file. ### Configure TLS To enable TLS for MinIO containers, acquire TLS certificates from a CA or create self-signed certificates. While creating / acquiring certificates ensure the corresponding domain names are set as per the standard [DNS naming conventions](https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#pod-identity) in a Kubernetes StatefulSet (for a distributed MinIO setup). Then create a secret using ```bash kubectl create secret generic tls-ssl-minio --from-file=path/to/private.key...

- Kubernetes is now built with Go 1.19.9 ([#117776](https://github.com/kubernetes/kubernetes/pull/117776), [@xmudrii](https://github.com/xmudrii)) [SIG Release and Testing]

### Bug or Regression

- Fix "dbus: connection closed by user" error after dbus daemon restart
  CVE-2023-27561 CVE-2023-25809 CVE-2023-28642: Bump fix runc v1.1.4 -> v1.1.5

- `PidPressure` now evicts pods from lowest priority to highest priority ([#72844](https://github.com/kuber...

- Reset streams when an error happens during port-forward allowing kubectl to maintain port-forward connection open ([#128318](https://github.com/kubernetes/kubernetes/pull/128318), [@soltysh](https://github.com/soltysh)) [SIG API Machinery, CLI and Node]

file. ### Configure TLS To enable TLS for MinIO containers, acquire TLS certificates from a CA or create self-signed certificates. While creating / acquiring certificates ensure the corresponding domain names are set as per the standard [DNS naming conventions](https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#pod-identity) in a Kubernetes StatefulSet (for a distributed MinIO setup). Then create a secret using ```bash kubectl create secret generic tls-ssl-minio --from-file=path/to/private.key...

## Changes by Kind

### Feature

- Kubelet TCP and HTTP probes are more effective using networking resources: conntrack entries, sockets, ... 

- Kube-proxy: fix a bug on UDP `NodePort` Services where stale connection tracking entries may blackhole the traffic directed to the `NodePort` ([#98305](https://github.com/kubernetes/kubernetes/pull/98305), [@aojea](https://github.com/aojea))

		Transport: globalRemoteTargetTransport,
		Timeout:   10 * time.Second,
	}

	resp, err := client.Do(req)
	if err != nil {
		return err
	}
	if err == nil {
		// Drain the connection.
		xhttp.DrainBody(resp.Body)
	}
	if resp != nil {
		amzid := resp.Header.Get(xhttp.AmzRequestHostID)
		if _, ok := globalNodeNamesHex[amzid]; ok {
			return BucketRemoteIdenticalToSource{

an L7 load balancer that already mitigates these http/2 attacks may choose not to enable the kube-apiserver mitigation to avoid disrupting load balancer → kube-apiserver connections if http/2 requests from multiple clients share the same backend connection. An API server on a private network may choose not to enable the kube-apiserver mitigation to prevent performance regressions for unauthenticated clients. Authenticated requests rely on the fix in golang.org/x/net v0.17.0 alone. https://issue.k8s.io/121197...

	quarkus/extensions/resteasy-reactive/quarkus-resteasy-reactive/runtime/pom.xml
	quarkus/test-framework/junit5/pom.xml
quarkus/integration-tests/hibernate-orm-tenancy/connection-resolver/pom.xml
	quarkus/extensions/undertow/runtime/pom.xml
	quarkus/extensions/hibernate-orm/runtime/pom.xml
	quarkus/extensions/jdbc/jdbc-mariadb/runtime/pom.xml