### Action Required

* `kubectl create rolebinding` and `kubectl create clusterrolebinding` no longer allow specifying multiple subjects as comma-separated arguments. Use repeated `--user`, `--group`, or `--serviceaccount` arguments to specify multiple subjects.  ([#43903](https://github.com/kubernetes/kubernetes/pull/43903), [@xilabao](https://github.com/xilabao))

### Other notable changes

             name: system:azure-cloud-provider
           roleRef:
             apiGroup: rbac.authorization.k8s.io
             kind: ClusterRole
             name: system:azure-cloud-provider
           subjects:
           - kind: ServiceAccount
             name: azure-cloud-provider
             namespace: kube-system
    ```

* Add support for --image-pull-policy to 'kubectl run' ([#30614](https://github.com/kubernetes/kubernetes/pull/30614), [@AdoHe](https://github.com/AdoHe))
* x509 authenticator: get groups from subject's organization field ([#30392](https://github.com/kubernetes/kubernetes/pull/30392), [@ericchiang](https://github.com/ericchiang))

*   RBAC ClusterRoles can now select other roles to aggregate. ([#54005](https://github.com/kubernetes/kubernetes/pull/54005),[ @deads2k](https://github.com/deads2k))
*   Fixed an issue with RBAC reconciliation that caused duplicated subjects in some bootstrapped RoleBinding objects on each restart of the API server. ([#53239](https://github.com/kubernetes/kubernetes/pull/53239),[ @enj](https://github.com/enj))

#### **Other**

  Alice did not feel encouraged to ask any more questions about
it, so she turned to the Mock Turtle, and said `What else had you
to learn?'

  `Well, there was Mystery,' the Mock Turtle replied, counting
off the subjects on his flappers, `--Mystery, ancient and modern,
with Seaography:  then Drawling--the Drawling-master was an old
conger-eel, that used to come once a week:  HE taught us
Drawling, Stretching, and Fainting in Coils.'

  Alice did not feel encouraged to ask any more questions about
it, so she turned to the Mock Turtle, and said `What else had you
to learn?'

  `Well, there was Mystery,' the Mock Turtle replied, counting
off the subjects on his flappers, `--Mystery, ancient and modern,
with Seaography:  then Drawling--the Drawling-master was an old
conger-eel, that used to come once a week:  HE taught us
Drawling, Stretching, and Fainting in Coils.'

* Fixes an issue with RBAC reconciliation that could cause duplicated subjects in some bootstrapped rolebindings on each restart of the API server. ([#53239](https://github.com/kubernetes/kubernetes/pull/53239), [@enj](https://github.com/enj))

* You can now display requests/limits of extended resources in node allocated resources. ([#46079](https://github.com/kubernetes/kubernetes/pull/46079), [@xiangpengzhao](https://github.com/xiangpengzhao))
* The `--remove-extra-subjects` and `--remove-extra-permissions` flags have been enabled for `kubectl auth reconcile` ([#64541](https://github.com/kubernetes/kubernetes/pull/64541), [@mrogers950](https://github.com/mrogers950))