- Kubeadm: add support for certificate chain validation. When using kubeadm in external CA mode, this allows an intermediate CA to be used to sign the certificates. The intermediate CA certificate must be appended to each signed certificate for this to work correctly. ([#97266](https://github.com/kubernetes/kubernetes/pull/97266), [@robbiemcmichael](https://github.com/robbiemcmichael)) [SIG Cluster...

- DRA: Fixed Kubelet admission to correctly handle...

- Client-go certificate manager rotation gained the ability to preserve optional intermediate chains accompanying issued certificates ([#88744](https://github.com/kubernetes/kubernetes/pull/88744), [@jackkleeman](https://github.com/jackkleeman)) [SIG API Machinery and Auth]

                    # class was set and a response field with a TypeAdapter
                    # exists. Serializes directly to JSON bytes via Pydantic's
                    # Rust core, skipping the intermediate Python dict +
                    # json.dumps() step.
                    use_dump_json = response_field is not None and isinstance(
                        response_class, DefaultPlaceholder
                    )

- Kubeadm: during the validation of existing kubeconfig files on disk, handle cases where the "ca.crt" is a bundle and has intermediate certificates. Find a common trust anchor between the "ca.crt" bundle and the CA in the existing kubeconfig on disk instead of treating "ca.crt" as a file containing a single CA. ([#123102](https://github.com/kubernetes/kubernetes/pull/123102),...

## Dependencies

### Added

</p>

<p>
For instance, some architectures provide a "fused multiply and add" (FMA) instruction
that computes <code>x*y + z</code> without rounding the intermediate result <code>x*y</code>.
These examples show when a Go implementation can use that instruction:
</p>

<pre>
// FMA allowed for computing r, because x*y is not explicitly rounded:
r  = x*y + z

// This is allowed by FIPS 198-1, Section 6: "Conceptually, the intermediate // results of the compression function on the B-byte blocks (K0 ⊕ ipad) and // (K0 ⊕ opad) can be precomputed once, at the time of generation of the key // K, or before its first use. These intermediate results can be stored and // then used to initialize H each time that a message needs to be // authenticated using the same key. [...] These stored intermediate values // shall be treated and protected in the same manner as...

  * [stable] [containerd](https://github.com/containerd/containerd): containerd v1.1 natively supports CRI v1alpha2 now, so users can use Kubernetes v1.10 with containerd v1.1 directly, without having to use the intermediate cri-containerd daemon. [All Kubernetes 1.10 tests passed](https://k8s-testgrid.appspot.com/sig-node-containerd). [@Random-Liu]

// This is allowed by FIPS 198-1, Section 6: "Conceptually, the intermediate // results of the compression function on the B-byte blocks (K0 ⊕ ipad) and // (K0 ⊕ opad) can be precomputed once, at the time of generation of the key // K, or before its first use. These intermediate results can be stored and // then used to initialize H each time that a message needs to be // authenticated using the same key. [...] These stored intermediate values // shall be treated and protected in the same manner as...