- Only declare Job as finished after removing all Pod finalizers to avoid orphan Pods ([#119160](https://github.com/kubernetes/kubernetes/pull/119160), [@alculquicondor](https://github.com/alculquicondor)) [SIG Apps and Testing]

* Fix a bug in kubelet hostport logic which flushes KUBE-MARK-MASQ iptables chain ([#32413](https://github.com/kubernetes/kubernetes/pull/32413), [@freehan](https://github.com/freehan))
* Make sure finalizers prevent deletion on storage that supports graceful deletion ([#32351](https://github.com/kubernetes/kubernetes/pull/32351), [@caesarxuchao](https://github.com/caesarxuchao))

* When a namespace is being deleted and spec.finalizers are still being processed, stop returning a 409 conflict error and instead return the object as we would during metadata.finalizer processing. ([#84122](https://github.com/kubernetes/kubernetes/pull/84122), [@smarterclayton](https://github.com/smarterclayton))

     *
     * 2) To detect when FinalizableReference's class loader has to be garbage collected, at which
     * point, Finalizer can stop running
     */

    Finalizer finalizer = new Finalizer(finalizableReferenceClass, queue, frqReference);
    String threadName = "com.google.common.base.internal.Finalizer";
    Thread thread = null;
    if (bigThreadConstructor != null) {
      try {
        boolean inheritThreadLocals = false;

* Fixed a bug in the apiserver storage that could cause just-added finalizers to be ignored on an immediately following delete request, leading to premature deletion. ([#77619](https://github.com/kubernetes/kubernetes/pull/77619), [@caesarxuchao](https://github.com/caesarxuchao))

- Pod Finalizers and Conditions updates are skipped for re-scheduling attempts ([#91298](https://github.com/kubernetes/kubernetes/pull/91298), [@alculquicondor](https://github.com/alculquicondor)) [SIG Scheduling]

  
  With this patch, the external provisioner can remove the finalizer in next reconcile loop. Unfortunately if the provious existing pv has the Failed state, this patch won't take effort. It requires users to remove finalizer. ([#126043](https://github.com/kubernetes/kubernetes/pull/126043), [@carlory](https://github.com/carlory)) [SIG Apps and Storage]

    assertThat(frqC).isNotSameInstanceAs(sepFrqC);
    // Check the assumptions above.

    // FRQ tries to load the Finalizer class (for the reference-collecting thread) in a few ways.
    // If the class is accessible to the system ClassLoader (ClassLoader.getSystemClassLoader())
    // then FRQ does not bother to load Finalizer.class through a separate ClassLoader. That happens

        PreauthIntegrityContext context = sessionContexts.get(sessionId);
        return context != null ? context.getCurrentHash() : null;
    }

    /**
     * Finalizes and removes the preauth integrity context for a session.
     *
     * @param sessionId the session identifier
     */
    public void finalizeSession(String sessionId) {

                    throw new DictionaryException("Failed to write: " + item, e);
                }
            }
            return null;
        }

        /**
         * Closes the updater and finalizes the file update operation.
         * If changes were committed, the temporary file replaces the original.
         * Otherwise, the temporary file is deleted.
         */
        @Override
        public void close() {