- Enforced kubelet to request serving certificates only once it has at least one IP address in the `.status.addresses` of its associated Node object. This avoids requesting DNS-only serving certificates before externally set addresses are in place. Until 1.33, the previous behavior can be opted back into by setting the deprecated `AllowDNSOnlyNodeCSR` feature...

     * their caseless domain and username fields are equal and either both hashes are external and they are equal or both internally supplied passwords are equal. If one {@code NtlmPasswordAuthentication} object has external hashes (meaning negotiated via NTLM HTTP Authentication) and the other does not they will not be equal. This is technically not correct however the server 8 byte challage would be required to compute and compare the password hashes but that it not available with...

 * to {@code A}; used for converting back and forth between <i>different representations of the same
 * information</i>.
 *
 * <h3>Invertibility</h3>
 *
 * <p>The reverse operation <b>may</b> be a strict <i>inverse</i> (meaning that {@code
 * converter.reverse().convert(converter.convert(a)).equals(a)} is always true). However, it is very
 * common (perhaps <i>more</i> common) for round-trip conversion to be <i>lossy</i>. Consider an

- Kubeadm: add the deprecated flag --port=0 to kube-controller-manager and kube-scheduler manifests to disable insecure serving. Without this flag the components by default serve (e.g. /metrics) insecurely on the default node interface (controlled by --address). Users that wish to override this behavior and enable insecure serving can pass a custom --port=X via kubeadm's "extraArgs" mechanic for these components. ([#92720](https://github.com/kubernetes/kubernetes/pull/92720),...

    /** Default failure count value (-1 indicates no limit). */
    public static final Integer DEFAULT_FAILURE_COUNT = -1;

    /** Default purge day value (-1 indicates no purging). */
    public static final String DEFAULT_PURGE_DAY = "-1";

    /** Default suggest purge day value (30 days). */
    public static final String DEFAULT_SUGGEST_PURGE_DAY = "30";

- Updated the control plane's trust anchor publisher to create and manage a new ClusterTrustBundle object, associated with the `kubernetes.io/kube-apiserver-serving` X.509 certificate signer. This ClusterTrustBundle contains a PEM bundle in its payload that you can use to verify kube-apiserver serving certificates. ([#127326](https://github.com/kubernetes/kubernetes/pull/127326), [@stlaz](https://github.com/stlaz)) [SIG API Machinery, Apps, Auth, Cluster Lifecycle and Testing]...

- Fix regression introduced in 1.33  - where some Paginated LIST calls are falling back to etcd instead of serving from cache. ([#132337](https://github.com/kubernetes/kubernetes/pull/132337), [@hakuna-matatah](https://github.com/hakuna-matatah)) [SIG API Machinery]

            return time;
        }
        return -1;
    }

    /**
     * Retrieves a list of access results from the data service for processing.
     * Filters out results that are too recent based on commit margin time and manages crawler throttling.
     *
     * @param cb the consumer to customize the search request
     * @param cleanupTime the time taken for the last cleanup operation

- kube-controller-manager and cloud-controller-manager now hold generated serving certificates in-memory unless a writeable location is specified with --cert-dir ([#69884](https://github.com/kubernetes/kubernetes/pull/69884), [@liggitt](https://github.com/liggitt))

     * may fluctuate up and down.
     */
    private int length;

    // True if we just called build() and the elements array is being used by a created ISM, meaning
    // we shouldn't modify that array further.
    private boolean forceCopyElements;

    /**
     * Creates a new builder. The returned builder is equivalent to the builder generated by {@link