## Changelog since v1.12.8

### Other notable changes

* Active watches of custom resources now terminate properly if the CRD is modified. ([#78029](https://github.com/kubernetes/kubernetes/pull/78029), [@liggitt](https://github.com/liggitt))

- The pod phase lifecycle guarantees that terminal Pods, those whose states are Unready or Succeeded, can not regress and will have all container stopped. Hence, terminal Pods will never be reachable and should not publish their IP addresses on the Endpoints or EndpointSlices, independently of the Service TolerateUnready option. ([#110260](https://github...

  
    To address this, the new debian-hyperkube-base image (v1.1.0) uses the
    debian-iptables base image (v12.1.0), which includes iptables-wrapper, a
    script used to determine the correct iptables mode to run in. ([#92493](https://github.com/kubernetes/kubernetes/pull/92493), [@justaugustus](https://github.com/justaugustus)) [SIG Cluster Lifecycle and Release]

## Dependencies

### Added

- **Auth**
  - [alpha] Container Image Policy allows an access controller to determine whether a pod may be scheduled based on a policy ([docs](http://kubernetes.io/docs/admin/admission-controllers/#imagepolicywebhook)) ([kubernetes/features#59](https://github.com/kubernetes/enhancements/issues/59))

* `tf.train.CheckpointOptions` and `tf.saved_model.SaveOptions`
    * These now take in a new argument called `experimental_sharding_callback`.
      This is a callback function wrapper that will be executed to determine how
      tensors will be split into shards when the saver writes the checkpoint
      shards to disk. `tf.train.experimental.ShardByTaskPolicy` is the default

* Fixed regression in initial kubectl exec terminal dimensions ([#51127](https://github.com/kubernetes/kubernetes/pull/51127), [@chen-anders](https://github.com/chen-anders))

- Active watches of custom resources now terminate properly if the CRD is modified. ([#78029](https://github.com/kubernetes/kubernetes/pull/78029), [@liggitt](https://github.com/liggitt))

pkg syscall (linux-arm-cgo), type Termios struct
pkg syscall (linux-arm-cgo), type Termios struct, Cc [32]uint8
pkg syscall (linux-arm-cgo), type Termios struct, Cflag uint32
pkg syscall (linux-arm-cgo), type Termios struct, Iflag uint32
pkg syscall (linux-arm-cgo), type Termios struct, Ispeed uint32
pkg syscall (linux-arm-cgo), type Termios struct, Lflag uint32

* Active watches of custom resources now terminate properly if the CRD is modified. ([#78029](https://github.com/kubernetes/kubernetes/pull/78029), [@liggitt](https://github.com/liggitt))

- Fix the regression with the slow pods termination. Before this fix pods may take an additional time to terminate - up to one minute. Reversing the change that ensured that CNI resources cleaned up when the pod is removed on API server. ([#97980](https://github.com/kubernetes/kubernetes/pull/97980), [@SergeyKanzhelev](https://github.com/SergeyKanzhelev)) [SIG...