- Updated the Partitionable Devices feature to support referencing counter sets across ResourceSlices within the same resource pool. Devices from incomplete pools were no longer considered for allocation. This change introduced backwards-incompatible updates to the alpha feature, requiring any ResourceSlices using it to be removed...

## Changelog since v1.15.3

### Other notable changes

* Restores compatibility with kubectl client-side validation when structural schemas are present in a CRD which sets spec.preserveUnknownFields=true ([#82666](https://github.com/kubernetes/kubernetes/pull/82666), [@liggitt](https://github.com/liggitt))

* Change `kubeadm create token` to default to the group that almost everyone will want to use.  The group is system:bootstrappers:kubeadm:default-node-token and is the group that kubeadm sets up, via an RBAC binding, for auto-approval (system:certificates.k8s.io:certificatesigningrequests:nodeclient). ([#53512](https://github.com/kubernetes/kubernetes/pull/53512), [@jbeda](https://github.com/jbeda))

servername.us
servers.run
servesarcasm.com
service.gov.scot
service.gov.uk
service.one
servicebus.windows.net
services
services.aero
setagaya.tokyo.jp
seto.aichi.jp
setouchi.okayama.jp
settsu.osaka.jp
sevastopol.ua
seven
sew
sex
sex.hu
sex.pl
sexy
sf.no
sfr
sg
sg-1.paas.massivegrid.net
sh
sh.cn
shacknet.nu
shakotan.hokkaido.jp
shangrila

          <type>String</type>
          <required>true</required>
          <description>The unique id for this report set, to be used during POM inheritance and profile injection
            for merging of report sets.
          </description>
          <defaultValue>default</defaultValue>
        </field>
        <field>
          <name>reports</name>
          <version>4.0.0+</version>

### Other (Cleanup or Flake)

- Kube-apiserver: sets an upper-bound on the lifetime of idle keep-alive connections and time to read the headers of incoming requests ([#103958](https://github.com/kubernetes/kubernetes/pull/103958), [@liggitt](https://github.com/liggitt)) [SIG API Machinery and Node]

- Changed how the API server handles updates to `.spec.defaultBackend` of Ingress objects.

      newEntry.setValueReference(valueReference.copyFor(this.valueReferenceQueue, value, newEntry));
      return newEntry;
    }

    /** Sets a new value of an entry. Adds newly created entries at the end of the access queue. */
    @GuardedBy("this")
    void setValue(ReferenceEntry<K, V> entry, K key, V value, long now) {

### Other (Cleanup or Flake)

- Kube-apiserver: sets an upper-bound on the lifetime of idle keep-alive connections and time to read the headers of incoming requests ([#103958](https://github.com/kubernetes/kubernetes/pull/103958), [@liggitt](https://github.com/liggitt)) [SIG API Machinery and Node]

*   `tf.experimental.dtensor`

    *   Deprecated `dtensor.run_on` in favor of `dtensor.default_mesh` to correctly indicate that the context does not override the mesh that the ops and functions will run on, it only sets a fallback default mesh.