- Fixed a bug that caused the `apiserver` to panic when trying to allocate a Service with a dynamic `ClusterIP` and was configured with Service CIDRs with a /28 mask for IPv4 and a /124 mask for IPv6 ([#115322](https://github.com/kubernetes/kubernetes/pull/115322), [@aojea](https://github.com/aojea))
- Fixed a bug where Kubernetes would apply a default StorageClass to a PersistentVolumeClaim,

 50% {\n    opacity: 0.2;\n  }\n}\n.placeholder-wave {\n  -webkit-mask-image: linear-gradient(130deg, #000 55%, rgba(0, 0, 0, 0.8) 75%, #000 95%);\n  mask-image: linear-gradient(130deg, #000 55%, rgba(0, 0, 0, 0.8) 75%, #000 95%);\n  -webkit-mask-size: 200% 100%;\n  mask-size: 200% 100%;\n  animation: placeholder-wave 2s linear infinite;\n}\n\n@keyframes placeholder-wave {\n  100% {\n    -webkit-mask-position: -200% 0%;\n    mask-position: -200% 0%;\n  }\n}\n.clearfix::after {\n  display: block;\n...

		// 'healing.bin' might be truncated
		return nil
	}
	h := newHealingTracker()
	_, err = h.UnmarshalMsg(b)
	internalLogIf(GlobalContext, err)
	return h
}

// checkODirectDiskSupport asks the disk to write some data
// with O_DIRECT support, return an error if any and return
// errUnsupportedDisk if there is no O_DIRECT support
func (s *xlStorage) checkODirectDiskSupport(fsType string) error {

#### Fixed Versions

- kubelet v1.22.14
- kubelet v1.23.11
- kubelet v1.24.5
- kubelet v1.25.0


To upgrade, refer to this documentation _For core Kubernetes:_ https://kubernetes.io/docs/tasks/administer-cluster/cluster-management/#upgrading-a-cluster 

### Detection

Kubernetes Audit logs may indicate if the user name was misspelled to bypass the restriction placed on which user is a pod allowed to run as.

## Major Themes

### SIG API Machinery

*   KMS: Alpha integration with GCP KMS was removed in favor of a future out-of-process extension point. Discontinue use of the GCP KMS integration and ensure [data has been decrypted](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/#decrypting-all-data) (or reencrypted with a different provider) before upgrading ([#54759](https://github.com/kubernetes/kubernetes/pull/54759),[ @sakshamsharma](https://github.com/sakshamsharma))

- Added a redundant process to remove tracking finalizers from Pods that belong to Jobs. The process kicks in after the control plane marks a Job as finished. ([#119944](https://github.com/kubernetes/kubernetes/pull/119944), [@Sharpz7](https://github.com/Sharpz7))

- Fix a bug that caused to panic the apiserver when trying to allocate a Service with a dynamic ClusterIP and it has been configured with Service CIDRs with a /28 mask for IPv4 and a /124 mask for IPv6 ([#115333](https://github.com/kubernetes/kubernetes/pull/115333), [@aojea](https://github.com/aojea)) [SIG Testing]

pkg net, method (IP) IsLinkLocalUnicast() bool
pkg net, method (IP) IsLoopback() bool
pkg net, method (IP) IsMulticast() bool
pkg net, method (IP) IsUnspecified() bool
pkg net, method (IP) Mask(IPMask) IP
pkg net, method (IP) String() string
pkg net, method (IP) To16() IP
pkg net, method (IP) To4() IP
pkg net, method (IPMask) Size() (int, int)
pkg net, method (IPMask) String() string

1F191..1F19A  ; valid                  ;      ; NV8    # 6.0  SQUARED CL..SQUARED VS
1F19B..1F1AC  ; valid                  ;      ; NV8    # 9.0  SQUARED THREE D..SQUARED VOD
1F1AD         ; valid                  ;      ; NV8    # 13.0 MASK WORK SYMBOL
1F1AE..1F1E5  ; disallowed                             # NA   <reserved-1F1AE>..<reserved-1F1E5>