* Exec authenticator plugin supports TLS client certificates. ([#61803](https://github.com/kubernetes/kubernetes/pull/61803), [@awly](https://github.com/awly))
* The `serverAddressByClientCIDRs` property in `metav1.APIGroup`(discovery API) is now optional instead of required. ([#61963](https://github.com/kubernetes/kubernetes/pull/61963), [@roycaihw](https://github.com/roycaihw))

pro.pr
pro.tt
pro.typeform.com
pro.vn
prochowice.pl
prod
production.aero
productions
prof
prof.pr
profesional.bo
progressive
project.space
promo
properties
property
protection
protonet.io
pru
prudential
pruszkow.pl
prvcy.page
przeworsk.pl
ps
psc.br
psi.br
psp.gov.pl
psse.gov.pl
pstmn.io
pt
pt.eu.org
pt.it

- Corrected the documentation for escaping dollar signs in a container's env, command and args property. ([#101916](https://github.com/kubernetes/kubernetes/pull/101916), [@MartinKanters](https://github.com/MartinKanters)) [SIG Apps]

### Other notable changes

* CustomResourceDefinitions: OpenAPI v3 validation schemas containing `$ref`references are no longer permitted (valid references could not be constructed previously because property ids were not permitted either). Before upgrading, ensure CRD definitions do not include those `$ref` fields. ([#58438](https://github.com/kubernetes/kubernetes/pull/58438), [@carlory](https://github.com/carlory))

- Kube-apiserver: fix a possible panic validating a custom resource whose CustomResourceDefinition indicates a status subresource exists, but which does not define a `status` property in the `openAPIV3Schema` ([#135362](https://github.com/kubernetes/kubernetes/pull/135362), [@fusida](https://github.com/fusida)) [SIG API Machinery]

* CustomResourceDefinitions: OpenAPI v3 validation schemas containing `$ref`references are no longer permitted (valid references could not be constructed previously because property ids were not permitted either). Before upgrading, ensure CRD definitions do not include those `$ref` fields. ([#58438](https://github.com/kubernetes/kubernetes/pull/58438), [@carlory](https://github.com/carlory))

      <match value="CD001" type="string" offset="36865"/>
    </magic>
    <glob pattern="*.iso"/>
  </mime-type>

  <mime-type type="application/x-itunes-bplist">
    <_comment>Apple iTunes Binary Property List</_comment>
    <sub-class-of type="application/x-bplist"/>
  </mime-type>

  <mime-type type="application/x-itunes-ipa">
    <sub-class-of type="application/zip"/>

2149          ; mapped                 ; 006A          # 3.2  DOUBLE-STRUCK ITALIC SMALL J
214A..214B    ; valid                  ;      ; NV8    # 3.2  PROPERTY LINE..TURNED AMPERSAND
214C          ; valid                  ;      ; NV8    # 4.1  PER SIGN
214D          ; valid                  ;      ; NV8    # 5.0  AKTIESELSKAB

    * The new support for ORM mode fixes issues/adds features related to ORMs with lazy-loading, hybrid properties, dynamic/getters (using `@property` decorators) and several other use cases.
    * This applies to ORMs like SQLAlchemy, Peewee, Tortoise ORM, GINO ORM and virtually any other.