- The `ValidateProxyRedirects` feature was promoted to Beta and enabled by default. This feature restricts redirect-following from the apiserver to same-host redirects.  If nodes are configured to respond to CRI streaming requests on a different host interface than what the apiserver makes requests on (only the case if not using the built-in dockershim & setting the kubelet flag `--redirect-container-streaming=true`), then these requests will be broken....

- Fix handling of aws-load-balancer-security-groups annotation. Security-Groups assigned with this annotation are no longer modified by kubernetes which is the expected behaviour of most users. Also no unnecessary Security-Groups are created anymore if this annotation is used. ([#88690](https://github.com/kubernetes/kubernetes/pull/88690), [@Elias481](https://github.com/Elias481)) [SIG Cloud Provider]

```sh
docker run \
  -p 9000:9000 \
  -p 9001:9001 \
  -e "MINIO_ROOT_USER=AKIAIOSFODNN7EXAMPLE" \
  -e "MINIO_ROOT_PASSWORD=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" \

 * one can get a better result, as only a few registry suffixes are addressable. However, the most
 * useful test to determine if a domain is a plausible web host is {@link #hasPublicSuffix()}. This
 * will return {@code true} for many domains which (currently) are not hosts, such as {@code "com"},
 * but given that any public suffix may become a host without warning, it is better to err on the

    .sslSocketFactory(clientCertificates.sslSocketFactory(), clientCertificates.trustManager())
    .build();
```

Client Authentication
---------------------

The above scenario is representative of most TLS set ups: the client uses certificates to validate
the identity of a server. The converse is also possible. Here we create a server that authenticates
a client and a client that authenticates a server.

```java

	outReq.URL.Scheme = target.Scheme
	outReq.URL.Host = target.Host

	u := f.getURLFromRequest(outReq)

	outReq.URL.Path = u.Path
	outReq.URL.RawPath = u.RawPath
	outReq.URL.RawQuery = u.RawQuery
	outReq.RequestURI = "" // Outgoing request should not have RequestURI

	// Do not pass client Host header unless requested.
	if !f.PassHost {
		outReq.Host = target.Host
	}

	// TODO: only supports HTTP 1.1 for now.

    assertThat("http://host/a\u0000b".toHttpUrl().toUri())
      .isEqualTo(URI("http://host/a%00b"))
    assertThat("http://host/a\u0080b".toHttpUrl().toUri())
      .isEqualTo(URI("http://host/a%C2%80b"))
    assertThat("http://host/a\u009fb".toHttpUrl().toUri())
      .isEqualTo(URI("http://host/a%C2%9Fb"))
    // Percent-encoded in the query.
    assertThat("http://host/?a\u0000b".toHttpUrl().toUri())
      .isEqualTo(URI("http://host/?a%00b"))

				if err != nil {
					reqInfo := (&logger.ReqInfo{}).AppendTags("peerAddress", client.host.String())
					ctx := logger.SetReqInfo(ctx, reqInfo)
					peersLogOnceIf(ctx, err, client.host.String())
				}
			}
			return nil
		}, i, *client.host)
	}
	ng.Wait()
	if ctx.Err() != nil {
		return false
	}

	// Local host
	thisAddr, err := xnet.ParseHost(globalLocalNodeName)
	if err != nil {

  <groupId>maven</groupId>
  <artifactId>p0</artifactId>
  <packaging>pom</packaging>
  <version>1.0</version>

  <scm>
    <connection>scm:svn:http://host/p0</connection>
    <developerConnection>scm:svn:https://host/p0</developerConnection>
    <url>http://host/viewer?path=/p0</url>
  </scm>

  <modules>
    <module>modules/p1</module>
  </modules>

  <groupId>maven</groupId>
  <artifactId>p0</artifactId>
  <packaging>pom</packaging>
  <version>1.0</version>

  <scm>
    <connection>scm:svn:http://host/p0</connection>
    <developerConnection>scm:svn:https://host/p0</developerConnection>
    <url>http://host/viewer?path=/p0</url>
  </scm>

  <modules>
    <module>modules/p1</module>
  </modules>