* Break the 'certificatesigningrequests' controller into a 'csrapprover' controller and 'csrsigner' controller. ([#45514](https://github.com/kubernetes/kubernetes/pull/45514), [@mikedanese](https://github.com/mikedanese))

nd.us ne ne.jp ne.ke ne.kr ne.pw ne.tz ne.ug ne.us neat-url.com nebraska.museum nec nedre-eiker.no neko.am nemuro.hokkaido.jp nerdpol.ovh nerima.tokyo.jp nes.akershus.no nes.buskerud.no nesna.no nesodden.no nesoddtangen.no nesseby.no nesset.no net net-freaks.com net.ac net.ae net.af net.ag net.ai net.al net.am net.ar net.au net.az net.ba net.bb net.bh net.bj net.bm net.bn net.bo net.br net.bs net.bt net.bz net.ci net.cm net.cn net.co net.cu net.cw net.cy net.dm net.do net.dz net.ec net.eg net.et net.eu.org...

  The API Server will no longer proxy non-101 responses for upgrade requests. This could break proxied backends (such as an extension API server) that respond to upgrade requests with a non-101 response code. ([#92941](https://github.com/kubernetes/kubernetes/pull/92941), [@tallclair](https://github.com/tallclair)) [SIG API Machinery]

* Mark multi-scheduler graduation to beta and then v1. ([#38871](https://github.com/kubernetes/kubernetes/pull/38871), [@k82cn](https://github.com/k82cn))
* Scheduler treats StatefulSet pods as belonging to a single equivalence class. ([#39718](https://github.com/kubernetes/kubernetes/pull/39718), [@foxish](https://github.com/foxish))

  // MinDomains indicates a minimum number of eligible domains.
  // When the number of eligible domains with matching topology keys is less than minDomains,
  // Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed.
  // And when the number of eligible domains with matching topology keys equals or greater than minDomains,
  // this value has no effect on scheduling.

  The API Server will no longer proxy non-101 responses for upgrade requests. This could break proxied backends (such as an extension API server) that respond to upgrade requests with a non-101 response code. ([#92941](https://github.com/kubernetes/kubernetes/pull/92941), [@tallclair](https://github.com/tallclair)) [SIG API Machinery]

  The API Server will no longer proxy non-101 responses for upgrade requests. This could break proxied backends (such as an extension API server) that respond to upgrade requests with a non-101 response code. ([#92941](https://github.com/kubernetes/kubernetes/pull/92941), [@tallclair](https://github.com/tallclair)) [SIG API Machinery]

bbva

// bcg : 2015-04-02 The Boston Consulting Group, Inc.
bcg

// bcn : 2014-07-24 Municipi de Barcelona
bcn

// beats : 2015-05-14 Beats Electronics, LLC
beats

// beauty : 2015-12-03 XYZ.COM LLC
beauty

// beer : 2014-01-09 Registry Services, LLC
beer

// bentley : 2014-12-18 Bentley Motors Limited
bentley

In v1.26.0, we've found the bug that the PreEnqueue extension point doesn't work for Pods going to activeQ through backoffQ. 
It doesn't affect any of the vanilla Kubernetes behavior, but, may break custom PreEnqueue plugins.

The cause PR is [reverted](https://github.com/kubernetes/kubernetes/pull/117194) by v1.26.1.

## Urgent Upgrade Notes 

### (No, really, you MUST read this before you upgrade)

- A lease can only attach up to 1k objects. ([#98257](https://github.com/kubernetes/kubernetes/pull/98257), [@lingsamuel](https://github.com/lingsamuel)) [SIG API Machinery]
- Add ignore-errors flag for drain, support none-break drain in group ([#98203](https://github.com/kubernetes/kubernetes/pull/98203), [@yuzhiquan](https://github.com/yuzhiquan)) [SIG CLI]
- Base-images: Update to debian-iptables:buster-v1.4.0
  - Uses iptables 1.8.5