this validation could allow authenticated requests destined for Nodes to be redirected to the API Server through its private network.

The merged fix enforces validation against the proxying address for a Node. In some cases, the fix can break clients that depend on the `nodes/proxy` subresource, specifically if a kubelet advertises a localhost or link-local address to the Kubernetes control plane. Configuring an egress proxy for egress to the cluster network can also mitigate this vulnerability....

- cpumanager will now rollback state if updateContainerCPUSet failed, indicating that the container start failed. This change will prevent CPU leaks. ([#67430](https://github.com/kubernetes/kubernetes/pull/67430), [@choury](https://github.com/choury))

pkg go/token, const AND_ASSIGN Token
pkg go/token, const AND_NOT Token
pkg go/token, const AND_NOT_ASSIGN Token
pkg go/token, const ARROW Token
pkg go/token, const ASSIGN Token
pkg go/token, const BREAK Token
pkg go/token, const CASE Token
pkg go/token, const CHAN Token
pkg go/token, const CHAR Token
pkg go/token, const COLON Token
pkg go/token, const COMMA Token
pkg go/token, const COMMENT Token

pkg go/token, const AND_ASSIGN = 28
pkg go/token, const AND_NOT = 22
pkg go/token, const AND_NOT_ASSIGN = 33
pkg go/token, const ARROW = 36
pkg go/token, const ASSIGN = 42
pkg go/token, const BREAK = 61
pkg go/token, const CASE = 62
pkg go/token, const CHAN = 63
pkg go/token, const CHAR = 8
pkg go/token, const COLON = 58
pkg go/token, const COMMA = 52
pkg go/token, const COMMENT = 2