A security issue was discovered in Kubernetes where a large number of container checkpoint requests made to the unauthenticated kubelet read-only HTTP endpoint may cause a Node Denial of Service by filling the Node's disk.

**Affected Versions**:
  - kubelet kubelet v1.30.0 to v1.30.9
  - kubelet v1.31.0 to v1.31.5
  - kubelet v1.32.0 to v1.32.1

**Fixed Versions**:
  - kubelet 1.29.14
  - kubelet 1.30.10

- Fixed PersistentolumeLabel providing wrong topology labels to Azure Disk PersistentVolumes when the external Azure cloud provider is used. ([#124528](https://github.com/kubernetes/kubernetes/pull/124528), [@jsafrane](https://github.com/jsafrane)) [SIG Cloud Provider]

	} else {
		err = signRequestV2(request, s.accessKey, s.secretKey)
	}
	c.Assert(err, nil)
	// execute the HTTP request.
	// the content is expected to have the content of previous disk.
	response, err = s.client.Do(request)
	c.Assert(err, nil)
	c.Assert(response.StatusCode, http.StatusOK)

	// creating HTTP request to fetch the previously uploaded object.

- Check for newer resize fields when deciding recovery feature's status in kubelet ([#131437](https://github.com/kubernetes/kubernetes/pull/131437), [@gnufied](https://github.com/gnufied)) [SIG Storage]
- Disable reading of disk geometry before calling expansion for ext and xfs filesystems ([#131636](https://github.com/kubernetes/kubernetes/pull/131636), [@gnufied](https://github.com/gnufied)) [SIG Storage]

A security issue was discovered in Kubernetes where a large number of container checkpoint requests made to the unauthenticated kubelet read-only HTTP endpoint may cause a Node Denial of Service by filling the Node's disk.

**Affected Versions**:
  - kubelet kubelet v1.30.0 to v1.30.9
  - kubelet v1.31.0 to v1.31.5
  - kubelet v1.32.0 to v1.32.1

**Fixed Versions**:
  - kubelet 1.29.14
  - kubelet 1.30.10

## Changelog since v1.28.9

## Changes by Kind

### Bug or Regression

- Fixed PersistentolumeLabel providing wrong topology labels to Azure Disk PersistentVolumes when the external Azure cloud provider is used. ([#124528](https://github.com/kubernetes/kubernetes/pull/124528), [@jsafrane](https://github.com/jsafrane)) [SIG Cloud Provider]

- Disabled reading of disk geometry before calling expansion for ext and xfs filesystems. ([#131568](https://github.com/kubernetes/kubernetes/pull/131568), [@gnufied](https://github.com/gnufied))

      This is a callback function wrapper that will be executed to determine how
      tensors will be split into shards when the saver writes the checkpoint
      shards to disk. `tf.train.experimental.ShardByTaskPolicy` is the default
      sharding behavior, but `tf.train.experimental.MaxShardSizePolicy` can be
      used to shard the checkpoint with a maximum shard file size. Users with

- Unmounted volumes correctly for reconstructed volumes even if mount operation fails after kubelet restart. ([#110670](https://github.com/kubernetes/kubernetes/pull/110670), [@gnufied](https://github.com/gnufied))
- Updated max azure data disk count map with new VM types. ([#111406](https://github.com/kubernetes/kubernetes/pull/111406), [@bennerv](https://github.com/bennerv))

- Kubernetes is now built with Go 1.19.9 ([#117774](https://github.com/kubernetes/kubernetes/pull/117774), [@xmudrii](https://github.com/xmudrii)) [SIG Release and Testing]

### Failing Test

- Allow Azure Disk e2es to use newer topology labels if available from nodes ([#117216](https://github.com/kubernetes/kubernetes/pull/117216), [@gnufied](https://github.com/gnufied)) [SIG Storage and Testing]

### Bug or Regression