- `kubeadm`: a separate "super-admin.conf" file is now deployed. The User in `admin.conf` is now bound to a new RBAC Group `kubeadm:cluster-admins` that has `cluster-admin` `ClusterRole` access. The User in `super-admin.conf` is now bound to the `system:masters` built-in super-powers / break-glass Group that can bypass RBAC. Before this change, the default `admin.conf` was bound to `system:masters` Group, which was undesired. Executing `kubeadm init phase kubeconfig all` or just `kubeadm...

using vSphere. ([#59328](https://github.com/kubernetes/kubernetes/pull/59328), [@divyenpatel](https://github.com/divyenpatel))

* Emit number of bound and unbound persistent volumes as Metrics. This PR adds four kinds of Volume Metrics for kube-controller-manager: bound PVC numbers, unbound PVC numbers, bound PV numbers and unbound PV numbers. The PVC metrics use namespace as dimension and the PV metrics use StorageClassName as its dimension. With these metrics we can better monitor the...

   * methods as implementations of normal converters do?
   *
   * But no matter what we do, it's worth remembering that the resulting code is going to be unsound
   * in the presence of LegacyConverter, at least in the case of users who view the converter as a
   * Function<A, B> or who call convertAll (and for any checkers that apply @PolyNull-like semantics

 * either of these extremes, {@code Striped} allows the user to trade between required concurrency
 * and memory footprint. For example, if a set of tasks are CPU-bound, one could easily create a
 * very compact {@code Striped<Lock>} of {@code availableProcessors() * 4} stripes, instead of
 * possibly thousands of locks which could be created in a {@code Map<K, Lock>} structure.
 *

- Added enforcement of an upper cost bound for DRA evaluations of CEL. The API server and scheduler now enforce an upper bound on the cost and runtime steps required for evaluating a CEL expression. ([#128101](https://github.com/kubernetes/kubernetes/pull/128101), [@pohly](https://github.com/pohly)) [SIG API Machinery and Node]

  //     @JointlyNullable T defaultValue);
  //
  // ...where "@JointlyNullable" is similar to @PolyNull but slightly different:
  //
  // - @PolyNull means "@Nullable or @Nonnull"
  //   (That would be unsound for an input Iterable<@Nullable Foo>. So, if we wanted to use
  //   @PolyNull, we would have to restrict this method to non-null <T>. But it has users who pass
  //   iterables with null elements.)
  //

          if (++thatSize > thisSize) {
            return false;
          }
        }
        return true; // that.size() == this.size()
      }
    }

    /**
     * Returns a lower bound for {@link #size()} based on the sizes of the backing sets.
     *
     * <p>This is more efficient than {@link #size()}, which iterates over the entire {@link
     * SetView}.
     */
    abstract int minSize();

    other.use {
      other.start(addressA, 0)

      // Same address is okay.
      other.start(addressA, 0)

      // Same address with bound port is okay.
      other.start(addressA, other.port)

      // Different address is not okay.
      assertFailsWith<IllegalStateException> {
        other.start(addressB, 0)
      }

  //     @JointlyNullable T defaultValue);
  //
  // ...where "@JointlyNullable" is similar to @PolyNull but slightly different:
  //
  // - @PolyNull means "@Nullable or @Nonnull"
  //   (That would be unsound for an input Iterable<@Nullable Foo>. So, if we wanted to use
  //   @PolyNull, we would have to restrict this method to non-null <T>. But it has users who pass
  //   iterables with null elements.)
  //

              + " called");
    }
  }

  public void testNullBounds() {
    // NullBounds has methods whose parameters are type variables that have
    // "extends @Nullable Object" as a bound. This test ensures that NullPointerTester considers
    // those parameters to be @Nullable, so it won't call the methods.
    NullBounds<?, ?, ?> nullBounds = new NullBounds<>();