- Switched intstr.Type to sized integer to follow API guidelines and improve compatibility with proto libraries ([#83956](https://github.com/kubernetes/kubernetes/pull/83956), [@liggitt](https://github.com/liggitt))

  - Health check (liveness & readiness) probes using an HTTPGetAction will no longer follow redirects to different hostnames from the original probe request. Instead, these non-local redirects will be treated as a Success (the documented behavior). In this case an event with reason "ProbeWarning" will be generated, indicating that the redirect...

pkg syscall (netbsd-arm64-cgo), const O_NOCTTY = 32768
pkg syscall (netbsd-arm64-cgo), const ONOEOT = 8
pkg syscall (netbsd-arm64-cgo), const ONOEOT ideal-int
pkg syscall (netbsd-arm64-cgo), const O_NOFOLLOW = 256
pkg syscall (netbsd-arm64-cgo), const O_NOFOLLOW ideal-int
pkg syscall (netbsd-arm64-cgo), const O_NONBLOCK = 4
pkg syscall (netbsd-arm64-cgo), const O_NOSIGPIPE = 16777216
pkg syscall (netbsd-arm64-cgo), const O_NOSIGPIPE ideal-int

- 'Promoted `cronjob_job_creation_skew` metric to stable to follow the cronjob v2 controller,
  the following metrics had their name updated to match metrics API guidelines:
    - `cronjob_job_creation_skew_duration_seconds` -> `job_creation_skew_duration_seconds`.' ([#113008](https://github.com/kubernetes/kubernetes/pull/113008), [@soltysh](https://github.com/soltysh))

pkg syscall (freebsd-riscv64), const O_NDELAY ideal-int #53466
pkg syscall (freebsd-riscv64), const O_NOCTTY = 32768 #53466
pkg syscall (freebsd-riscv64), const O_NOFOLLOW = 256 #53466
pkg syscall (freebsd-riscv64), const O_NOFOLLOW ideal-int #53466
pkg syscall (freebsd-riscv64), const O_NONBLOCK = 4 #53466
pkg syscall (freebsd-riscv64), const O_SHLOCK = 16 #53466

### Ephemeral Containers Graduate to Stable

  You can still access kubelet's `/healthz`, `/pods` and `/configz` by granting the caller `nodes/proxy` permission in RBAC but that also grants the caller permissions to exec, run and attach to containers on the nodes and doing so does not follow the least privilege principle. Granting callers more permissions than they need can give attackers an opportunity to escalate privileges. ([#126347](https://github.com/kubernetes/kubernetes/pull/126347), [@vinayakankugoyal](https://github.com/vinayakankugoyal))...

pkg syscall (darwin-386), const O_EXLOCK ideal-int
pkg syscall (darwin-386), const O_FSYNC ideal-int
pkg syscall (darwin-386), const O_NDELAY ideal-int
pkg syscall (darwin-386), const O_NOFOLLOW ideal-int
pkg syscall (darwin-386), const O_POPUP ideal-int
pkg syscall (darwin-386), const O_SHLOCK ideal-int
pkg syscall (darwin-386), const O_SYMLINK ideal-int
pkg syscall (darwin-386), const PROT_EXEC ideal-int

- Set ProcMountType feature to disabled by default, to follow the lead of UserNamespacesSupport (which it relies on). ([#126291](https://github.com/kubernetes/kubernetes/pull/126291), [@haircommander](https://github.com/haircommander)) [SIG Node]

- CoreDNS correctly implements DNS spec for Services with externalNames that look like IP addresses. Kube-dns does not follow the spec for the same case, resulting in a behavior change when moving from Kube-dns to CoreDNS. See: [coredns/coredns#2324](https://github.com/coredns/coredns/issues/2324)