* Fix AWS device allocator to only use valid device names ([#41455](https://github.com/kubernetes/kubernetes/pull/41455), [@gnufied](https://github.com/gnufied))
* Trust region if found from AWS metadata ([#38880](https://github.com/kubernetes/kubernetes/pull/38880), [@justinsb](https://github.com/justinsb))

- Updated the control plane's trust anchor publisher to create and manage a new ClusterTrustBundle object, associated with the `kubernetes.io/kube-apiserver-serving` X.509 certificate signer. This ClusterTrustBundle contains a PEM bundle in its payload that you can use to verify kube-apiserver...

trentinsuedtirol.it
trentinsüd-tirol.it
trentinsüdtirol.it
trento.it
treviso.it
trieste.it
troandin.no
trogstad.no
troitsk.su
tromsa.no
tromso.no
tromsø.no
trondheim.no
trust
trv
try-snowplow.com
trycloudflare.com
trysil.no
træna.no
trøgstad.no
ts.it
ts.net
tselinograd.su
tsk.tr
tsu.mie.jp
tsubame.niigata.jp
tsubata.ishikawa.jp

    /**
     * Get the value for the key 'rate.limit.trusted.proxies'. <br>
     * The value is, e.g. 127.0.0.1,::1 <br>
     * comment: Comma-separated list of trusted proxy IPs. Only trust X-Forwarded-For/X-Real-IP from these IPs.
     * @return The value of found property. (NotNull: if not found, exception but basically no way)
     */
    String getRateLimitTrustedProxies();

    /**

- Etcd: update to v3.5.9 ([#118077](https://github.com/kubernetes/kubernetes/pull/118077), [@nikhita](https://github.com/nikhita)) [SIG Cloud Provider, Cluster Lifecycle and Testing]
- Fixes an issue where the vsphere cloud provider will not trust a certificate if:
  - The issuer of the certificate is unknown (x509.UnknownAuthorityError)
  - The requested name does not match the set of authorized names (x509.HostnameError)

### Other (Cleanup or Flake)

- Fixes an issue where the vsphere cloud provider will not trust a certificate if:
  - The issuer of the certificate is unknown (x509.UnknownAuthorityError)
  - The requested name does not match the set of authorized names (x509.HostnameError)

- Etcd: update to v3.5.9 ([#118078](https://github.com/kubernetes/kubernetes/pull/118078), [@nikhita](https://github.com/nikhita)) [SIG Cloud Provider, Cluster Lifecycle and Testing]
- Fixes an issue where the vsphere cloud provider will not trust a certificate if:
  - The issuer of the certificate is unknown (x509.UnknownAuthorityError)
  - The requested name does not match the set of authorized names (x509.HostnameError)

*   Added a `model.export(filepath)` API to create a lightweight SavedModel artifact that can be used for inference (e.g. with TF-Serving).