- bump master cidr range from /30 to /29 ([#32886](https://github.com/kubernetes/kubernetes/issues/32886))
- non-hostNetwork daemonsets will almost always have a pod that fails to schedule ([#32900](https://github.com/kubernetes/kubernetes/issues/32900))
- Service loadBalancerSourceRanges doesn't respect updates ([#33033](https://github.com/kubernetes/kubernetes/issues/33033))

    <sub-class-of type="application/x-msdownload"/>
    <magic priority="55">
      <!-- Technically the header offset is stored at 0x3c, and isn't a -->
      <!-- constant, but it's almost always set to start at 0x80, 0xb0, -->
      <!-- 0xd0 or 0xf0. Will always have the MZ msdoc header too. -->
      <match value="MZ" type="string" offset="0">
         <match value="PE\000\000" type="string" offset="128"/>

        canned Estimators`.
    *   `Estimator.export_savedmodel` has been renamed to `export_saved_model`.
    *   When saving to SavedModel, Estimators will strip default op attributes.
        This is almost always the correct behavior, as it is more forwards
        compatible, but if you require that default attributes to be saved with
        the model, please use `tf.compat.v1.Estimator`.

- No-op and GC related updates to cluster trust bundles no longer require attest authorization when the `ClusterTrustBundleAttest` plugin is enabled. ([#120779](https://github.com/kubernetes/kubernetes/pull/120779), [@enj](https://github.com/enj))

  Server-side apply now considers `.spec.defaultBackend` to be an atomic struct.  This means that any field-owner who sets values in that struct (they are mutually exclusive) owns the whole struct. For almost all users this change has no impact; for controllers that want to change the default backend port from number to name (or vice-versa), this makes it easier. ([#126207](https://github.com/kubernetes/kubernetes/pull/126207), [@thockin](https://github.com/thockin))...

- Added a alpha feature, behind the `RelaxedEnvironmentVariableValidation` feature gate.
  When that gate is enabled, Kubernetes allows almost all printable ASCII characters to be used in the names
  of environment variables for containers in Pods. ([#123385](https://github.com/kubernetes/kubernetes/pull/123385), [@HirazawaUi](https://github.com/HirazawaUi))

* Change `kubeadm create token` to default to the group that almost everyone will want to use.  The group is system:bootstrappers:kubeadm:default-node-token and is the group that kubeadm sets up, via an RBAC binding, for auto-approval (system:certificates.k8s.io:certificatesigningrequests:nodeclient). ([#53512](h...

* Add API version apps/v1, and bump DaemonSet to apps/v1 ([#53278](https://github.com/kubernetes/kubernetes/pull/53278), [@janetkuo](https://github.com/janetkuo))

## Known Issues

### LocalStorageCapacityIsolationFSQuotaMonitoring ConfigMap rendering failure

1DFC          ; valid                                  # 6.0  COMBINING DOUBLE INVERTED BREVE BELOW
1DFD          ; valid                                  # 5.2  COMBINING ALMOST EQUAL TO BELOW
1DFE..1DFF    ; valid                                  # 5.0  COMBINING LEFT ARROWHEAD ABOVE..COMBINING RIGHT ARROWHEAD AND DOWN ARROWHEAD BELOW