- Passing an invalid policy name in the `--cpu-manager-policy` flag will now cause the kubelet to fail instead of simply ignoring the flag and running the `cpumanager`’s default policy instead. ([#80294](https://github.com/kubernetes/kubernetes/pull/80294),...

</li>
</ul>

<h3 id="special-instructions">Special instructions</h3>

<p>
The <code>PCALIGN</code> pseudo-instruction is used to indicate that the next instruction should be aligned
to a specified boundary by padding with no-op instructions.
</p>

<p>
It is currently supported on arm64, amd64, ppc64, loong64 and riscv64.

For example, the start of the <code>MOVD</code> instruction below is aligned to 32 bytes:
<pre>

- The `horizontalpodautoscaling` and `clusterrole-aggregation` controllers now assume the `autoscaling/v1` and `rbac.authorization.k8s.io/v1` APIs are available. If you disable those APIs and do not want to run those controllers, exclude them by passing `--controllers=-horizontalpodautoscaling` or `--controllers=-clusterrole-aggregation` to `kube-controller-manager`. ([#117977](https://github.com/kubernetes/kubernetes/pull/117977), [@liggitt](https://github.com/liggitt)) [SIG API Machinery and Cloud...

### Other (Cleanup or Flake)

- Fixes the flooding warning messages about setting volume ownership for configmap/secret volumes ([#92878](https://github.com/kubernetes/kubernetes/pull/92878), [@jvanz](https://github.com/jvanz)) [SIG Instrumentation, Node and Storage]

  /**
   * Returns the result of calling {@link Future#get()} uninterruptibly on a task known not to throw
   * a checked exception. This makes {@code Future} more suitable for lightweight, fast-running
   * tasks that, barring bugs in the code, will not fail. This gives it exception-handling behavior
   * similar to that of {@code ForkJoinTask.join}.
   *
   * <p>Exceptions from {@code Future.get} are treated as follows:
   *
   * <ul>

		// While not recommended, it is valid to append to a shifted buffer.
		// This forces Write to copy the input.
		if rn.Intn(8) == 0 && cap(b) > 0 {
			b = b[1:1:cap(b)]
		}

		// Append a random integer of varying width.
		n := int64(rn.Intn(1 << rn.Intn(30)))
		want = append(strconv.AppendInt(want, n, 10), ' ')
		b = append(strconv.AppendInt(b, n, 10), ' ')
		w.Write(b)
	}
	w.Flush()

	}
}

func TestCVE202139293(t *testing.T) {
	// directory size is so large, that the check in Reader.init
	// overflows when subtracting from the archive size, causing
	// the pre-allocation check to be bypassed.
	data := []byte{
		0x50, 0x4b, 0x06, 0x06, 0x05, 0x06, 0x31, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x50, 0x4b,

      status->status = InvalidArgument("Unparseable RunOptions proto");
      return;
    }
    if (run_metadata != nullptr && run_metadata->data != nullptr) {
      status->status =
          InvalidArgument("Passing non-empty run_metadata is invalid.");
      return;
    }

    RunMetadata run_metadata_proto;
    result = session->Run(run_options_proto, input_pairs, output_tensor_names,

### Other (Cleanup or Flake)

- Add warning for PV on relaim policy when it is Recycle ([#122339](https://github.com/kubernetes/kubernetes/pull/122339), [@carlory](https://github.com/carlory)) [SIG Storage]

    }.also { expected ->
      assertThat(expected.message).isEqualTo("Too many follow-up requests: 21")
    }
  }

  /**
   * We had a bug where we were passing a null route to the authenticator.
   * https://github.com/square/okhttp/issues/3809
   */
  @Test
  fun authenticateWithNoConnection() {
    server.enqueue(
      MockResponse(
        code = 401,