if res != nil && res.NormDN == cred.ParentUser {
			denyOnly = true
		}
	}

	// Check if action is allowed if creating access key for another user
	// Check if action is explicitly denied if for self
	if !globalIAMSys.IsAllowed(policy.Args{
		AccountName:     cred.AccessKey,
		Groups:          cred.Groups,
		Action:          policy.CreateServiceAccountAdminAction,
		ConditionValues: condValues,
		IsOwner:         owner,

				var isErr bool
				evt := evalActionFromLifecycle(ctx, *lc, rcfg, replcfg, goi)
				switch evt.Action {
				case lifecycle.DeleteAllVersionsAction, lifecycle.DelMarkerDeleteAllVersionsAction:
					// opts.DeletePrefix is used only in the above lifecycle Expiration actions.
				default:
					// object has been modified since lifecycle action was previously evaluated
					isErr = true
				}
				if isErr {

#### Storage

* [stable] Mount options

  * The ability to specify mount options for volumes is moved from beta to stable.

  * A new `MountOptions` field in the `PersistentVolume` spec is available to specify mount options. This field replaces an annotation.

  * A new `MountOptions` field in the `StorageClass` spec allows configuration of mount options for dynamically provisioned volumes.

    - [Action Required](#action-required-4)
    - [Other notable changes](#other-notable-changes-20)
- [v1.7.0-alpha.3](#v170-alpha3)
  - [Downloads for v1.7.0-alpha.3](#downloads-for-v170-alpha3)
    - [Client Binaries](#client-binaries-21)
    - [Server Binaries](#server-binaries-21)
    - [Node Binaries](#node-binaries-21)
  - [Changelog since v1.7.0-alpha.2](#changelog-since-v170-alpha2)
    - [Action Required](#action-required-5)

infringement claim (excluding declaratory judgment actions,
counter-claims, and cross-claims) alleging that a Contributor Version
directly or indirectly infringes any patent, then the rights granted to
You by any and all Contributors for the Covered Software under Section
2.1 of this License shall terminate.

5.3. In the event of termination under Sections 5.1 or 5.2 above, all

  - [Changelog since v1.4.0-alpha.3](#changelog-since-v140-alpha3)
    - [Action Required](#action-required)
    - [Other notable changes](#other-notable-changes-16)
- [v1.4.0-alpha.3](#v140-alpha3)
  - [Downloads](#downloads-15)
  - [Changelog since v1.4.0-alpha.2](#changelog-since-v140-alpha2)
    - [Action Required](#action-required-1)
    - [Other notable changes](#other-notable-changes-17)

    - [Action Required](#action-required)
    - [Other notable changes](#other-notable-changes-10)
- [v1.5.0-alpha.2](#v150-alpha2)
  - [Downloads for v1.5.0-alpha.2](#downloads-for-v150-alpha2)
    - [Client Binaries](#client-binaries-12)
    - [Server Binaries](#server-binaries-12)
  - [Changelog since v1.5.0-alpha.1](#changelog-since-v150-alpha1)
    - [Action Required](#action-required-1)

    - [Action Required](#action-required-2)
    - [Other notable changes](#other-notable-changes-20)
- [v1.6.0-beta.1](#v160-beta1)
  - [Downloads for v1.6.0-beta.1](#downloads-for-v160-beta1)
    - [Client Binaries](#client-binaries-18)
    - [Server Binaries](#server-binaries-18)
  - [Changelog since v1.6.0-alpha.3](#changelog-since-v160-alpha3)
    - [Action Required](#action-required-3)

A security issue was discovered in kube-apiserver that could allow an attacker controlled aggregated API server to redirect client traffic to any URL.  This could lead to the client performing unexpected actions as well as leaking the client's credentials to third parties. 

    - [Action Required](#action-required)
    - [Other notable changes](#other-notable-changes-7)
- [v1.11.2](#v1112)
  - [Downloads for v1.11.2](#downloads-for-v1112)
    - [Client Binaries](#client-binaries-8)
    - [Server Binaries](#server-binaries-8)
    - [Node Binaries](#node-binaries-8)
  - [Changelog since v1.11.1](#changelog-since-v1111)
    - [Action Required](#action-required-1)