- Support for proxying a request to a peer kube-apiserver if the local apiserver is not able to serve it due to version skew or in the case the requested api is disabled on the local apiserver ([#117740](https://github.com/kubernetes/kubernetes/pull/117740), [@Richabanker](https://github.com/Richabanker))...

a problem where spurious retransmits in a long-running TCP connection to a service
IP could result in the connection being closed with the error "Connection reset by
peer" ([#74840](https://github.com/kubernetes/kubernetes/pull/74840), [@anfernee](https://github.com/anfernee))

2FB1          ; mapped                 ; 97CB          # 3.0  KANGXI RADICAL TANNED LEATHER
2FB2          ; mapped                 ; 97ED          # 3.0  KANGXI RADICAL LEEK
2FB3          ; mapped                 ; 97F3          # 3.0  KANGXI RADICAL SOUND
2FB4          ; mapped                 ; 9801          # 3.0  KANGXI RADICAL LEAF

- If `kubeadm reset` finds no etcd member ID for the peer it removes during the `remove-etcd-member` phase, it continues immediately to other phases, instead of retrying the phase for up to 3 minutes before continuing. ([#117948](https://github.com/kubernetes/kubernetes/pull/117948), [@dlipovetsky](https...

f":{"X-Minio-Internal-Server-Side-Encryption-Iv":"RmncthzgaMkD0R+ZqoC5SY5Tut8gu/31UbksoUSYL2Y=","X-Minio-Internal-Server-Side-Encryption-S3-Kms-Key-Id":"my-minio-key","X-Minio-Internal-Server-Side-Encryption-S3-Kms-Sealed-Key":"IAAfAKiIoO0Fsj267F1+lcEr//nkrRrZfKL7qb7qFoMKMk+BiVuBWm+aVoQ==","X-Minio-Internal-Server-Side-Encryption-S3-Sealed-Key":"IAAfAJTgBSbY05/iqYVveVKm/kfnt/vxWjoDhnh3MEEaC7p8/Eh2IboF9Sz1l23SsmMLD/dJwQ==","X-Minio-Internal-Server-Side-Encryption-Seal-Algorithm":"DAREv2-HMAC-SHA2...

s/kubernetes/pull/57902), [@kawych](https://github.com/kawych))

* On cluster provision or upgrade, kubeadm now generates certs and secures all connections to the etcd static-pod with mTLS. This includes the etcd serving cert, the etcd peer cert, and the apiserver etcd client cert. Flags and hostMounts are added to the etcd and apiserver static-pods to load these certs. For connections to etcd, https is now used in favor of http. ([#57415](https://github.com/kubernetes/kubernetes/pull/57415),...

- If `kubeadm reset` finds no etcd member ID for the peer it removes during the `remove-etcd-member` phase, it continues immediately to other phases, instead of retrying the phase for up to 3 minutes before continuing. ([#118057](https://github.com/kubernetes/kubernetes/pull/118057), [@dlipovetsky](https...

- If `kubeadm reset` finds no etcd member ID for the peer it removes during the `remove-etcd-member` phase, it continues immediately to other phases, instead of retrying the phase for up to 3 minutes before continuing. ([#117916](https://github.com/kubernetes/kubernetes/pull/117916), [@dlipovetsky](https...

- If `kubeadm reset` finds no etcd member ID for the peer it removes during the `remove-etcd-member` phase, it continues immediately to other phases, instead of retrying the phase for up to 3 minutes before continuing. ([#118192](https://github.com/kubernetes/kubernetes/pull/118192), [@dlipovetsky](https...