// Each volume plugin defines its own supported topology specifications.
  // An empty TopologySelectorTerm list means there is no topology restriction.
  // This field is only honored by servers that enable the VolumeScheduling feature.
  // +optional
  // +listType=atomic
  repeated k8s.io.api.core.v1.TopologySelectorTerm allowedTopologies = 8;
}

  // Each volume plugin defines its own supported topology specifications.
  // An empty TopologySelectorTerm list means there is no topology restriction.
  // This field is only honored by servers that enable the VolumeScheduling feature.
  // +optional
  // +listType=atomic
  repeated k8s.io.api.core.v1.TopologySelectorTerm allowedTopologies = 8;
}

- kube-apiserver: the `NodeRestriction` admission plugin now prevents kubelets from modifying `Node` labels prefixed with `node-restriction.kubernetes.io/`. The `node-restriction.kubernetes.io/` label prefix is reserved for cluster administrators to use for labeling `Node` objects to target workloads to nodes in a way that kubelets cannot modify or spoof. ([#68267](https://github.com/kubernetes/kubernetes/pull/68267),...

// Copyright 2015 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.

// This input was created by taking the instruction productions in
// the old assembler's (5a's) grammar and hand-writing complete
// instructions for each rule, to guarantee we cover the same space.

#include "../../../../../runtime/textflag.h"

TEXT	foo(SB), DUPOK|NOSPLIT, $0

// ADD
//

     *   attempt multiple proxy servers in sequence, eventually falling back to a direct
     *   connection.
     *
     * Set this to false to avoid retrying requests when doing so is destructive. In this case the
     * calling application should do its own recovery of connectivity failures.
     */
    fun retryOnConnectionFailure(retryOnConnectionFailure: Boolean) =
      apply {

    most common use of duplex calls is [gRPC][grpc_http2].

 *  New: Prevent OkHttp from retransmitting a request body by overriding `RequestBody.isOneShot()`.
    This is most useful when writing the request body is destructive.

 *  New: We've added `requestFailed()` and `responseFailed()` methods to `EventListener`. These
    are called instead of `requestBodyEnd()` and `responseBodyEnd()` in some failure situations.

automatically defined in the preamble. Note that there is no way for C
code to create a value of this type; this is only useful for passing
string values from Go to C and back to Go.

Using //export in a file places a restriction on the preamble:
since it is copied into two different C output files, it must not
contain any definitions, only declarations. If a file contains both
definitions and declarations, then the two output files will produce

	if srcInfo.Legacy {
		srcInfo.metadataOnly = false
	}

	// Check if x-amz-metadata-directive or x-amz-tagging-directive was not set to REPLACE and source,
	// destination are same objects. Apply this restriction also when
	// metadataOnly is true indicating that we are not overwriting the object.
	// if encryption is enabled we do not need explicit "REPLACE" metadata to
	// be enabled as well - this is to allow for key-rotation.

* Scheduler only activates unschedulable pods if node's scheduling related properties change. ([#71551](https://github.com/kubernetes/kubernetes/pull/71551), [@mlmhl](https://github.com/mlmhl))
* fix issue: vm sku restriction policy does not work in azure disk attach/detach ([#71941](https://github.com/kubernetes/kubernetes/pull/71941), [@andyzhangx](https://github.com/andyzhangx))

### Detection

Kubernetes Audit logs may indicate if the user name was misspelled to bypass the restriction placed on which user is a pod allowed to run as.

If you find evidence that this vulnerability has been exploited, please contact ******@****.***

#### Additional Details