- Kube-apiserver: requests to node, Service, and Pod `/proxy` subresources with no additional URL path now only automatically redirect GET and HEAD requests. ([#95128](https://github.com/kubernetes/kubernetes/pull/95128), [@Riaankl](https://github.com/Riaankl))

        </field>
        <field>
          <name>tag</name>
          <version>4.0.0+</version>
          <description>The tag of current code. By default, it's set to HEAD during development.</description>
          <type>String</type>
          <defaultValue>HEAD</defaultValue>
        </field>
        <field>
          <name>url</name>
          <version>4.0.0+</version>
          <description>
            <![CDATA[

### Bug or Regression

- Fix a scheduler preemption issue where the victim pod was not deleted due to incorrect status patching. This issue occurred when the preemptor and victim pods had different QoS classes in their status, causing the preemption to fail entirely. ([#126694](https://github.com/kubernetes/kubernetes/pull/126694), [@Huang-Wei](https://github.com/Huang-Wei)) [SIG Scheduling]

   *
   * However, for a variety of reasons, Google developers have written a ton of code over the past
   * decade that assumes that they can use checkNotNull for non-precondition checks. I had hoped to
   * take a principled stand on this, but the amount of such code is simply overwhelming. To avoid
   * creating a lot of compile errors that users would not find to be informative, we're giving in

		if err != nil {
			if !xnet.IsNetworkOrHostDown(err, true) {
				gridLogIf(ctx, fmt.Errorf("ws writeMessage: %w", err))
			}
			return
		}
		if cap(merged) > writeBufferSize*8 {
			// If we had to send an excessively large package, reset size.
			merged = make([]byte, 0, writeBufferSize)
		}
		if !writeBuffer() {
			return
		}
	}
}

    DummyEntry<Object, Object> entryThree =
        createDummyEntry(keyThree, hashThree, valueThree, entryTwo);

    // alone
    assertThat(segment.removeEntryFromChain(entryOne, entryOne)).isNull();

    // head
    assertThat(segment.removeEntryFromChain(entryTwo, entryTwo)).isSameInstanceAs(entryOne);

    // middle
    ReferenceEntry<Object, Object> newFirst = segment.removeEntryFromChain(entryThree, entryTwo);

    DummyEntry<Object, Object> entryThree =
        createDummyEntry(keyThree, hashThree, valueThree, entryTwo);

    // alone
    assertThat(segment.removeEntryFromChain(entryOne, entryOne)).isNull();

    // head
    assertThat(segment.removeEntryFromChain(entryTwo, entryTwo)).isSameInstanceAs(entryOne);

    // middle
    ReferenceEntry<Object, Object> newFirst = segment.removeEntryFromChain(entryThree, entryTwo);

- Previously, when trying to allocate devices through DRA for a node timed out, scheduling would proceed with another node if any had the necessary resources. This potentially hid that a node was ignored. Worse, if scheduling was slow overall, the pod was incorrectly moved to "unschedulable" and only retried after a periodic sweep. Now timeouts are errors that are always visible as...

		// coming from a policy claim based openid provider.
		roleArns := puInfo.roleArns.ToSlice()
		var roleArn string
		if len(roleArns) == 0 {
			iamLogIf(GlobalContext,
				fmt.Errorf("parentUser: %s had no roleArns mapped!", parentUser))
			continue
		}
		roleArn = roleArns[0]
		u, err := sys.OpenIDConfig.LookupUser(roleArn, puInfo.subClaimValue)
		if err != nil {
			iamLogIf(GlobalContext, err)

- The following roles have had `Watch` added to them (prefixed with `system:controller:`):
  
  - `cronjob-controller`
  - `endpoint-controller`
  - `endpointslice-controller`
  - `endpointslicemirroring-controller`