### Other (Cleanup or Flake)

- Bump distroless-iptables to 0.2.8 based on Go 1.20.11 ([#121962](https://github.com/kubernetes/kubernetes/pull/121962), [@cpanato](https://github.com/cpanato)) [SIG Testing]
- Makefile and scripts now respect GOTOOLCHAIN and otherwise ensure ./.go-version is used ([#122077](https://github.com/kubernetes/kubernetes/pull/122077), [@BenTheElder](https://github.com/BenTheElder)) [SIG Release and Testing]

## Dependencies

### Added

- AppArmor profiles specified in the pod or container SecurityContext are no longer copied to deprecated AppArmor annotations (prefix `container.apparmor.security.beta.kubernetes.io/`). Anything that inspects the deprecated annotations must be migrated to use the SecurityContext fields instead. ([#131989](https://github.com/kubernetes/kubernetes/pull/131989), [@tallclair](https://github.com/tallclair)) [SIG Node]

* kubeadm: Enable kubelet client certificate rotation ([#52196](https://github.com/kubernetes/kubernetes/pull/52196), [@luxas](https://github.com/luxas))
* Scheduler predicate developer should respect equivalence class cache ([#52146](https://github.com/kubernetes/kubernetes/pull/52146), [@resouer](https://github.com/resouer))

  The Cat only grinned when it saw Alice.  It looked good-
natured, she thought:  still it had VERY long claws and a great
many teeth, so she felt that it ought to be treated with respect.

  `Cheshire Puss,' she began, rather timidly, as she did not at
all know whether it would like the name:  however, it only
grinned a little wider.  `Come, it's pleased so far,' thought

- Kubeadm: during kubelet health checks, respect the healthz address:port configured in the KubeletConfiguration instead of hardcoding localhost:10248. ([#125265](https://github.com/kubernetes/kubernetes/pull/125265), [@neolit123](https://github.com/neolit123)) [SIG Cluster Lifecycle]

* GCE: Fix for internal load balancer management resulting in backend services with outdated instance group links. ([#62887](https://github.com/kubernetes/kubernetes/pull/62887), [@nicksardo](https://github.com/nicksardo))
* respect fstype in Windows for azure disk ([#61267](https://github.com/kubernetes/kubernetes/pull/61267), [@andyzhangx](https://github.com/andyzhangx))

* Implement kubectl rollout undo and history for DaemonSet ([#46144](https://github.com/kubernetes/kubernetes/pull/46144), [@janetkuo](https://github.com/janetkuo))
* Respect PDBs during node upgrades and add test coverage to the ServiceTest upgrade test. ([#45748](https://github.com/kubernetes/kubernetes/pull/45748), [@mml](https://github.com/mml))

(as opposed to the three characters <code>...</code>) is not a token of the Go
language.
</p>

<p>
A link of the form [<a href="#Language_versions">Go 1.xx</a>] indicates that a described
language feature (or some aspect of it) was changed or added with language version 1.xx and
thus requires at minimum that language version to build.
For details, see the <a href="#Language_versions">linked section</a>
in the <a href="#Appendix">appendix</a>.

2F8C          ; mapped                 ; 864D          # 3.0  KANGXI RADICAL TIGER
2F8D          ; mapped                 ; 866B          # 3.0  KANGXI RADICAL INSECT
2F8E          ; mapped                 ; 8840          # 3.0  KANGXI RADICAL BLOOD
2F8F          ; mapped                 ; 884C          # 3.0  KANGXI RADICAL WALK ENCLOSURE