IAAMqgB,EAAgBtmB,UAAEomB,EAAO3jB,YAAY6f,KAxHV,4BA0H/B,GAEEgE,GACFtmB,UAAEsmB,GAAephB,YAAYe,IAGK,QAAhCmgB,EAAO3mB,aAAa,SACtB2mB,EAAOlf,aAAa,iBAAiB,GAIzClH,UAAET,GAASgO,SAAStH,IACiB,QAAjC1G,EAAQE,aAAa,SACvBF,EAAQ2H,aAAa,iBAAiB,GAGxCnI,EAAKwB,OAAOhB,GAERA,EAAQsH,UAAUC,SAAS8N,KAC7BrV,EAAQsH,UAAUmB,IAAIyG,IAGxB,IAAI5J,EAAStF,EAAQkD,WAKrB,GAJIoC,GAA8B,OAApBA,EAAOoW,WACnBpW,EAASA,EAAOpC,YAGdoC,GAAU7E,UAAE6E,GAAQM,SAvKK,iBAuK+B,CAC1D,IAAMohB,EAAkBvmB,UAAET,GAASuF,QA5Jf,aA4J0C,GAE9D,GAAIyhB,EAAiB,CACnB,I...

* PodSecurityPolicy admission sets `podsecuritypolicy.admission.k8s.io/admit-policy` and `podsecuritypolicy.admission.k8s.io/validate-policy` annotations containing the name of the policy that allowed a pod to be admitted. (PodSecurityPolicy also gained the ability to [limit hostPath volume mounts to be read-only](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#volumes-and-file-systems).)

In addition, the NodeRestriction admission plugin now prevents kubelets from modifying...

AAGhC,UACf0kB,GApJQ,IAoJgBtC,GAAMsC,EApJtB,KAoJ6C,EACrD,MACJ,IAAK,SACDA,EAAO5mB,KAAKkE,GAAGhC,UACf0kB,GAzJQ,IAyJgBtC,GAAMsC,EAzJtB,KAyJ6C,EACrD,MAKR,OAFA5mB,KAAKkE,GAAGqd,QAAQqF,GAChBzmB,EAAM4F,aAAa/F,MAAM,GAClBA,MAyqBX0mB,GAAMtkB,OAp5BN,SAAgBolB,GAERA,EADCA,IACaxnB,KAAK2hB,QACbxhB,EAAMgkB,iBACNhkB,EAAM+jB,eAEhB,IAAI5a,EAASN,EAAahJ,KAAMwnB,GAChC,OAAOxnB,KAAK+I,aAAa0e,WAAWne,IA84BxCod,GAAMxhB,KA34BN,SAAc0hB,EAAMc,GAChB,OACI1nB,KAAK4D,YACHoC,EAAS4gB,IAASA,EAAKhjB,WAAc+Y,GAAYiK,GAAMhjB,WAElDke,GAAe...

- The errors in k8s.io/apimachinery/pkg/api/meta gained support for the stdlibs errors.Is matching, including when wrapped ([#111808](https://github.com/kubernetes/kubernetes/pull/111808), [@alvaroaleman](https://github.com/alvaroaleman)) [SIG API Machinery]

- Client-go certificate manager rotation gained the ability to preserve optional intermediate chains accompanying issued certificates ([#88744](https://github.com/kubernetes/kubernetes/pull/88744), [@jackkleeman](https://github.com/jackkleeman)) [SIG API Machinery and Auth]