- KMS Providers will install a healthz check for the status of kms-plugin in kube-apiservers' encryption config. ([#78540](https://github.com/kubernetes/kubernetes/pull/78540), [@immutableT](https://github.com/immutableT))

KubeProxyConfiguration After:

```
apiVersion: kubeproxy.config.k8s.io/v1alpha1
kind: KubeProxyConfiguration
**featureGates:**
**  SupportIPVSProxyMode: true**
```

If your cluster was installed by kubeadm, you should edit the `featureGates` field in the `kubeadm-config` ConfigMap. You can do this using `kubectl -n kube-system edit cm kubeadm-config` before upgrading. For example:

kubeadm-config Before:

```

DeliverEngine { public void DeliverEngine(); } org/apache/ivy/core/publish/PublishEngine.class package org.apache.ivy.core.publish; public final synchronized class PublishEngine { public void PublishEngine(); } org/apache/ivy/core/install/InstallEngine.class package org.apache.ivy.core.install; public final synchronized class InstallEngine { public void InstallEngine(); } org/apache/ivy/core/retrieve/RetrieveEngine$1.class package org.apache.ivy.core.retrieve; final synchronized class RetrieveEngine$1 implements...

</p>

<p>
The interpretation of the ImportPath is implementation-dependent but
it is typically a substring of the full file name of the compiled
package and may be relative to a repository of installed packages.
</p>

<p>
Implementation restriction: A compiler may restrict ImportPaths to
non-empty strings using only characters belonging to

## Known Issues

### LocalStorageCapacityIsolationFSQuotaMonitoring ConfigMap rendering failure

- The Originating Identity feature, which lets the broker know which user that performed an action, is now GA.
- [Namespaced Brokers](https://svc-cat.io/docs/namespaced-broker-resources/), which enable operators to install a broker into a namespace instead of the cluster level, reached GA.

  // core object) or a PersistentVolumeClaim object.
  // When this field is specified, volume binding will only succeed if the type of
  // the specified object matches some installed volume populator or dynamic
  // provisioner.
  // This field will replace the functionality of the dataSource field and as such
  // if both fields are non-empty, they must have the same value. For backwards

- GCE Windows will no longer install Docker on containerd nodes. ([#101747](https://github.com/kubernetes/kubernetes/pull/101747), [@jeremyje](https://github.com/jeremyje)) [SIG Cloud Provider and Windows]

</p>

<p>
The interpretation of the ImportPath is implementation-dependent but
it is typically a substring of the full file name of the compiled
package and may be relative to a repository of installed packages.
</p>

<p>
Implementation restriction: A compiler may restrict ImportPaths to
non-empty strings using only characters belonging to

- Fixed a bug that doesn't allow to install k8s.io/kube-openapi dependency on execute kube::codegen::gen_openapi. ([#126923](https://github.com/kubernetes/kubernetes/pull/126923), [@kannon92](https://github.com/kannon92)) [SIG API Machinery]