#### Go Client
* Add support for client-side spam filtering of events([#47367](https://github.com/kubernetes/kubernetes/pull/47367))

- Scheduler throughput has been improved by ~50% in large clusters (>2000 nodes).

### SIG-service-catalog
- The Originating Identity feature, which lets the broker know which user that performed an action, is now GA.
- [Namespaced Brokers](https://svc-cat.io/docs/namespaced-broker-resources/), which enable operators to install a broker into a namespace instead of the cluster level, reached GA.

    * 2. A cluster can be dualstack (i.e. Pods and nodes carry dualstack IPs) but does not need to support ingress on dualstack. In this case the cluster can perform egress using `PodIPs` (according to family and binding selection in user code) but will ingress will only be performed against the pod primary IP. This can be configured by supplying single entry to `--service-cluster-ip-range` flag.

join` only did the discovery part and exited successfully without checking that the kubelet actually started properly and performed the TLS bootstrap correctly. Now, as kubeadm runs some post-join steps (for example, annotating the Node API object with the CRISocket), `kubeadm join` is now waiting for the kubelet to perform the TLS Bootstrap, and then uses that credential to perform further actions. This also improves the UX, as `kubeadm` will exit with a non-zero code if the kubelet isn't in a functional...

import com.google.common.annotations.GwtCompatible;
import org.jspecify.annotations.NullMarked;

/**
 * An object that can perform a {@link #tearDown} operation.
 *
 * @author Kevin Bourrillion
 * @since 10.0
 */
@GwtCompatible
@NullMarked
public interface TearDown {
  /**
   * Performs a <b>single</b> tear-down operation. See test-libraries-for-java's {@code
   * com.google.common.testing.junit3.TearDownTestCase} and {@code

* Fix container hostPid settings when CRI is enabled. ([#44116](https://github.com/kubernetes/kubernetes/pull/44116), [@feiskyer](https://github.com/feiskyer))
* RBAC role and rolebinding auto-reconciliation is now performed only when the RBAC authorization mode is enabled. ([#43813](https://github.com/kubernetes/kubernetes/pull/43813), [@liggitt](https://github.com/liggitt))

A job is the basic unit of work for MinIO Batch Job. A job is a self describing YAML, once this YAML is submitted and evaluated - MinIO performs the requested actions on each of the objects obtained under the described criteria in job YAML file.

### Type
Type describes the job type, such as replicating objects between MinIO sites. Each job performs a single type of operation across all objects that match the job description criteria.

## Batch Jobs via Commandline

            throws IOException, ServletException {
        return authenticate(req, resp, challenge);
    }

    /**
     * Performs NTLM authentication for the servlet request.
     *
     * @param req The request being serviced.
     * @param resp The response.
     * @param challenge The domain controller challenge.

import com.google.common.annotations.GwtCompatible;
import org.jspecify.annotations.NullMarked;

/**
 * An object that can perform a {@link #tearDown} operation.
 *
 * @author Kevin Bourrillion
 * @since 10.0
 */
@FunctionalInterface
@GwtCompatible
@NullMarked
public interface TearDown {
  /**
   * Performs a <b>single</b> tear-down operation. See test-libraries-for-java's {@code

            final byte[] challenge) throws IOException {
        return authenticate(tc, req, resp, challenge);
    }

    /**
     * Performs NTLM authentication for the servlet request.
     *
     * @param tc
     *            context to use
     *
     * @param req
     *            The request being serviced.
     * @param resp