* PodSecurityPolicy admission sets `podsecuritypolicy.admission.k8s.io/admit-policy` and `podsecuritypolicy.admission.k8s.io/validate-policy` annotations containing the name of the policy that allowed a pod to be admitted. (PodSecurityPolicy also gained the ability to [limit hostPath volume mounts to be read-only](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#volumes-and-file-systems).)

In addition, the NodeRestriction admission plugin now prevents kubelets from modifying...

AAGhC,UACf0kB,GApJQ,IAoJgBtC,GAAMsC,EApJtB,KAoJ6C,EACrD,MACJ,IAAK,SACDA,EAAO5mB,KAAKkE,GAAGhC,UACf0kB,GAzJQ,IAyJgBtC,GAAMsC,EAzJtB,KAyJ6C,EACrD,MAKR,OAFA5mB,KAAKkE,GAAGqd,QAAQqF,GAChBzmB,EAAM4F,aAAa/F,MAAM,GAClBA,MAyqBX0mB,GAAMtkB,OAp5BN,SAAgBolB,GAERA,EADCA,IACaxnB,KAAK2hB,QACbxhB,EAAMgkB,iBACNhkB,EAAM+jB,eAEhB,IAAI5a,EAASN,EAAahJ,KAAMwnB,GAChC,OAAOxnB,KAAK+I,aAAa0e,WAAWne,IA84BxCod,GAAMxhB,KA34BN,SAAc0hB,EAAMc,GAChB,OACI1nB,KAAK4D,YACHoC,EAAS4gB,IAASA,EAAKhjB,WAAc+Y,GAAYiK,GAAMhjB,WAElDke,GAAe...

- The errors in k8s.io/apimachinery/pkg/api/meta gained support for the stdlibs errors.Is matching, including when wrapped ([#111808](https://github.com/kubernetes/kubernetes/pull/111808), [@alvaroaleman](https://github.com/alvaroaleman)) [SIG API Machinery]

- Client-go certificate manager rotation gained the ability to preserve optional intermediate chains accompanying issued certificates ([#88744](https://github.com/kubernetes/kubernetes/pull/88744), [@jackkleeman](https://github.com/jackkleeman)) [SIG API Machinery and Auth]