*  Fix: Recover gracefully when a coalesced connection immediately goes unhealthy.
 *  Fix: Defer the `SecurityException` when looking up the default proxy selector.
 *  Fix: Don't use brackets formatting IPv6 host names in MockWebServer.
 *  Fix: Don't permit cache iterators to remove entries that are being written.


## Version 4.0.1

_2019-07-10_

- PodLifecycleSleepAction is graduated to GA ([#128046](https://github.com/kubernetes/kubernetes/pull/128046), [@AxeZhan](https://github.com/AxeZhan)) [SIG Architecture, Node and Testing]
- Pods were allowed to use the `net.ipv4.tcp_rmem` and `net.ipv4.tcp_wmem` sysctl by default
  when the kernel version was 4.15 or higher. With the kernel 4.15 the sysctl became namespaced.

* The pod annotation `security.alpha.kubernetes.io/sysctls` now allows customization of namespaced and well isolated kernel parameters (sysctls), starting with `kernel.shm_rmid_forced`, `net.ipv4.ip_local_port_range` and `net.ipv4.tcp_syncookies` for Kubernetes 1.4. ([#27180](https://github.com/kubernetes/kubernetes/pull/27180), [@sttts](https://github.com/sttts))

 *  Fix: Change `MockWebServer` to use the same logic as OkHttp when determining
    whether an HTTP request permits a body.
 *  Fix: `HttpUrl` now uses the canonical form for IPv6 addresses.
 *  Fix: Use `HttpUrl` internally.
 *  Fix: Recover from Android 4.2.2 EBADF crashes.
 *  Fix: Don't crash with an `IllegalStateException` if an HTTP/2 or SPDY

### Bug or Regression

- Fix a bug that caused to panic the apiserver when trying to allocate a Service with a dynamic ClusterIP and it has been configured with Service CIDRs with a /28 mask for IPv4 and a /124 mask for IPv6 ([#115334](https://github.com/kubernetes/kubernetes/pull/115334), [@aojea](https://github.com/aojea)) [SIG Network and Testing]

    // IPv6 colons don't interfere with port numbers or passwords.
    assertThat(parse("http://[::1]:8080/").port).isEqualTo(8080)
    assertThat(parse("http://user:password@[::1]/").password).isEqualTo("password")
    assertThat(parse("http://user:password@[::1]:8080/").host).isEqualTo("::1")

    // Permit the contents of IPv6 addresses to be percent-encoded...

domain.title = Fess

# Search Engine

# The type of search engine backend (e.g., default, opensearch).
search_engine.type=default
# The URL of the search engine HTTP endpoint.
# For IPv6 environments, use brackets around the IPv6 address (e.g., http://[::1]:9201)
search_engine.http.url=http://localhost:9201
# Path to SSL certificate authorities for secure HTTP connections.
search_engine.http.ssl.certificate_authorities=

ce.gov.br
ce.it
ce.leg.br
cechire.com
center
centralus.azurestaticapps.net
ceo
cern
certification.aero
cesena-forli.it
cesena-forlì.it
cesenaforli.it
cesenaforlì.it
cf
cf-ipfs.com
cfa
cfd
cfolks.pl
cg
ch
ch.eu.org
ch.it
ch.trendhosting.cloud
chambagri.fr
championship.aero
chanel
channel
channelsdvr.net
charity
charter.aero

- Fixed a regression in kube-proxy where it might refuse to start if given
  single-stack IPv6 configuration options on a node that has both IPv4 and
  IPv6 IPs. ([#121008](https://github.com/kubernetes/kubernetes/pull/121008), [@danwinship](https://github.com/danwinship)) [SIG Network]

- Added support to the kube-proxy nodePortAddresses / --nodeport-addresses option to
  accept the value "primary", meaning to only listen for NodePort connections
  on the node's primary IPv4 and/or IPv6 address (according to the Node object).
  This is strongly recommended, if you were not previously using
  --nodeport-addresses, to avoid surprising behavior.