- Added a new container based image for running e2e tests ([#69368](https://github.com/kubernetes/kubernetes/pull/69368), [@dims](https://github.com/dims))

    protected static final String SPNEGO_INITIALIZED = "spnego.initialized";

    /** Configuration key for directories to exclude from SPNEGO authentication. */
    protected static final String SPNEGO_EXCLUDE_DIRS = "spnego.exclude.dirs";

    /** Configuration key for enabling delegation in SPNEGO authentication. */
    protected static final String SPNEGO_ALLOW_DELEGATION = "spnego.allow.delegation";

* Increase request timeout based on termination grace period ([#31275](https://github.com/kubernetes/kubernetes/pull/31275), [@dims](https://github.com/dims))
* Fixed two issues of kubectl bash completion. ([#31135](https://github.com/kubernetes/kubernetes/pull/31135), [@xingzhou](https://github.com/xingzhou))

- hyperkube
  - The `--make-symlinks` flag is deprecated and will be removed in a future release. ([#74975](https://github.com/kubernetes/kubernetes/pull/74975), [@dims](https://github.com/dims))
- API

## Dependencies

### Added
_Nothing has changed._

### Changed
_Nothing has changed._

### Removed

- Changed apiserver to treat failures decoding a mutating webhook patch as failures to call the webhook so they trigger the webhook failurePolicy and count against metrics like `webhook_fail_open_count` ([#131627](https://github.com/kubernetes/kubernetes/pull/131627), [@dims](https://github.com/dims)) [SIG API Machinery]

    CacheBuilder<Object, Object> builder = CacheBuilder.newBuilder().maximumSize(16);
    assertThrows(IllegalStateException.class, () -> builder.maximumWeight(16));
  }

  @GwtIncompatible // digs into internals of the non-GWT implementation
  public void testMaximumSize_largerThanInt() {
    CacheBuilder<Object, Object> builder =
        CacheBuilder.newBuilder().initialCapacity(512).maximumSize(Long.MAX_VALUE);

    CacheBuilder<Object, Object> builder = CacheBuilder.newBuilder().maximumSize(16);
    assertThrows(IllegalStateException.class, () -> builder.maximumWeight(16));
  }

  @GwtIncompatible // digs into internals of the non-GWT implementation
  public void testMaximumSize_largerThanInt() {
    CacheBuilder<Object, Object> builder =
        CacheBuilder.newBuilder().initialCapacity(512).maximumSize(Long.MAX_VALUE);

- The feature gate `LegacyServiceAccountTokenTracking` (GA since 1.28) is now removed because the feature is unconditionally enabled. ([#122409](https://github.com/kubernetes/kubernetes/pull/122409), [@Rei1010](https://github.com/Rei1010))...

 - OpenStack Cinder CSI migration is on by default, Clinder CSI driver must be installed on clusters on OpenStack for Cinder volumes to work. ([#98538](https://github.com/kubernetes/kubernetes/pull/98538), [@dims](https://github.com/dims)) [SIG Storage]