- Kubeadm: fixed a bug during kubeadm upgrade, where it is not possible to mount a new device and create a symbolic link for /etc/kubernetes (or a sub-directory) so that kubeadm stores its information on the mounted device. ([#123406](https://github.com/kubernetes/kubernetes/pull/123406), [@SataQiu](https://github.com/SataQiu))

- CRDs under k8s.io and kubernetes.io must have the `api-approved.kubernetes.io` set to either `unapproved.*` or a link to the pull request approving the schema. See https://github.com/kubernetes/enhancements/pull/1111 for more details. ([#79992](https://github.com/kubernetes/kubernetes/pull/79992), [@deads2k](https://github.com/deads2k))

pkg syscall (netbsd-arm64-cgo), type Stat_t struct, Mode uint32
pkg syscall (netbsd-arm64-cgo), type Stat_t struct, Mtimespec Timespec
pkg syscall (netbsd-arm64-cgo), type Stat_t struct, Nlink uint32
pkg syscall (netbsd-arm64-cgo), type Stat_t struct, Pad_cgo_0 [4]uint8
pkg syscall (netbsd-arm64-cgo), type Stat_t struct, Pad_cgo_1 [4]uint8
pkg syscall (netbsd-arm64-cgo), type Stat_t struct, Pad_cgo_2 [4]uint8

    * An ip address is required for the cache instance to listen for requests on, default is a link local ip address of value 169.254.20.10
* Fix dry-run output in kubectl apply --prune ([#69344](https://github.com/kubernetes/kubernetes/pull/69344), [@zegl](https://github.com/zegl))

pkg syscall (freebsd-arm64), type Stat_t struct, Mode uint16
pkg syscall (freebsd-arm64), type Stat_t struct, Mtimespec Timespec
pkg syscall (freebsd-arm64), type Stat_t struct, Nlink uint64
pkg syscall (freebsd-arm64), type Stat_t struct, Padding0 int16
pkg syscall (freebsd-arm64), type Stat_t struct, Padding1 int32
pkg syscall (freebsd-arm64), type Stat_t struct, Rdev uint64

pkg syscall (darwin-arm64), type Stat_t struct, Mode uint16
pkg syscall (darwin-arm64), type Stat_t struct, Mtimespec Timespec
pkg syscall (darwin-arm64), type Stat_t struct, Nlink uint16
pkg syscall (darwin-arm64), type Stat_t struct, Pad_cgo_0 [4]uint8
pkg syscall (darwin-arm64), type Stat_t struct, Qspare [2]int64
pkg syscall (darwin-arm64), type Stat_t struct, Rdev int32

* kubeadm: fix a bug related to volume unmount if the kubelet run directory is a symbolic link ([#77507](https://github.com/kubernetes/kubernetes/pull/77507), [@cuericlee](https://github.com/cuericlee))
* n/a ([#78059](https://github.com/kubernetes/kubernetes/pull/78059), [@figo](https://github.com/figo))

### Documentation

- Fix ALPHA stability level reference link ([#98641](https://github.com/kubernetes/kubernetes/pull/98641), [@Jeffwan](https://github.com/Jeffwan)) [SIG Auth, Cloud Provider, Instrumentation and Storage]

### Failing Test

pkg syscall (freebsd-riscv64), type Stat_t struct, Mode uint16 #53466
pkg syscall (freebsd-riscv64), type Stat_t struct, Mtimespec Timespec #53466
pkg syscall (freebsd-riscv64), type Stat_t struct, Nlink uint64 #53466
pkg syscall (freebsd-riscv64), type Stat_t struct, Padding0 int16 #53466
pkg syscall (freebsd-riscv64), type Stat_t struct, Padding1 int32 #53466

The merged fix enforces validation against the proxying address for a Node. In some cases, the fix can break clients that depend on the `nodes/proxy` subresource, specifically if a kubelet advertises a localhost or link-local address to the Kubernetes control plane. Configuring an egress proxy for egress to the cluster network can also mitigate this vulnerability.

**Affected Versions**:
  - kube-apiserver v1.25.0 - v1.25.3