- Fixed file permission issues that happened during update of `Secret`/`ConfigMap`/`projected volume` when `fsGroup` is used. The problem caused a race condition where application gets intermittent permission denied error when reading files that were just updated, before the correct permissions were applied. ([#114464](https://github.com/kubernetes/kubernetes/pull/114464),...

- `kubeadm join` fails if file-based discovery is too long, with a default timeout of 5 minutes. ([#80804](https://github.com/kubernetes/kubernetes/pull/80804), [@olivierlemasle](ht...

- Kubeadm: during execution of the "check expiration" command, treat the etcd CA as external if there is a missing etcd CA key file (etcd/ca.key) and perform the proper validation on certificates signed by the...

pkg io/fs, type DirEntry interface, Type() FileMode
pkg io/fs, type FS interface { Open }
pkg io/fs, type FS interface, Open(string) (File, error)
pkg io/fs, type File interface { Close, Read, Stat }
pkg io/fs, type File interface, Close() error
pkg io/fs, type File interface, Read([]uint8) (int, error)
pkg io/fs, type File interface, Stat() (FileInfo, error)
pkg io/fs, type FileInfo interface { IsDir, ModTime, Mode, Name, Size, Sys }

* Pre-existing log files are now opened with O_APPEND, instead of O_TRUNC. This helps prevent losing logs when components crash-loop, and also enables external log rotation utilities to truncate log files in-place without components extending log files to their pre-truncation sizes on subsequent writes. ([#74837](https://github.com/kubernetes/kubernetes/pull/74837), [@mtaufen](https:...

## Urgent Upgrade Notes 

### (No, really, you MUST read this before you upgrade)

- `kubeadm`: added a new "kubeadm config validate" command that can be used to
  validate any input config file. Use the `--config` flag to pass a config file
  to it. See the command `--help` screen for more information. As a result of adding
  this new command, enhance the validation capabilities of the existing "kubeadm

pkg syscall (netbsd-arm64), const SYS_EXTATTR_LIST_FILE ideal-int
pkg syscall (netbsd-arm64), const SYS_EXTATTR_LIST_LINK = 372
pkg syscall (netbsd-arm64), const SYS_EXTATTR_LIST_LINK ideal-int
pkg syscall (netbsd-arm64), const SYS_EXTATTR_SET_FD = 364
pkg syscall (netbsd-arm64), const SYS_EXTATTR_SET_FD ideal-int
pkg syscall (netbsd-arm64), const SYS_EXTATTR_SET_FILE = 361

enhanced the "patches" functionality to be able to patch kubelet config files containing `v1beta1.KubeletConfiguration`. The new patch target is called `kubeletconfiguration` (e.g. patch file `kubeletconfiguration+json.json`).This makes it possible to apply node specific KubeletConfiguration options during `init`, `join` and `upgrade`, while the main `KubeletConfiguration` that is passed to `init` as part of the `--config` file can still act as the global stored in the cluster `KubeletConfiguration`....

- Kubeadm: during execution of the `certs check-expiration` command, treat the etcd CA as external if there is a missing etcd CA key file (etcd/ca.key) and perform the proper validation on certificates signed by the etcd CA....