through the built-in NodeRestriction admission plugin.

**Affected Versions**:
  - kube-apiserver v1.20.0 - v1.20.5
  - kube-apiserver v1.19.0 - v1.19.9
  - kube-apiserver <= v1.18.17

**Fixed Versions**:
  - kube-apiserver v1.21.0
  - kube-apiserver v1.20.6
  - kube-apiserver v1.19.10
  - kube-apiserver v1.18.18

This vulnerability was reported by Rogerio Bastos & Ari Lima from RedHat

      - [Instrumentation](#instrumentation-1)
      - [Internal storage layer](#internal-storage-layer)
      - [Kubernetes Dashboard](#kubernetes-dashboard)
      - [kube-dns](#kube-dns)
      - [kube-proxy](#kube-proxy-1)
      - [kube-scheduler](#kube-scheduler)
      - [Storage](#storage-2)
      - [Networking](#networking-1)
      - [Node controller](#node-controller)
      - [Node Components](#node-components-1)

- kube-proxy no longer automatically cleans up network rules created by running kube-proxy in other modes. If you are switching the kube-proxy mode (EG: iptables to IPVS), you will need to run `kube-proxy --cleanup`, or restart the worker node (recommended) before restarting kube-proxy. If you are not switching kube-proxy between different modes, this change should not require any action. ([#76109](https://...

* AWS: Change default networking for kube-up to kubenet ([#32239](https://github.com/kubernetes/kubernetes/pull/32239), [@zmerlynn](https://github.com/zmerlynn))
* Make sure finalizers prevent deletion on storage that supports graceful deletion ([#32351](https://github.com/kubernetes/kubernetes/pull/32351), [@caesarxuchao](https://github.com/caesarxuchao))

      - [Multi-platform](#multi-platform)
      - [Cloud Providers](#cloud-providers)
    - [Network](#network)
      - [network-policy](#network-policy)
      - [kube-proxy ipvs mode](#kube-proxy-ipvs-mode)
    - [API Machinery](#api-machinery)
      - [kube-apiserver](#kube-apiserver)
      - [Dynamic Admission Control](#dynamic-admission-control)
      - [Custom Resource Definitions (CRDs)](#custom-resource-definitions-crds)

/third_party/etcd*
/default.etcd

# Also ignore protoc installed by hack/install-protoc.sh
/third_party/protoc*

# User cluster configs
.kubeconfig

.tags*

# Version file for dockerized build
.dockerized-kube-version-defs

# Web UI
/www/master/node_modules/
/www/master/npm-debug.log
/www/master/shared/config/development.json

# Karma output
/www/test_out

hayas
hayamos
hayáis
hayan
habré
habrás
habrá
habremos
habréis
habrán
habría
habrías
habríamos
habríais
habrían
había
habías
habíamos
habíais
habían
hube
hubiste
hubo
hubimos
hubisteis
hubieron
hubiera
hubieras
hubiéramos
hubierais
hubieran
hubiese
hubieses
hubiésemos
hubieseis
hubiesen
habiendo
habido
habida

    ## to:
    ##  - namespaceSelector:
    ##    matchExpressions:
    ##    - {key: role, operator: In, values: [minio]}
    ##
    to: []
  # only when using flavor: cilium
  egressEntities:
    - kube-apiserver

## PodDisruptionBudget settings
## ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions/
##
podDisruptionBudget:
  enabled: false
  maxUnavailable: 1

	MULLD	(R1)(R2*1), R3        // e3321000000c
	MULLW	(R3)(R4*1), R5        // 71543000
	MULLW	4096(R3), R4          // e34030000151
	SUB	(R1), R2              // e32010000009
	SUBC	(R1), R2              // e3201000000b
	SUBE	(R1), R2              // e32010000089
	SUBW	(R1), R2              // 5b201000
	SUBW	-1(R1), R2            // e3201fffff5b
	AND	(R1), R2              // e32010000080
	ANDW	(R1), R2              // 54201000

	SUBCV R3, R4, R5                // 7ca32410
	SUBCVCC R3, R4, R5              // 7ca32411
	SUBMEVCC R3, R4                 // 7c8305d1
	SUBV R3, R4, R5                 // 7ca32450
	SUBE R3, R4, R5                 // 7ca32110
	SUBECC R3, R4, R5               // 7ca32111
	SUBEV R3, R4, R5                // 7ca32510
	SUBEVCC R3, R4, R5              // 7ca32511