- Image garbage collection no longer fails for images with only one tag but more than one repository associated. ([#70647](https://github.com/kubernetes/kubernetes/pull/70647), [@corvus-ch](https://github.com/corvus-ch))
- Re-issued Allocate grpc calls before starting a container that requests device-plugin resources if the cached state is missing. ([#73824](https://github.com/kubernetes/kubernetes/pull/73824), [@jiayingz](https://github.com/jiayingz))

		for _, group := range entity.Groups {
			m[group] = append(m[group], entity.Policy)
		}
	}

	{
		// We don't compare the values of the canned policies because server is
		// re-encoding them. (FIXME?)
		for k := range content.policies {
			content.policies[k] = nil
			gotContent.policies[k] = nil
		}
		if !reflect.DeepEqual(content.policies, gotContent.policies) {

- Terminated Pods on a node will not be re-admitted on kubelet restart. This fixes the problem of Completed Pods awaiting for the finalizer marked as Failed after the kubelet restart. ([#127208](https://github.com/kubernetes/kubernetes/pull/127208), [@SergeyKanzhelev](https://github.com/SergeyKanzhelev))...

* Applies zone labels to vSphere Volumes and honors allowedTopologies when provisioning. ([#74654](https://github.com/kubernetes/kubernetes/pull/74654), [@subramanian-neelakantan](https://github.com/subramanian-neelakantan))
* Re-issue Allocate grpc calls before starting a container that requests device-plugin resources if the cached state is missing. ([#73824](https://github.com/kubernetes/kubernetes/pull/73824), [@jiayingz](https://github.com/jiayingz))

}PùÏ”r~¹¿mÙeF•ß4Ý`ƒR”yߌ,? $b•‚¯ˆÒSš˜brû…h^Ûmà6ì Ь€‰| ‹ á Á¦ z«ïúz¡<þ³ qbf‹_t¦N+ ž#Bpé¢3šy§“â ²KÄ¡)î6‡H)êŸ#C à‘‹—Õ-ú>Z©FMÉiÐ i4 Øß ž80”¸Ùe°ZDy] wÖY+Ïé¬ë a(`lm×0ãúµÞ¬ÂcY%l#¢ íb ñOÏD Áæ Å5 ¦ ? ¤ ýEë»[oõ´ Î- pltO;7WËpË~N (£)½È6^N G›CR•€§‚… ˜qÅÖ~â6tŒ·¨éœ7œã \âyçðs9M rE ÿf§«ú”ΈI ‰LÝ ²Š¬ÆR€| Ã’1üXòÇàktÉv^W¼ØÔ%§aGü݈8ñÂä œ¾¬¹ ¸õeo`¸è` ÈD{8‘?o•Y ‡Läœv¯V…žlvZ– ´Â“?Ù¬`‡oÕvMIrì5'˜ c²— o’ n¾Ag ‘ ÈK[Ï •R+â% ÐK© _ áYœ ¼… ;7M®Q x j)Š¡Zëqj( BÏÜÔ’ ræçªÖa`Ø­ûr WÇ‚Bõ#“v„ ¡—¾ ) ´Ö ÷W9 ¾G 2ÊÐæ‡ FÐ]ÚâÂÉV€^éYK/ÑzŸ°Ù™+æÏ— C‘nÈ%¼ ÂØM’òÈýUã¦ó4Íó7...

- Kubernetes is now built with Go 1.20.11 ([#121810](https://github.com/kubernetes/kubernetes/pull/121810), [@cpanato](https://github.com/cpanato)) [SIG Release and Testing]

### Bug or Regression

  * `kubectl delete podsecuritypolicies/my-privileged-policy`
3. After upgrading to 1.5.5, re-create the exported PodSecurityPolicy objects:
  * `kubectl create -f psp.yaml`

## Downloads for v1.5.5


filename | sha256 hash
-------- | -----------

32F8          ; mapped                 ; 30EB          # 1.1  CIRCLED KATAKANA RU
32F9          ; mapped                 ; 30EC          # 1.1  CIRCLED KATAKANA RE
32FA          ; mapped                 ; 30ED          # 1.1  CIRCLED KATAKANA RO
32FB          ; mapped                 ; 30EF          # 1.1  CIRCLED KATAKANA WA

* Access to externally managed IP addresses via the kube-apiserver service proxy subresource is no longer allowed by default. This can be re-enabled via the `ServiceProxyAllowExternalIPs` feature gate, but will be disallowed completely in 1.11 ([#57265](https://github.com/kubernetes/kubernetes/pull/57265), [@brendandburns](https://github.com/brendandburns))

across reboots of the host and restarts of the kubelet.
  
  The kubelet ensures any image requiring credential verification is always pulled if authentication information from an image pull is not yet present, thus enforcing authentication / re-authentication. This means an image pull might be attempted even in cases where a pod requests the `IfNotPresent` image pull policy, and might lead to the pod not starting if its pull policy is `Never` and is unable to present authentication information...