* Fixing a bug in OpenStack cloud provider, where dual stack deployments (IPv4 and IPv6) did not work well when using kubenet as the network plugin. ([#59749](https://github.com/kubernetes/kubernetes/pull/59749), [@zioproto](https://github.com/zioproto))

- Fixed a bug where a change in the `appProtocol` for a Service did not trigger a load balancer update. ([#113032](https://github.com/kubernetes/kubernetes/pull/113032), [@MartinForReal](https://github.com/MartinForReal)) [SIG Cloud Provider and Network]

* `kubeadm join` is now blocking on the kubelet performing the TLS Bootstrap properly. Earlier, `kubeadm join` only did the discovery part and exited successfully without checking that the kubelet actually started properly and performed the TLS bootstrap correctly. Now, as kubeadm runs some post-join steps (for example, annotating the Node API object with the CRISocket),...

* Fixed a bug in the single-numa-node policy of the TopologyManager.  Previously, pods that only requested CPU resources and did not request any third-party devices would fail to launch with a TopologyAffinity error. Now they will launch successfully. ([#83697](https://github.com/kubernetes/kubernetes/pull/83697), [@klueska](https://github.com/klueska))

,MAAMnG,KAAKqD,EAAO+C,iBAnaR,gEAoaxB0H,QAAO,SAAAoF,GAAI,OAAI1U,UAAE0U,GAAM9Q,GAAG,eAE7B,GAAqB,IAAjB6Q,EAAM1M,OAAV,CAIA,IAAIiD,EAAQyJ,EAAMnI,QAAQhJ,EAAMK,QApcX,KAscjBL,EAAM+I,OAA8BrB,EAAQ,GAC9CA,IAtcqB,KAycnB1H,EAAM+I,OAAgCrB,EAAQyJ,EAAM1M,OAAS,GAC/DiD,IAGEA,EAAQ,IACVA,EAAQ,GAGVyJ,EAAMzJ,GAAOhE,Y,6BA7Yf,WACE,MA9EY,U,mBAiFd,WACE,OAAOsB,K,uBAGT,WACE,OAAOO,O,EArBLqJ,GAiaNlS,UAAEZ,UACC0G,GAAG4L,GAAwB5C,GAAsBoD,GAASsC,wBAC1D1O,GAAG4L,GAAwBC,GAAeO,GAASsC,wBACnD1O,GAAM2L,iCAAgDS,GAASQ,aAC/D5M,GAAG2L,GAA...

- Fixed a regression which prevented pods with `docker/default` seccomp annotations from being created in 1.19 if a PodSecurityPolicy was in place which did not allow `runtime/default` seccomp profiles. ([#95985](https://github.com/kubernetes/kubernetes/pull/95985), [@saschagrunert](https://github.com/saschagrunert)) [SIG Auth]

* If the `TokenRequestProjection` feature gate is disabled, projected serviceAccountToken volume sources are now dropped at object creation time, or at object update time if the existing object did not have a projected serviceAccountToken volume source. Previously, these would result in validation errors. ([#72714](https://github.com/kubernetes/kubernetes/pull/72714), [@mourya007](https://github.com/mourya007))

* Bump addon-manager to v9.0.1 ([#77282](https://github.com/kubernetes/kubernetes/pull/77282), [@MrHohn](h...

* kubeadm: fix an issue where 'config view' did not return a config in case of a 1.12 cluster ([#69969](https://github.com/kubernetes/kubernetes/pull/69969), [@neolit123](https://github.com/neolit123))

- Fixed a regression which prevented pods with `docker/default` seccomp annotations from being created in 1.19 if a PodSecurityPolicy was in place which did not allow `runtime/default` seccomp profiles. ([#95990](https://github.com/kubernetes/kubernetes/pull/95990), [@saschagrunert](https://github.com/saschagrunert)) [SIG Auth]