* Add the Patch method to the generated clientset. ([#27293](https://github.com/kubernetes/kubernetes/pull/27293), [@caesarxuchao](https://github.com/caesarxuchao))
* let patch use --local flag like `kubectl set image` ([#26722](https://github.com/kubernetes/kubernetes/pull/26722), [@deads2k](https://github.com/deads2k))

- Kube-apiserver: fixes a 1.27+ regression in watch stability by serving watch requests without a resourceVersion from the watch cache by default, as in <1.27 (disabling the change in #115096 by default). This mitigates the impact of an etcd watch bug (https://github.com/etcd-io/etcd/pull/17555). If the 1.27 change in #115096 to serve these requests from underlying storage is still desired despite the impact on watch stability, it can be re-enabled with a `WatchFromStorageWithoutResourceVersion`...

				"application/octet-stream",
				"application/oda",
				"application/oebps-package+xml",
				"application/ogg",
				"application/kate",
				"application/onenote",
				"application/parityfec",
				"application/patch-ops-error+xml",
				"application/pgp-encrypted",
				"application/pgp-keys",
				"application/pgp-signature",
				"application/pics-rules",
				"application/pidf+xml",
				"application/pidf-diff+xml",

	public final fun -deprecated_directory ()Ljava/io/File;
	public fun <init> (Ljava/io/File;J)V
	public fun <init> (Lokio/FileSystem;Lokio/Path;J)V
	public fun close ()V
	public final fun delete ()V
	public final fun directory ()Ljava/io/File;
	public final fun directoryPath ()Lokio/Path;
	public final fun evictAll ()V
	public fun flush ()V
	public final fun hitCount ()I
	public final fun initialize ()V

    assertThat(
      challengeResponse.request.url
        .toUrl()
        .path,
    ).isEqualTo("/b")
    val redirectedBy = challengeResponse.priorResponse
    assertThat(
      redirectedBy!!
        .request.url
        .toUrl()
        .path,
    ).isEqualTo("/a")
  }

  @Test
  fun attemptAuthorization20Times() {
    for (i in 0..19) {

 - The `batch/v2alpha1.CronJob` is deprecated in favor of `batch/v1beta1`.

 - The `batch/v2alpha1.ScheduledJob` was removed. Use `batch/v1beta1.CronJob` instead.

### Auth

 - The RBAC v1alpha1 API group is deprecated in favor of RBAC v1.

    If you do not, you risk allowing unauthorized users to access your federation apiserver.
  * You do not need to adjust this flag on Kubelet:  there was no authorization for the Kubelet APIs in 1.4.
* batch/v2alpha1.ScheduledJob has been renamed, use batch/v2alpha1.CronJob instead ([#36021](https://github.com/kubernetes/kubernetes/pull/36021), [@soltysh](https://github.com/soltysh))
* PetSet has been renamed to StatefulSet.

- Kube-apiserver: fixes a 1.27+ regression in watch stability by serving watch requests without a resourceVersion from the watch cache by default, as in <1.27 (disabling the change in #115096 by default). This mitigates the impact of an etcd watch bug (https://github.com/etcd-io/etcd/pull/17555). If the 1.27 change in #115096 to serve these requests from underlying storage is still desired despite the impact on watch stability, it can be re-enabled with a `WatchFromStorageWithoutResourceVersion`...

- Fixes a regression in v1beta1 PodDisruptionBudget handling of `strategic merge patch`-type API requests for the `selector` field. Prior to 1.21, these requests would merge `matchLabels` content and replace `matchExpressions` content. In 1.21, patch requests touching the `selector` field started replacing the entire selector. This is consistent with server-side apply and the v1 PodDisruptionBudget behavior, but should...

  # - filtering criteria only applies for all source objects match the criteria
  # - configurable notification endpoints
  # - configurable retries for the job (each retry skips successfully previously replaced objects)
  flags:
    filter:
      newerThan: "7d10h31s" # match objects newer than this value (e.g. 7d10h31s)
      olderThan: "7d" # match objects older than this value (e.g. 7d10h31s)