- Support for proxying a request to a peer kube-apiserver if the local apiserver is not able to serve it due to version skew or in the case the requested api is disabled on the local apiserver ([#117740](https://github.com/kubernetes/kubernetes/pull/117740), [@Richabanker](https://github.com/Richabanker))...

*   `conversion-gen` is now usable in a context without a vendored k8s.io/kubernetes. The Kubernetes core API is removed from `default extra-peer-dirs`. ([#54394](https://github.com/kubernetes/kubernetes/pull/54394),[ @sttts](https://github.com/sttts))

KAAK6T,QAAc,OAA0B,IAAjB7T,KAAK6T,QAAgB,IAAM,OACxD,OAGRoB,QAAS,WACL,MACI,WACgB,EAAfjV,KAAK6T,QAAc,OAA0B,IAAjB7T,KAAK6T,QAAgB,IAAM,OACxD,OAGRqB,SAAU,WACN,OAAQlV,KAAKqT,OACT,KAAK,EACD,MACI,uBACgB,EAAfrT,KAAK6T,QACA,OACiB,IAAjB7T,KAAK6T,QACL,IACA,OACN,MAER,QACI,MACI,uBACgB,EAAf7T,KAAK6T,QACA,OACiB,IAAjB7T,KAAK6T,QACL,IACA,OACN,QAIhBsB,SAAU,KAEdQ,aAAc,CACVC,OAAQ,SACRC,KAAM,QACNnI,EAAG,iBACHoI,GAAI,aACJpT,EAAG,YACHqT,GAAI,YACJC,EAAG,SACHC,GAAI,SACJxD,EAAG,YACHyD,GAAI,YACJC,EAAG,gBACHC,GAAI,eACJC,EAAG,...

a problem where spurious retransmits in a long-running TCP connection to a service
IP could result in the connection being closed with the error "Connection reset by
peer" ([#74840](https://github.com/kubernetes/kubernetes/pull/74840), [@anfernee](https://github.com/anfernee))

,calendar:{sameDay:"[oxhi \xe0] LT",nextDay:"[dem\xe0 \xe0] LT",nextWeek:"dddd [\xe0] LT",lastDay:"[ieiri \xe0] LT",lastWeek:"[s\xfcr el] dddd [lasteu \xe0] LT",sameElse:"L"},relativeTime:{future:"osprei %s",past:"ja%s",s:Er,ss:Er,m:Er,mm:Er,h:Er,hh:Er,d:Er,dd:Er,M:Er,MM:Er,y:Er,yy:Er},dayOfMonthOrdinalParse:/\d{1,2}\./,ordinal:"%d.",week:{dow:1,doy:4}}),M.defineLocale("tzm-latn",{months:"innayr_br\u02e4ayr\u02e4_mar\u02e4s\u02e4_ibrir_mayyw_ywnyw_ywlywz_\u0263w\u0161t_\u0161wtanbir_kt\u02e4wbr\...

* Adds an approval work flow to the certificate approver that will approve certificate signing requests from kubelets that meet all the criteria of kubelet server certificates. ([#46884](https://github.com/kubernetes/kubernetes/pull/46884), [@jcbsmpsn](https://github.com/jcbsmpsn))

* Adds an approval work flow to the certificate approver that will approve certificate signing requests from kubelets that meet all the criteria of kubelet server certificates. ([#46884](https://github.com/kubernetes/kubernetes/pull/46884), [@jcbsmpsn](https://github.com/jcbsmpsn))

s/kubernetes/pull/57902), [@kawych](https://github.com/kawych))

* On cluster provision or upgrade, kubeadm now generates certs and secures all connections to the etcd static-pod with mTLS. This includes the etcd serving cert, the etcd peer cert, and the apiserver etcd client cert. Flags and hostMounts are added to the etcd and apiserver static-pods to load these certs. For connections to etcd, https is now used in favor of http. ([#57415](https://github.com/kubernetes/kubernetes/pull/57415),...

- Kubeadm: ignore EINVAL when unmounting /var/lib/kubelet peer mounts during reset ([#137571](https://github.com/kubernetes/kubernetes/pull/137571), [@fuweid](https://github.com/fuweid)) [SIG Cluster Lifecycle]

## Dependencies

### Added
_Nothing has changed._

### Changed

- Kubeadm: ignore EINVAL when unmounting /var/lib/kubelet peer mounts during reset ([#137570](https://github.com/kubernetes/kubernetes/pull/137570), [@fuweid](https://github.com/fuweid)) [SIG Cluster Lifecycle]

## Dependencies

### Added
_Nothing has changed._

### Changed