### Other (Cleanup or Flake)

- "Removed the ability to run `kubectl exec [POD] [COMMAND]` without a `--` separator.
  The `--` separator has been recommended since the Kubernetes v1.18 release, which also deprecated the legacy way of invoking `kubectl exec`.
  

Here is a list of some of the changes that have been made to kubeadm:

- Kubeadm internal config has been promoted to `v1alpha3`:
  - `v1alpha1` has been removed.
  - `v1alpha3` has split apart `MasterConfiguration` into separate components; `InitConfiguration`, `ClusterConfiguration`, `JoinConfiguration`, `KubeletConfiguration`, and `KubeProxyConfiguration`
  - Different configuration types can be supplied all in the same file separated by `---`.

          // Ignore the response so it gets leaked then GC'd.
          latch.countDown()
        }
      },
    )
    latch.await()
    // There's some flakiness when triggering a GC for objects in a separate thread. Adding a
    // small delay appears to ensure the objects will get GC'd.
    Thread.sleep(200)
    awaitGarbageCollection()
    val message = testLogHandler.take()
    assertThat(message).contains(

* kube-up: install new Docker pre-requisite (libltdl7) when not in image ([#28745](https://github.com/kubernetes/kubernetes/pull/28745), [@justinsb](https://github.com/justinsb))
* Separate rate limiters for Pod evictions for different zones in NodeController ([#28843](https://github.com/kubernetes/kubernetes/pull/28843), [@gmarek](https://github.com/gmarek))

* [AppArmor] Hold bad AppArmor pods in pending rather than rejecting ([#35342](https://github.com/kubernetes/kubernetes/pull/35342), [@timstclair](https://github.com/timstclair))
* Federation: separate notion of zone-name & dns-suffix ([#35372](https://github.com/kubernetes/kubernetes/pull/35372), [@justinsb](https://github.com/justinsb))

 - It can be used to provide scratch storage that is different from the root disk, for example persistent memory, or a separate local disk on that node.
 - All StorageClass parameters for volume provisioning are supported.

* Laid the groundwork for OIDC distributed claims handling in the apiserver authentication token checker. A distributed claim allows the OIDC provider to delegate a claim to a separate URL. ([ref](http://openid.net/specs/openid-connect-core-1_0.html#AggregatedDistributedClaims)). ([#63213](https://github.com/kubernetes/kubernetes/pull/63213), [@filmil](https://github.com/filmil))

* ReplicationController now shares its underlying controller implementation with ReplicaSet to reduce the maintenance burden going forward. However, they are still separate resources and there should be no externally visible effects from this change. ([#49429](https://github.com/kubernetes/kubernetes/pull/49429), [@enisoc](https://github.com/enisoc))

- Prevent watch cache starvation by moving its watch to separate RPC and add a SeparateCacheWatchRPC feature flag to disable this behavior ([#123694](https://github.com/kubernetes/kubernetes/pull/123694), [@mengqiy](https://github.com/mengqiy)) [SIG API Machinery]

]. type EncapsulationKey1024 struct { ρ [32]byte // sampleNTT seed for A h [32]byte // H(ek) encryptionKey1024 } // Bytes returns the encapsulation key as a byte slice. func (ek *EncapsulationKey1024) Bytes() []byte { // The actual logic is in a separate function to outline this allocation. b := make([]byte, 0, EncapsulationKeySize) return ek.bytes(b) } func (ek *EncapsulationKey1024) bytes(b []byte) []byte { for i := range ek.t { b = polyByteEncode(b, ek.t[i]) } b = append(b, ek.ρ[:]...) return...