* etcd3: avoid unnecessary decoding in etcd3 client  ([#34435](https://github.com/kubernetes/kubernetes/pull/34435), [@wojtek-t](https://github.com/wojtek-t))
* Test x509 intermediates correctly ([#34524](https://github.com/kubernetes/kubernetes/pull/34524), [@liggitt](https://github.com/liggitt))

00002d0 b5 34 7e c4 c2 9e f5 a0 f6 5b 7e 6e ca 73 c7 ef
00002e0 5d be de f9 e8 81 eb a5 0a a5 63 54 2c d7 1c d1
00002f0 89 17 85 f8 16 94 f2 8a b2 a3 f5 b6 6d df 75 cd
0000300 90 dd 64 bd 5d 55 4e f2 55 19 1b b7 cc ef 1b ea
0000310 2e 05 9c f4 aa 1e a8 cd a6 82 c7 59 0f 5e 9d e0
0000320 bb fc 6c d6 99 23 eb 36 ad c6 c5 e1 d8 e1 e2 3e
0000330 d9 90 5a f7 91 5d 6f bc 33 6d 98 47 d2 7c 2e 2f

- Fixed an issue where the `vsphere` cloud provider would not trust a certificate if:
  - The issuer of the certificate was unknown (`x509.UnknownAuthorityError`)
  - The requested name did not match the set of authorized names (`x509.HostnameError`)

## Changelog since v1.3.8

### Other notable changes

* Test x509 intermediates correctly ([#34524](https://github.com/kubernetes/kubernetes/pull/34524), [@liggitt](https://github.com/liggitt))

pkg crypto/tls, type ConnectionState struct, TLSUnique //deprecated
pkg crypto/x509, func DecryptPEMBlock //deprecated
pkg crypto/x509, func EncryptPEMBlock //deprecated
pkg crypto/x509, func IsEncryptedPEMBlock //deprecated
pkg crypto/x509, type CertificateRequest struct, Attributes //deprecated
pkg database/sql/driver, type ColumnConverter //deprecated

pkg crypto/ed25519, type PublicKey []uint8
pkg crypto/tls, const Ed25519 = 2055
pkg crypto/tls, const Ed25519 SignatureScheme
pkg crypto/x509, const Ed25519 = 4
pkg crypto/x509, const Ed25519 PublicKeyAlgorithm
pkg crypto/x509, const PureEd25519 = 16
pkg crypto/x509, const PureEd25519 SignatureAlgorithm
pkg database/sql, method (*Conn) Raw(func(interface{}) error) error
pkg database/sql, method (*NullInt32) Scan(interface{}) error

   * Each OkHttpClient used to get its own instance of NullProxySelector, and because these weren't
   * equal their connections weren't pooled. That's a nasty performance bug!
   *
   * https://github.com/square/okhttp/issues/5519
   */
  @Test
  fun connectionPoolingWithFreshClientSamePool() {
    server.enqueue(MockResponse(body = "abc"))
    server.enqueue(MockResponse(body = "def"))
    server.enqueue(MockResponse(body = "ghi"))

- Fixes an issue where the vsphere cloud provider will not trust a certificate if:
  - The issuer of the certificate is unknown (x509.UnknownAuthorityError)
  - The requested name does not match the set of authorized names (x509.HostnameError)

- Node Problem Detector is now...

### Other (Cleanup or Flake)

- Fixes an issue where the vsphere cloud provider will not trust a certificate if:
  - The issuer of the certificate is unknown (x509.UnknownAuthorityError)
  - The requested name does not match the set of authorized names (x509.HostnameError)