- Kubernetes 1.24 is built with go1.18, which will no longer validate certificates signed with a SHA-1 hash algorithm by default. See https://golang.org/doc/go1.18#sha1 for more details. If you are using certificates like this in admission or conversion ([#109024](https://github.com/kubernetes/kubernetes/pull/109024), [@stlaz](https://github.com/stlaz))

    <sub-class-of type="text/plain"/>
  </mime-type>

  <mime-type type="text/calendar">
    <magic priority="50">
      <match value="BEGIN:VCALENDAR" type="string" offset="0">
        <match value="\nVERSION:2.0" type="string" offset="15:360"/>
      </match>
    </magic>
    <glob pattern="*.ics"/>
    <glob pattern="*.ifb"/>
    <sub-class-of type="text/plain"/>
  </mime-type>

re-enable deprecated legacy behavior of treating the CommonName of X.509 serving certificates as a host name. This behavior has been disabled by default since Kubernetes 1.19 / go 1.15. Serving certificates used by admission webhooks, custom resource conversion webhooks, and aggregated API servers must now include valid Subject Alternative Names. If you are running Kubernetes 1.22 with `GODEBUG=x509ignoreCN=0` set, check the `apiserver_kube_aggregator_x509_missing_san_total` and `apiserver_webhooks_x5...

- The go version defined in `.go-version` is now fetched when invoking test, build, and code generation targets if the current go version does not match it. Set $FORCE_HOST_GO=y while testing or building to skip this behavior, or set $GO_VERSION to override the selected go version. ([#115497](https://github.com/kubernetes/kubernetes/pull/115497), [@liggitt](https://github.com/liggitt)) [SIG Release and Testing]

### Bug or Regression

- The go version defined in `.go-version` is now fetched when invoking test, build, and code generation targets if the current go version does not match it. Set $FORCE_HOST_GO=y while testing or building to skip this behavior, or set $GO_VERSION to override the selected go version. ([#115496](https://github.com/kubernetes/kubernetes/pull/115496), [@liggitt](https://github.com/liggitt)) [SIG Release and Testing]

### Failing Test

pkg crypto/tls, const VersionTLS11 ideal-int
pkg crypto/tls, const VersionTLS12 = 771
pkg crypto/tls, const VersionTLS12 ideal-int
pkg crypto/tls, type Config struct, MaxVersion uint16
pkg crypto/tls, type Config struct, MinVersion uint16
pkg crypto/x509, func MarshalECPrivateKey(*ecdsa.PrivateKey) ([]uint8, error)
pkg crypto/x509, type Certificate struct, CRLDistributionPoints []string
pkg crypto/x509, type Certificate struct, Extensions []pkix.Extension