- [Changes to Addons](#changes-to-addons)
    - [Dashboard](#dashboard)
    - [DNS](#dns)
    - [DNS Autoscaler](#dns-autoscaler)
    - [Cluster Autoscaler](#cluster-autoscaler-1)
    - [Cluster Load Balancing](#cluster-load-balancing)
    - [etcd Empty Dir Cleanup](#etcd-empty-dir-cleanup)
    - [Fluentd](#fluentd)
    - [Heapster](#heapster)
    - [Registry](#registry)

 * which is optimal, and <i>not</i> the size of the internal hashtable, which could be much larger
 * than {@code size()}. Furthermore, this structure places significantly reduced load on the garbage
 * collector by only using a constant number of internal objects.
 *
 * <p>If there are no removals, then iteration order for the {@link #entrySet}, {@link #keySet}, and

   * is called. This will fail if the iterator is infinite and may cause problems if the iterator
   * eagerly fetches data for each source when iterated (rather than producing sources that only
   * load data through their streams). Prefer using the {@link #concat(Iterable)} overload if
   * possible.
   *
   * @param sources the sources to concatenate
   * @return a {@code ByteSource} containing the concatenated data

    /**
     * Channel binding policy: -1=not set, 0=disabled, 1=preferred, 2=required
     */
    protected int channelBindingPolicy = -1; // -1=not set, 0=disabled, 1=preferred, 2=required
    /**
     * Load balancing strategy for distributing operations across channels
     */
    protected String loadBalancingStrategy;
    /**
     * Interval in milliseconds for checking channel health
     */

            if (parentPath != null) {
                // Parent is local, so it becomes our new candidate
                lastLocalParent = parentPath;

                // Load the parent model to continue walking up
                Path parentTempPath = tempDir.resolve(commonRoot.relativize(parentPath));
                ModelBuilderRequest parentRequest = ModelBuilderRequest.builder()

- Fixed an issue in the Windows kube-proxy (winkernel) where IPv4 and IPv6 Service load balancers could be incorrectly shared, causing broken dual-stack Service behavior. The kube-proxy now tracks load balancers per IP family, enabling correct support for PreferDualStack and RequireDualStack Services on Windows nodes. ([#136241](https://github.com/kubernetes/kubernetes/pull/136241), [@prin...

is unauthenticated. The mitigation may be disabled by setting the `UnauthenticatedHTTP2DOSMitigation` feature gate to `false` (it is enabled by default). An API server fronted by an L7 load balancer that already mitigates these http/2 attacks may choose to disable the kube-apiserver mitigation to avoid disrupting load balancer -> kube-apiserver connections if http/2 requests from multiple clients share the same backend connection. An API server on a private network may opt to disable the kube-apiserver...

  - [alpha] Creating a `Federated Ingress` is as simple as submitting
    an `Ingress` creation request to the Federation API Server. The
    Federation control system then creates and maintains a single
    global virtual IP to load balance incoming HTTP(S) traffic across
    some or all the registered clusters, across all regions. Google's
    GCE L7 LoadBalancer is the first supported implementation, and
	is available in this release.

* support for mounting local-ssds on GCI ([#27143](https://github.com/kubernetes/kubernetes/pull/27143), [@adityakali](https://github.com/adityakali))
* AWS: support mixed plaintext/encrypted ports in ELBs via service.beta.kubernetes.io/aws-load-balancer-ssl-ports annotation ([#26976](https://github.com/kubernetes/kubernetes/pull/26976), [@therc](https://github.com/therc))

unauthenticated. The mitigation may be enabled by setting the `UnauthenticatedHTTP2DOSMitigation` feature gate to `true` (it is disabled by default). An API server fronted by an L7 load balancer that already mitigates these http/2 attacks may choose not to enable the kube-apiserver mitigation to avoid disrupting load balancer → kube-apiserver connections if http/2 requests from multiple clients share the same backend connection. An API server on a private network may choose not to enable the kube-apiserver...