- kube-apiserver: Fixes an issue updating the default ServiceCIDR API object and creating dual-stack Service API objects when `--service-cluster-ip-range` flag passed to kube-apiserver is changed from single-stack to dual-stack. ([#131263](https://github.com/kubernetes/kubernetes/pull/131263), [@aojea](https://github.com/aojea)) [SIG API Machinery, Network and Testing]

- The `CloudDualStackNodeIPs` feature is now `beta`, meaning that when using
  an external cloud provider that has been updated to support the feature,
  you can pass comma-separated dual-stack `--node-ips` to `kubelet` and have
  the cloud provider take both IPs into account. ([#120275](https://github.com/kubernetes/kubernetes/pull/120275), [@danwinship](https://github.com/danwinship))

- Updated the API documentation for Service.Spec.IPFamily to warn that its exact
  semantics will probably change before the dual-stack feature goes GA, and users
  should look at ClusterIP or Endpoints, not IPFamily, to figure out if an existing
  Service is IPv4, IPv6, or dual-stack. ([#91527](https://github.com/kubernetes/kubernetes/pull/91527), [@danwinship](https://github.com/danwinship)) [SIG Apps and Network]

ca-central-1.elasticbeanstalk.com
ca.eu.org
ca.in
ca.it
ca.reclaim.cloud
ca.us
caa.aero
caa.li
cab
cable-modem.org
cafe
cafjs.com
cagliari.it
cahcesuolo.no
cal
cal.it
calabria.it
calculators.cx
call
caltanissetta.it
calvinklein
cam
cam.it
camau.vn
camdvr.org
camera
camp
campaign.gov.uk
campania.it
campidano-medio.it

- Kubeadm: update `CoreDNS` to 1.8.4. Grant `CoreDNS` permissions to "list" and "watch" `EndpointSlice` objects to accommodate dual-stack support. ([#102466](https://github.com/kubernetes/kubernetes/pull/102466), [@pacoxu](https://github.com/pacoxu))

// https://www.iana.org/domains/root/db/cab.html
cab

// cafe : Binky Moon, LLC
// https://www.iana.org/domains/root/db/cafe.html
cafe

// cal : Charleston Road Registry Inc.
// https://www.iana.org/domains/root/db/cal.html
cal

// call : Amazon Registry Services, Inc.
// https://www.iana.org/domains/root/db/call.html
call

// calvinklein : PVH gTLD Holdings LLC

G,CAAa1J,UAG1BkP,IACA+D,EACW,MAAd7M,MACC8I,EAAMjH,EAActF,KAApBuM,EAA6BA,EAAM8D,EAAWtQ,IAAjBwM,CAD9B9I,EAEc,OAAdA,MACC8I,EAAMjH,EAAcvF,IAApBwM,EAA4BA,EAAM8D,EAAWrQ,KAAjBuM,CAH7B9I,EAIc,KAAdA,MACC8I,EAAMjH,EAAcxF,MAApByM,EAA8BA,EAAM8D,EAAWxQ,GAAjB0M,CAL/B9I,EAMc,QAAdA,MACC8I,EAAMjH,EAAczF,GAApB0M,EAA2BA,EAAM8D,EAAWvQ,MAAjByM,EAEzBgE,EAAgBhE,EAAMjH,EAAcvF,IAApBwM,EAA4BA,EAAMvJ,EAAWjD,IAAjBwM,EAC5CiE,EAAiBjE,EAAMjH,EAActF,KAApBuM,EAA6BA,EAAMvJ,EAAWhD,KAAjBuM,EAC9CkE,EAAelE,EAAMjH,EAAczF,GAApB0M,EAA2...

import org.codelibs.core.io.FileUtil;
import org.codelibs.core.io.ResourceUtil;
import org.codelibs.core.lang.StringUtil;
import org.codelibs.core.lang.ThreadUtil;
import org.codelibs.curl.CurlResponse;
import org.codelibs.fesen.client.EngineInfo;
import org.codelibs.fesen.client.HttpClient;
import org.codelibs.fess.Constants;
import org.codelibs.fess.app.web.base.login.FessLoginAssist;

* Increase allowed lag for ssh key sync loop in tunneler to allow for one failure ([#60068](https://github.com/kubernetes/kubernetes/pull/60068), [@wojtek-t](https://github.com/wojtek-t))
* Fixing a bug in OpenStack cloud provider, where dual stack deployments (IPv4 and IPv6) did not work well when using kubenet as the network plugin. ([#59749](https://github.com/kubernetes/kubernetes/pull/59749), [@zioproto](https://github.com/zioproto))

* Make watch cache treat resourceVersion consistent with uncached watch ([#24008](https://github.com/kubernetes/kubernetes/pull/24008), [@liggitt](https://github.com/liggitt))

### Other notable changes

* Trusty: Add retry in curl commands ([#24749](https://github.com/kubernetes/kubernetes/pull/24749), [@andyzheng0831](https://github.com/andyzheng0831))