### Kube-proxy images are now based on distroless images

* The namespace API object no longer supports the deletecollection operation, which was previously allowed by mistake and did not respect expected namespace lifecycle semantics. ([#47098](https://github.com/kubernetes/kubernetes/pull/47098), [@liggitt](https://github.com/liggitt))

  - Better output for image pull errors.
- Improved air-gapped and offline support
  - kubeadm now handles air-gapped environments by using the local client version as a fallback.
  - Some kubeadm commands are now allowed to work in a completely offline mode.
- Certificate handling improvements:
  - Renew certs as part of upgrade.
  - New `kubeadm alpha phase certs renew` command for renewing certificates.

* Access to externally managed IP addresses via the kube-apiserver service proxy subresource is no longer allowed by default. This can be re-enabled via the `ServiceProxyAllowExternalIPs` feature gate, but will be disallowed completely in 1.11 ([#57265](https://github.com/kubernetes/kubernetes/pull/57265), [@brendandburns](https://github.com/brendandburns))

* AWS kube-up: move to Docker 1.11.2 ([#27676](https://github.com/kubernetes/kubernetes/pull/27676), [@justinsb](https://github.com/justinsb))
* Fixed an issue that Deployment may be scaled down further than allowed by maxUnavailable when minReadySeconds is set. ([#27728](https://github.com/kubernetes/kubernetes/pull/27728), [@janetkuo](https://github.com/janetkuo))



# v1.3.0-beta.2

### Detection

Kubernetes Audit logs may indicate if the user name was misspelled to bypass the restriction placed on which user is a pod allowed to run as.

If you find evidence that this vulnerability has been exploited, please contact ******@****.***

#### Additional Details

- The maximum number of ports allowed in EndpointSlices has been increased from 100 to 20,000 ([#99795](https://github.com/kubernetes/kubernetes/pull/99795), [@robscott](https://github.com/robscott)) [SIG Network]

## Dependencies

### Added

         *
         * @return true if the build was successful, false if the query is blank
         * @throws ResultOffsetExceededException if the offset exceeds the maximum allowed
         * @throws SearchQueryException if facet fields are invalid
         */
        public boolean build() {
            if (StringUtil.isBlank(query)) {
                return false;
            }

  }

  @Test
  fun responseCodeDisagreesWithHeaders() {
    server.enqueue(
      MockResponse(
        code = HttpURLConnection.HTTP_NO_CONTENT,
        body = "This body is not allowed!",
      ),
    )
    assertFailsWith<IOException> {
      getResponse(newRequest("/"))
    }.also { expected ->
      assertThat(expected.message).isEqualTo("HTTP 204 had non-zero Content-Length: 25")

- The maximum number of ports allowed in EndpointSlices has been increased from 100 to 20,000 ([#99795](https://github.com/kubernetes/kubernetes/pull/99795), [@robscott](https://github.com/robscott)) [SIG Network]

### Uncategorized