- The deprecated, legacy behavior of treating the CommonName field on X.509 serving certificates as a host name when no Subject Alternative Names are present is now disabled by default. It can be temporarily re-enabled by adding the value x509ignoreCN=0 to the GODEBUG environment variable. ([#93264](https://github.com/kubernetes/kubernetes/pull/93264), [@justaugustus](https://github.com/justaugustus)) [SIG API Machinery, Auth, CLI, Cloud Provider, Cluster...

* Fix issue where on re-registration of device plugin, `allocatable` was not getting updated. This issue makes devices invisible to the Kubelet if device plugin restarts. Only work-around, if this fix is not there, is to restart the kubelet and then start device plugin. (...

    *   Added a new `rerandomize_each_iteration` argument for the `tf.data.Dataset.random()` operation, which controls whether the sequence of generated random numbers should be re-randomized every epoch or not (the default behavior). If `seed` is set and `rerandomize_each_iteration=True`, the `random()` operation will produce a different (deterministic) sequence of numbers every epoch.

"můj", "svým", "ta", "tomto", "tohle", "tuto", "tyto", "jej", "zda", "proč", "máte", "tato", "kam", "tohoto", "kdo", "kteří", "mi", "nám", "tom", "tomuto", "mít", "nic", "proto", "kterou", "byla", "toho", "protože", "asi", "ho", "naši", "napište", "re", "což", "tím", "takže", "svých", "její", "svými", "jste", "aj", "tu", "tedy", "teto", "bylo", "kde", "ke", "pravé", "ji", "nad", "nejsou", "či", "pod", "téma", "mezi", "přes", "ty", "pak", "vám", "ani", "když", "však", "neg", "jsem", "tento", "článku",...

"můj", "svým", "ta", "tomto", "tohle", "tuto", "tyto", "jej", "zda", "proč", "máte", "tato", "kam", "tohoto", "kdo", "kteří", "mi", "nám", "tom", "tomuto", "mít", "nic", "proto", "kterou", "byla", "toho", "protože", "asi", "ho", "naši", "napište", "re", "což", "tím", "takže", "svých", "její", "svými", "jste", "aj", "tu", "tedy", "teto", "bylo", "kde", "ke", "pravé", "ji", "nad", "nejsou", "či", "pod", "téma", "mezi", "přes", "ty", "pak", "vám", "ani", "když", "však", "neg", "jsem", "tento", "článku",...

### Other notable changes

* Kubelet won't evict a static pod with priority `system-node-critical` upon resource pressure. ([#74222](https://github.com/kubernetes/kubernetes/pull/74222), [@Huang-Wei](https://github.com/Huang-Wei))
* Re-issue Allocate grpc calls before starting a container that requests device-plugin resources if the cached state is missing. ([#73824](https://github.com/kubernetes/kubernetes/pull/73824), [@jiayingz](https://github.com/jiayingz))

        /* JCIFS will build a composite list of shares if the target host has
         * multiple IP addresses such as when domain-based DFS is in play. Because
         * of this, to ensure that we query each IP individually without re-resolving
         * the hostname and getting a different IP, we must use the current addresses
         * IP rather than just url.getHost() like we were using prior to 1.2.16.
         */

## Changelog since v1.22.9

## Changes by Kind

### Bug or Regression

- Correct event registration for multiple scheduler plugins; this fixes a potential significant delay in re-queueing unschedulable pods. ([#109447](https://github.com/kubernetes/kubernetes/pull/109447), [@ahg-g](https://github.com/ahg-g)) [SIG Scheduling and Testing]

    /** The key of the message: Data Migration */
    public static final String LABELS_upgrade_data_migration = "{labels.upgrade_data_migration}";

    /** The key of the message: Re-indexing */
    public static final String LABELS_upgrade_reindex = "{labels.upgrade_reindex}";

    /** The key of the message: Start */

* Access to externally managed IP addresses via the kube-apiserver service proxy subresource is no longer allowed by default. This can be re-enabled via the `ServiceProxyAllowExternalIPs` feature gate, but will be disallowed completely in 1.11 ([#57265](https://github.com/kubernetes/kubernetes/pull/57265), [@brendandburns](https://github.com/brendandburns))