### kubectl (CLI)

- The `rules` field in RBAC `Role` and `ClusterRole` objects is now correctly reported as optional in the openapi schema. ([#73250](https://github.com/kubernetes/kubernetes/pull/73250), [@liggitt](https://github.com/liggitt))

- The `BalancedAllocation` plugin now skips all best-effort (zero-requested) pods. ([#130260](https://github.com/kubernetes/kubernetes/pull/130260), [@Bowser1704](https://github.com/Bowser1704))
- The following roles have had `Watch` added to them (prefixed with `system:controller:`):
  
  - `cronjob-controller`
  - `endpoint-controller`
  - `endpointslice-controller`
  - `endpointslicemirroring-controller`

    private User createTestUser(String username, String password) {
        User user = new User();
        user.setName(username);
        user.setPassword(password);
        user.setRoles(new String[] { "role1", "role2" });
        user.setGroups(new String[] { "group1", "group2" });
        return user;
    }

    // Test LdapManager implementation
    private static class TestLdapManager extends LdapManager {

`existing-objects` as a value to `--replicate` flag while adding or editing a replication rule.

Once existing object replication is enabled, all objects or object prefixes that satisfy the replication rules and were created prior to adding replication configuration OR while replication rules were disabled will be synced to the target cluster. Depending on the number of previously existing objects, the existing objects that are now eligible to be replicated will eventually be synced to the target...

        SuggestItem item = items.get(0);
        assertEquals("検索エンジン", item.getText());
        assertEquals("tag1", item.getTags()[0]);
        assertEquals("role1", item.getRoles()[0]);
    }

    protected ReadingConverter createDefaultReadingConverter() throws IOException {
        ReadingConverterChain chain = new ReadingConverterChain();

        List<Rule> rules = ruleManager.getRules();
        assertEquals(4, rules.size());
        assertEquals("rule1", rules.get(0).getRuleId());
        assertEquals("rule2", rules.get(1).getRuleId());
        assertEquals("rule3", rules.get(2).getRuleId());
        assertEquals("rule4", rules.get(3).getRuleId());
    }

    /**
     * Test adding duplicate rules
     */

				return
			}
		case "Rules":
			var zb0002 uint32
			zb0002, err = dc.ReadArrayHeader()
			if err != nil {
				err = msgp.WrapError(err, "Rules")
				return
			}
			if cap(z.Rules) >= int(zb0002) {
				z.Rules = (z.Rules)[:zb0002]
			} else {
				z.Rules = make([]BatchJobExpireFilter, zb0002)
			}
			for za0001 := range z.Rules {
				err = z.Rules[za0001].DecodeMsg(dc)
				if err != nil {

- Drop additional rule requirement (cronjobs/finalizers) in the roles who use kubectl create cronjobs to be backwards compatible ([#124883](https://github.com/kubernetes/kubernetes/pull/124883), [@ardaguclu](https://github.com/ardaguclu)) [SIG CLI]

	exit 1
fi

## Check if ILM expiry rules replicated
sleep 30s

./mc ilm rule list siteb/bucket
count=$(./mc ilm rule list siteb/bucket --json | jq '.config.Rules | length')
if [ $count -ne 1 ]; then
	echo "BUG: ILM expiry rules not replicated to 'siteb'"
	exit 1
fi

## Check replication of rules content
expDays=$(./mc ilm rule list siteb/bucket --json | jq '.config.Rules[0].Expiration.Days')