Fangjun Kuang, Fei Hu, Frank Laub, Frederic Bastien, Fredrik Knutsson, frreiss,
Frédéric Rechtenstein, fsx950223, Gaurav Singh, gbaned, George Grzegorz
Pawelczak, George Sterpu, Gian Marco Iodice, Giorgio Arena, Hans Gaiser, Hans
Pabst, Haoyu Wu, Harry Slatyer, hsahovic, Hugo, Hugo Sjöberg, IrinaM21, jacco,
Jake Tae, Jean-Denis Lesage, Jean-Michel Gorius, Jeff Daily, Jens Elofsson,

    ([docs](http://kubernetes.io/docs/user-guide/federation/federated-secrets.md))
    ([kubernetes/features#68](https://github.com/kubernetes/enhancements/issues/68))
  - [beta] Federation API server gained support for events and many
    federation controllers now report important events.
    ([docs](http://kubernetes.io/docs/user-guide/federation/events))

- Changed core_pattern on COS nodes to be an absolute path. ([#86329](https://github.com/kubernetes/kubernetes/pull/86329), [@mml](https://github.com/mml)) [SIG Cluster Lifecycle and Node]
- Client-go certificate manager rotation gained the ability to preserve optional intermediate chains accompanying issued certificates ([#88744](https://github.com/kubernetes/kubernetes/pull/88744), [@jackkleeman](https://github.com/jackkleeman)) [SIG API Machinery and Auth]

### Juju
* The kubernetes-master, kubernetes-worker and kubeapi-load-balancer charms have gained an nrpe-external-master relation, allowing the integration of their monitoring in an external Nagios server. ([#41923](https://github.com/kubernetes/kubernetes/pull/41923), [@Cynerva](https://github.com/Cynerva))

AMwgB,EAAgB1lB,EAAEwlB,EAAO7hB,YAAYge,KACzC3a,IACA,GAEE0e,GACF1lB,EAAE0lB,GAAe1f,YAAYd,IAGK,QAAhCsgB,EAAO1kB,aAAa,SACtB0kB,EAAO1d,aAAa,iBAAiB,GAezC,GAXA9H,EAAEY,GAASwN,SAASlJ,IACiB,QAAjCtE,EAAQE,aAAa,SACvBF,EAAQkH,aAAa,iBAAiB,GAGxC5H,EAAKyB,OAAOf,GAERA,EAAQ6G,UAAUC,SAASxC,KAC7BtE,EAAQ6G,UAAUsF,IAAI7H,IAGpBtE,EAAQ+C,YAAc3D,EAAEY,EAAQ+C,YAAYsC,SAASf,IAA0B,CACjF,IAAMygB,EAAkB3lB,EAAEY,GAASkF,QAAQkB,IAAmB,GAE9D,GAAI2e,EAAiB,CACnB,IAAMC,EAAqB,GAAG1Y,MAAMvK,KAAKgjB,EAAgB9Y,iBAAiB7F,KAE1EhH,EAAE4lB,GAA...

* Start synchronizing pods after network is ready.  ([#68752](https://github.com/kubernetes/kubernetes/pull/68752), [@krzysztof-jastrzebski](https://github.com/krzysztof-jastrzebski))
* kubectl has gained new --profile and --profile-output options to output go profiles ([#68681](https://github.com/kubernetes/kubernetes/pull/68681), [@dlespiau](https://github.com/dlespiau))

* PodSecurityPolicy admission sets `podsecuritypolicy.admission.k8s.io/admit-policy` and `podsecuritypolicy.admission.k8s.io/validate-policy` annotations containing the name of the policy that allowed a pod to be admitted. (PodSecurityPolicy also gained the ability to [limit hostPath volume mounts to be read-only](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#volumes-and-file-systems).)

In addition, the NodeRestriction admission plugin now prevents kubelets from modifying...

- The errors in k8s.io/apimachinery/pkg/api/meta gained support for the stdlibs errors.Is matching, including when wrapped ([#111808](https://github.com/kubernetes/kubernetes/pull/111808), [@alvaroaleman](https://github.com/alvaroaleman)) [SIG API Machinery]

- Client-go certificate manager rotation gained the ability to preserve optional intermediate chains accompanying issued certificates ([#88744](https://github.com/kubernetes/kubernetes/pull/88744), [@jackkleeman](https://github.com/jackkleeman)) [SIG API Machinery and Auth]