- [Client Binaries](#client-binaries-16)
    - [Server Binaries](#server-binaries-16)
    - [Node Binaries](#node-binaries-16)
  - [Changelog since v1.13.0-alpha.3](#changelog-since-v1130-alpha3)
    - [Action Required](#action-required)
    - [Other notable changes](#other-notable-changes-14)
- [v1.13.0-alpha.3](#v1130-alpha3)
  - [Downloads for v1.13.0-alpha.3](#downloads-for-v1130-alpha3)
    - [Client Binaries](#client-binaries-17)

  // This field is required in all cases.
  optional string namespace = 1;

  // Name is the metadata.name of the referenced ConfigMap.
  // This field is required in all cases.
  optional string name = 2;

  // UID is the metadata.UID of the referenced ConfigMap.
  // This field is forbidden in Node.Spec, and required in Node.Status.
  // +optional
  optional string uid = 3;

    - [Client Binaries](#client-binaries-26)
    - [Server Binaries](#server-binaries-26)
    - [Node Binaries](#node-binaries-26)
  - [Changelog since v1.17.0](#changelog-since-v1170-1)
    - [Action Required](#action-required)
    - [Other notable changes](#other-notable-changes-1)

<!-- END MUNGE: GENERATED_TOC -->

# v1.18.20


## Downloads for v1.18.20

### Source Code

filename | sha512 hash

- Kubeadm: allow the "certs check-expiration" command to not require the existence of the cluster CA key (ca.key file) when checking the expiration of managed certificates in kubeconfig files. ([#106930](https://github.com/kubernetes/kubernetes/pull/106930), [@neolit123](https://github.com/neolit123)) [SIG Cluster...

0X_1FFFP-16  // == 0.1249847412109375
0x15e-2      // == 0x15e - 2 (integer subtraction)

0x.p1        // invalid: mantissa has no digits
1p-2         // invalid: p exponent requires hexadecimal mantissa
0x1.5e-2     // invalid: hexadecimal mantissa requires p exponent
1_.5         // invalid: _ must separate successive digits
1._5         // invalid: _ must separate successive digits
1.5_e1       // invalid: _ must separate successive digits

- The test "[sig-network] EndpointSlice should have Endpoints and EndpointSlices pointing to API Server [Conformance]" only requires that there is an EndpointSlice that references the "kubernetes.default" service, it no longer requires that its named "kubernetes". ([#104664](https://github.com/kubernetes/kubernetes/pull/104664), [@aojea](https://github.com/aojea))

  - `response.patch` and `response.patchType` are not permitted from validating admission webhooks
  - `apiVersion: "admission.k8s.io/v1"` is required
  - `kind: "AdmissionReview"` is required
  - `response.uid: "<value of request.uid>"` is required
  - `response.patchType: "JSONPatch"` is required (if `response.patch` is set) ([#80231](https://github.com/kubernetes/kubernetes/pull/80231), [@liggitt](https://github.com/liggitt))

    - [Action Required](#action-required-2)
    - [Other notable changes](#other-notable-changes-20)
- [v1.6.0-beta.1](#v160-beta1)
  - [Downloads for v1.6.0-beta.1](#downloads-for-v160-beta1)
    - [Client Binaries](#client-binaries-18)
    - [Server Binaries](#server-binaries-18)
  - [Changelog since v1.6.0-alpha.3](#changelog-since-v160-alpha3)
    - [Action Required](#action-required-3)

- [`KT-60448`](https://youtrack.jetbrains.com/issue/KT-60448) FirLazyResolveContractViolationException: `lazyResolveToPhase(COMPILER_REQUIRED_ANNOTATIONS)` cannot be called from a transformer with a phase COMPILER_REQUIRED_ANNOTATIONS from AllOpen plugin

- As of v1.25, the PodSecurity `restricted` level no longer requires pods that set .spec.os.name="windows" to also set Linux-specific securityContext fields. If a 1.25+ cluster has unsupported [out-of-skew](https://kubernetes.io/releases/version-skew-policy/#kubelet) nodes prior to v1.23 and wants to ensure namespaces enforcing the `restricted` policy continue to require Linux-specific securityContext fields on all pods, ensure a version of the `restricted` prior...