* If ExperimentalCriticalPodAnnotation=True flag gate is set, kubelet will ensure that pods with `scheduler.alpha.kubernetes.io/critical-pod` annotation will be admitted even under resource pressure, will not be evicted, and are reasonably protected from system OOMs. ([#41052](https://github.com/kubernetes/kubernetes/pull/41052), [@vishh](https://github.com/vishh))

    assertThat(response.body.string()).isEqualTo("abc")
    assertThat(server.takeRequest().exchangeIndex).isEqualTo(0)

    // Note that although we have two routes available, we only use one. The retry is permitted
    // because there are routes available, but it chooses the existing connection since it isn't
    // yet considered unhealthy.
    assertThat(server.takeRequest().exchangeIndex).isEqualTo(1)
  }

        .build(),
    )
    val url = server.url("/a")
    assertThat(get(url).body.string()).isEqualTo("a")
    val i: Iterator<String> = cache.urls()
    cache.evictAll()

    // The URL was evicted before hasNext() made any promises.
    assertThat(i.hasNext()).isFalse()
    assertFailsWith<NoSuchElementException> {
      i.next()
    }
  }

- Reverted a kubectl azure auth module change where oidc claim spn: prefix was omitted resulting a breaking behavior with existing Azure AD OIDC enabled api-server ([#87507](https://github.com/kubernetes/kubernetes/pull/87507), [@weinong](https://github.com/weinong)) [SIG API Machinery, Auth and Cloud Provider]

		// For owner account and when plugin authZ is configured always set
		// effective policy as `consoleAdmin`.
		//
		// In the latter case, we let the UI render everything, but individual
		// actions would fail if not permitted by the external authZ service.
		for _, policy := range policy.DefaultPolicies {
			if policy.Name == "consoleAdmin" {
				effectivePolicy = policy.Definition
				break
			}
		}

this source code is governed by a BSD-style // license that can be found in the LICENSE file. //go:build !purego #include "textflag.h" // carryPropagate works exactly like carryPropagateGeneri and uses the // same AND, ADD, and LSR+MADD instructions emitted by the compiler, but // avoids loading R0-R4 twice and uses LDP and STP. // // See https://golang.org/issues/43145 for the main compiler issue. // // func carryPropagate(v *Element) TEXT ·carryPropagate(SB),NOFRAME|NOSPLIT,$0-8 MOVD v+0(FP), R20 LDP...

## Action Required

- etcd2 as a backend is deprecated and support will be removed in Kubernetes 1.13.

- Ensure `InstanceShutdownByProviderID` return false for creating Azure VMs. ([#104382](https://github.com/kubernetes/kubernetes/pull/104382), [@feiskyer](https://github.com/feiskyer))
- Evicted and other terminated Pods will no longer revert to the `Running` phase. ([#105462](https://github.com/kubernetes/kubernetes/pull/105462), [@ehashman](https://github.com/ehashman))

- Fixed a race condition on API server startup ensuring previously created webhook configurations are effective before the first write request is admitted. ([#95783](https://github.com/kubernetes/kubernetes/pull/95783), [@roycaihw](https://github.com/roycaihw)) [SIG API Machinery]

- Fixed a race condition on API server startup ensuring previously created webhook configurations are effective before the first write request is admitted. ([#95783](https://github.com/kubernetes/kubernetes/pull/95783), [@roycaihw](https://github.com/roycaihw)) [SIG API Machinery]