- Enforced kubelet to request serving certificates only once it has at least one IP address in the `.status.addresses` of its associated Node object. This avoids requesting DNS-only serving certificates before externally set addresses are in place. Until 1.33, the previous behavior can be opted back into by setting the deprecated `AllowDNSOnlyNodeCSR` feature...

 * behavior:
 *
 * {@snippet :
 * BaseEncoding.base16().lowerCase().decode("deadbeef");
 * }
 *
 * <p>Warning: BaseEncoding instances are immutable. Invoking a configuration method has no effect
 * on the receiving instance; you must store and use the new encoding instance it returns, instead.
 *
 * {@snippet :
 * // Do NOT do this
 * BaseEncoding hex = BaseEncoding.base16();
 * hex.lowerCase(); // does nothing!

    // list, it cannot be removed from it. Hence, foo is here.
    assertThat(hpackReader!!.getAndResetHeaderList()).isEqualTo(headerBlock)

    // Simulate receiving a small dynamic table size update, that implies eviction.
    bytesIn.writeByte(0x3F) // Dynamic table size update (size = 55).
    bytesIn.writeByte(0x18)
    hpackReader!!.readHeaders()

     */

    /**
     * Returns the DFS path for this file if it resides in a DFS share
     *
     * @return the DFS path or null if not in DFS
     * @throws SmbException if an error occurs while resolving the DFS path
     */
    public String getDfsPath() throws SmbException {
        resolveDfs(null);
        if (dfsReferral == null) {
            return null;
        }

- Fixes a regression exposed in 1.27 by kubectl switching to openapi v3 by resolving a flake in openapi v3 aggregation ([#119839](https://github.com/kubernetes/kubernetes/pull/119839), [@atiratree](https://github.com/atiratree)) [SIG API Machinery]

- Kubeadm: add the deprecated flag --port=0 to kube-controller-manager and kube-scheduler manifests to disable insecure serving. Without this flag the components by default serve (e.g. /metrics) insecurely on the default node interface (controlled by --address). Users that wish to override this behavior and enable insecure serving can pass a custom --port=X via kubeadm's "extraArgs" mechanic for these components. ([#92720](https://github.com/kubernetes/kubernetes/pull/92720),...

  /**
   * This test attempts to cause a future to wait for longer than it was requested to from a timed
   * get() call. As measurements of time are prone to flakiness, it tries to assert based on ranges
   * derived from observing how much time actually passed for various operations.
   */
  @SuppressWarnings("ThreadPriorityCheck")
  @AndroidIncompatible // Thread.suspend
  public void testToString_delayedTimeout() throws Exception {

    * This more closely aligns rest client as a generic RESTful client, while preserving the special Kube API extended error handling for the `Get` and `Into` methods (which most Kube clients use).

- Worked toward support for Windows Server version 1903, including adding Windows support for preserving the destination IP as the VIP when loadbalancing with DSR. ([#74825](https://github.com/kubernetes/kubernetes/pull/74825), [@ksubrmnn](https://github.com/ksubrmnn))

            int rn) throws CIFSException {
        if (log.isDebugEnabled()) {
            log.debug("Resolving DFS path " + path);
        }

        if (path.length() >= 2 && path.charAt(0) == '\\' && path.charAt(1) == '\\') {
            throw new SmbException("Path must not start with double slash: " + path);
        }