- Improved scheduling latency when many gated pods ([#124848](https://github.com/kubernetes/kubernetes/pull/124848), [@gabesaba](https://github.com/gabesaba)) [SIG Scheduling and Testing]
- Kube-apiserver: fixes a 1.28 regression printing pods with invalid initContainer status ([#124908](https://github.com/kubernetes/kubernetes/pull/124908), [@liggitt](https://github.com/liggitt)) [SIG Node]

- Improved scheduling latency when many gated pods ([#124851](https://github.com/kubernetes/kubernetes/pull/124851), [@gabesaba](https://github.com/gabesaba)) [SIG Scheduling and Testing]
- Kube-apiserver: fixes a 1.28 regression printing pods with invalid initContainer status ([#124910](https://github.com/kubernetes/kubernetes/pull/124910), [@liggitt](https://github.com/liggitt)) [SIG Node]

				if sys.OpenIDConfig.ProviderEnabled() {
					sys.purgeExpiredCredentialsForExternalSSO(ctx)
				}
			}

			timer.Reset(waitInterval())
		case <-ctx.Done():
			return
		}
	}
}

// Prints IAM role ARNs.
func (sys *IAMSys) printIAMRoles() {
	if len(sys.rolesMap) == 0 {
		return
	}
	var arns []string
	for arn := range sys.rolesMap {
		arns = append(arns, arn.String())
	}

- Fix --ignore-errors does not take effect if multiple logs are printed and unfollowed ([#97686](https://github.com/kubernetes/kubernetes/pull/97686), [@wzshiming](https://github.com/wzshiming)) [SIG CLI]

  Don't use these flags. Using deprecated flags causes the server to print a warning. Using a removed flag causes the server to abort the startup.

* The following deprecated flags were removed from `kubelet`:

  * `api-servers` - add apiserver addresses to the kubeconfig file instead.

  Don't use these flags. Using deprecated flags causes the kubelet to print a warning. Using a removed flag causes the kubelet to abort the startup.

- Fix image pulling failure when IMDS is unavailable in kubelet startup ([#110523](https://github.com/kubernetes/kubernetes/pull/110523), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider]
- Fix printing resources with int64 fields ([#110603](https://github.com/kubernetes/kubernetes/pull/110603), [@sanchezl](https://github.com/sanchezl)) [SIG API Machinery]

*   Kubefed init now supports --imagePullSecrets and --imagePullPolicy, making it possible to use private registries. ([#50740](https://github.com/kubernetes/kubernetes/pull/50740),[ @dixudx](https://github.com/dixudx))
*   Updated cluster printer to enable --show-labels ([#53771](https://github.com/kubernetes/kubernetes/pull/53771),[ @dixudx](https://github.com/dixudx))

	atTotal := uint64(0)
	for _, pool := range serverPools {
		atTotal += pool.Available
		if atTotal > choose && pool.Available > 0 {
			return pool.Index
		}
	}
	// Should not happen, but print values just in case.
	storageLogIf(ctx, fmt.Errorf("reached end of serverPools (total: %v, atTotal: %v, choose: %v)", total, atTotal, choose))
	return -1
}

* Added the ability to select pods in a chosen node to be drained based on given pod label-selector. ([#56864](https://github.com/kubernetes/kubernetes/pull/56864), [@juanvallejo](https://github.com/juanvallejo))

* Kubectl explain now prints out the Kind and API version of the resource being explained. ([#55689](https://github.com/kubernetes/kubernetes/pull/55689), [@luksa](https://github.com/luksa))

### Cluster Lifecycle

telescopes:  this time she found a little bottle on it, (`which
certainly was not here before,' said Alice,) and round the neck
of the bottle was a paper label, with the words `DRINK ME'
beautifully printed on it in large letters.

  It was all very well to say `Drink me,' but the wise little
Alice was not going to do THAT in a hurry.  `No, I'll look
first,' she said, `and see whether it's marked "poison" or not';