const CREAD = 2048
pkg syscall (darwin-arm64), const CREAD ideal-int
pkg syscall (darwin-arm64), const CS5 = 0
pkg syscall (darwin-arm64), const CS5 ideal-int
pkg syscall (darwin-arm64), const CS6 = 256
pkg syscall (darwin-arm64), const CS6 ideal-int

### CVE-2022-3162: Unauthorized read of Custom Resources

A security issue was discovered in Kubernetes where users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group they are not authorized to read.

**Affected Versions**:
  - kube-apiserver v1.25.0 - v1.25.3

pkg syscall (netbsd-arm64-cgo), const CLONE_VM = 256
pkg syscall (netbsd-arm64-cgo), const CLONE_VM ideal-int
pkg syscall (netbsd-arm64-cgo), const CREAD = 2048
pkg syscall (netbsd-arm64-cgo), const CREAD ideal-int
pkg syscall (netbsd-arm64-cgo), const CS5 = 0
pkg syscall (netbsd-arm64-cgo), const CS5 ideal-int
pkg syscall (netbsd-arm64-cgo), const CS6 = 256

- `readOnly` volumes now support recursive read-only mounts for kernel versions >= 5.12."
   ([#123180](https://github.com/kubernetes/kubernetes/pull/123180), [@AkihiroSuda](https://github.com/AkihiroSuda))
- cri-api: Implemented KEP-3857: Recursive Read-only (RRO) mounts.

    - [Container Images](#container-images-2)
  - [Changelog since v1.30.0](#changelog-since-v1300)
  - [Urgent Upgrade Notes](#urgent-upgrade-notes)
    - [(No, really, you MUST read this before you upgrade)](#no-really-you-must-read-this-before-you-upgrade)
  - [Changes by Kind](#changes-by-kind-2)
    - [Deprecation](#deprecation-1)
    - [API Change](#api-change-1)
    - [Feature](#feature-2)
    - [Failing Test](#failing-test)

### CVE-2022-3162: Unauthorized read of Custom Resources

A security issue was discovered in Kubernetes where users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group they are not authorized to read.

**Affected Versions**:
  - kube-apiserver v1.25.0 - v1.25.3

#### [alpha] Federated Jobs

Federated Jobs that are automatically deployed to multiple clusters
are now supported. Cluster selection and weighting determine how Job
parallelism and completions are spread across clusters. Federated Job
status reflects the aggregate status across all underlying cluster
jobs.

#### [alpha] Federated Horizontal Pod Autoscaling (HPA)

### **API Machinery**

*   The kube-apiserver `--etcd-quorum-read` flag is deprecated and the ability to switch off quorum read will be removed in a future release. ([#53795](https://github.com/kubernetes/kubernetes/pull/53795),[ @xiangpengzhao](https://github.com/xiangpengzhao))