- Fixed SELinux warning controller not to emit events for completed pods. ([#135629](https://github.com/kubernetes/kubernetes/pull/135629), [@jsafrane](https://github.com/jsafrane)) [SIG Apps, Storage and Testing]

          socketEffect = response.onResponseBody,
          expectedByteCount = body.contentLength,
          socket = socket,
        ).buffer()
    body.writeTo(responseBodySink)
    responseBodySink.emit()

    socket.sleepWhileOpen(response.trailersDelayNanos)
    if ("chunked".equals(response.headers["Transfer-Encoding"], ignoreCase = true)) {
      writeHeaders(socket.sink, response.trailers)
    }
  }

    assertFailsWith<IllegalStateException> {
      sinkReference.get().flush()
    }
    assertFailsWith<IllegalStateException> {
      sinkReference.get().write("ghi".toByteArray())
      sinkReference.get().emit()
    }
  }

  @Test
  fun getHeadersThrows() {
    server.enqueue(MockResponse.Builder().onRequestStart(CloseSocket()).build())
    assertFailsWith<IOException> {
      getResponse(newRequest("/"))

- EndpointSlice controller is now less likely to emit FailedToUpdateEndpointSlices events. ([#100114](https://github.com/kubernetes/kubernetes/pull/100114), [@robscott](https://github.com/robscott)) [SIG Apps and Network]

- Fixed SELinux warning controller not to emit events for completed pods. ([#136099](https://github.com/kubernetes/kubernetes/pull/136099), [@jsafrane](https://github.com/jsafrane)) [SIG Apps, Storage and Testing]

- Fixed SELinux warning controller not to emit events for completed pods. ([#136098](https://github.com/kubernetes/kubernetes/pull/136098), [@jsafrane](https://github.com/jsafrane)) [SIG Apps, Storage and Testing]

- EndpointSlice controller is now less likely to emit FailedToUpdateEndpointSlices events. ([#100113](https://github.com/kubernetes/kubernetes/pull/100113), [@robscott](https://github.com/robscott)) [SIG Apps and Network]

- Count pod overhead against an entity's ResourceQuota ([#99600](https://github.com/kubernetes/kubernetes/pull/99600), [@gjkim42](https://github.com/gjkim42)) [SIG API Machinery and Node]
- EndpointSlice controller is now less likely to emit FailedToUpdateEndpointSlices events. ([#100146](https://github.com/kubernetes/kubernetes/pull/100146), [@robscott](https://github.com/robscott)) [SIG Apps and Network]

kind: KubeProxyConfiguration
**featureGates:**
**  SupportIPVSProxyMode: true**
```

If your cluster was installed by kubeadm, you should edit the `featureGates` field in the `kubeadm-config` ConfigMap. You can do this using `kubectl -n kube-system edit cm kubeadm-config` before upgrading. For example:

kubeadm-config Before:

```
apiVersion: v1
kind: ConfigMap
metadata:
  name: kubeadm-config

## Changelog since v1.30.11

## Changes by Kind

### Bug or Regression

- Fix a bug where kube-apiserver could emit an further watch even even if decryption failed for earlier event and it was not emitted. ([#131161](https://github.com/kubernetes/kubernetes/pull/131161), [@wojtek-t](https://github.com/wojtek-t)) [SIG API Machinery]