The Panther took pie-crust, and gravy, and meat,
    While the Owl had the dish as its share of the treat.
    When the pie was all finished, the Owl, as a boon,
    Was kindly permitted to pocket the spoon:
    While the Panther received knife and fork with a growl,
    And concluded the banquet--]

  `What IS the use of repeating all that stuff,' the Mock Turtle

	tok := p.peek()
	if tok == '>' {
		isStatic = true
	} else if tok == scanner.Ident {
		abistr := p.get(scanner.Ident).String()
		if !p.allowABI {
			if issueError {
				p.errorf("ABI selector only permitted when compiling runtime, reference was to %q", name)
			}
		} else {
			theabi, valid := obj.ParseABI(abistr)
			if !valid {
				if issueError {
					p.errorf("malformed ABI selector %q in reference to %q",

* Fix panic when using `kubeadm init` with vsphere cloud-provider. ([#44661](https://github.com/kubernetes/kubernetes/pull/44661), [@xiangpengzhao](https://github.com/xiangpengzhao))
* kubectl: Fix bug that showed terminated/evicted pods even without `--show-all`. ([#48786](https://github.com/kubernetes/kubernetes/pull/48786), [@janetkuo](https://github.com/janetkuo))

* CustomResourceDefinitions: OpenAPI v3 validation schemas containing `$ref`references are no longer permitted (valid references could not be constructed previously because property ids were not permitted either). Before upgrading, ensure CRD definitions do not include those `$ref` fields. ([#58438](https://github.com/kubernetes/kubernetes/pull/58438), [@carlory](https://github.com/carlory))

    //  * URI is much more strict than HttpUrl or URL on what's accepted.
    //
    // HttpUrl is quite lenient with what characters it accepts. In particular, characters like '{'
    // and '"' are permitted but unlikely to occur in real-world URLs. Unfortunately we can't just
    // lock it down due to URL templating: "http://{env}.{dc}.example.com".
    UrlComponentEncodingTester
      .newInstance()

* If ExperimentalCriticalPodAnnotation=True flag gate is set, kubelet will ensure that pods with `scheduler.alpha.kubernetes.io/critical-pod` annotation will be admitted even under resource pressure, will not be evicted, and are reasonably protected from system OOMs. ([#41052](https://github.com/kubernetes/kubernetes/pull/41052), [@vishh](https://github.com/vishh))

* If ExperimentalCriticalPodAnnotation=True flag gate is set, kubelet will ensure that pods with `scheduler.alpha.kubernetes.io/critical-pod` annotation will be admitted even under resource pressure, will not be evicted, and are reasonably protected from system OOMs. ([#41052](https://github.com/kubernetes/kubernetes/pull/41052), [@vishh](https://github.com/vishh))

    assertThat(response.body.string()).isEqualTo("abc")
    assertThat(server.takeRequest().exchangeIndex).isEqualTo(0)

    // Note that although we have two routes available, we only use one. The retry is permitted
    // because there are routes available, but it chooses the existing connection since it isn't
    // yet considered unhealthy.
    assertThat(server.takeRequest().exchangeIndex).isEqualTo(1)
  }

        .build(),
    )
    val url = server.url("/a")
    assertThat(get(url).body.string()).isEqualTo("a")
    val i: Iterator<String> = cache.urls()
    cache.evictAll()

    // The URL was evicted before hasNext() made any promises.
    assertThat(i.hasNext()).isFalse()
    assertFailsWith<NoSuchElementException> {
      i.next()
    }
  }

- Reverted a kubectl azure auth module change where oidc claim spn: prefix was omitted resulting a breaking behavior with existing Azure AD OIDC enabled api-server ([#87507](https://github.com/kubernetes/kubernetes/pull/87507), [@weinong](https://github.com/weinong)) [SIG API Machinery, Auth and Cloud Provider]