- `kubeadm`: a separate "super-admin.conf" file is now deployed. The User in `admin.conf` is now bound to a new RBAC Group `kubeadm:cluster-admins` that has `cluster-admin` `ClusterRole` access. The User in `super-admin.conf` is now bound to the `system:masters` built-in super-powers / break-glass Group that can bypass RBAC. Before this change, the default `admin.conf` was bound to `system:masters` Group, which was undesired. Executing `kubeadm...

    data[i] = 0;
  }
  if (TF_TensorDefaultAlignment() > 0) {
    EXPECT_TRUE(TF_TensorIsAligned(a));
  }
  TF_DeleteTensor(a);
}

TEST(CAPI, TestTensorIsNotAligned) {
  // Test unaligned access via a Slice.
  Tensor x(DT_FLOAT, TensorShape({30}));
  x.flat<float>().setConstant(0.0);

  // Take an unaligned slice.
  Tensor y = x.Slice(1, 13);
  absl::Status status;

- Fix OpenAPI v3 not being cleaned up after deleting APIServices ([#120108](https://github.com/kubernetes/kubernetes/pull/120108), [@tnqn](https://github.com/tnqn)) [SIG API Machinery and Testing]
- Fix a concurrent map access in TopologyCache's `HasPopulatedHints` method. ([#120323](https://github.com/kubernetes/kubernetes/pull/120323), [@Miciah](https://github.com/Miciah)) [SIG Apps and Network]

- Kubeadm: Added the `HTTPEndpoints` field to `ClusterConfiguration.Etcd.ExternalEtcd` to configure HTTP endpoints for etcd communication in v1beta4. This separates HTTP traffic (e.g., `/metrics`, `/health`) from gRPC traffic, improving access control. Mirrors etcd’s `--listen-client-http-urls` behavior; if not set, the `Endpoints` field handles both traffic types. ([#134890](https://github.com/kubernetes/kubernetes/pull/134890), [@SataQiu](https://github.com/SataQiu))

	}()
	sOpts := minio.StatObjectOptions{
		VersionID: objInfo.VersionID,
		Internal: minio.AdvancedGetOptions{
			ReplicationProxyRequest: "false",
		},
	}
	sOpts.Set(xhttp.AmzTagDirective, "ACCESS")
	oi, cerr := tgt.StatObject(ctx, tgt.Bucket, object, sOpts)
	if cerr == nil {
		rAction = getReplicationAction(objInfo, oi, ri.OpType)
		rinfo.ReplicationStatus = replication.Completed

pkg syscall (freebsd-386-cgo), const WSTOPPED ideal-int
pkg syscall (freebsd-386-cgo), const WUNTRACED ideal-int
pkg syscall (freebsd-386-cgo), func Accept(int) (int, Sockaddr, error)
pkg syscall (freebsd-386-cgo), func Access(string, uint32) error
pkg syscall (freebsd-386-cgo), func Adjtime(*Timeval, *Timeval) error
pkg syscall (freebsd-386-cgo), func Bind(int, Sockaddr) error
pkg syscall (freebsd-386-cgo), func BpfBuflen(int) (int, error)

- CSI Migration: GCE PD access mode now reflects read only status of inline volumes - this allows multi-attach for read only many PDs ([#84809](https://github.com/kubernetes/kubernetes/pull/84809), [@davidz627](https://github.com/davidz627))

            <p>The condition is specified as a string expression that can include various
            functions, comparisons, and logical operators. Some key features include:</p>

            <ul>
            <li>Property access: {@code ${property.name}}</li>
            <li>Comparison operators: {@code ==}, {@code !=}, {@code <}, {@code >}, {@code <=}, {@code >=}</li>

A security issue was discovered in Kubernetes where users may have access to secure endpoints in the control plane network. Kubernetes clusters are only affected if an untrusted user can to modify Node objects and send requests proxying through them.

import com.google.common.annotations.Beta;
import com.google.common.annotations.GwtCompatible;
import com.google.common.collect.ImmutableMap;

/**
 * <b>Do not use this class directly. For access to public-suffix information, use {@link
 * com.google.common.net.InternetDomainName}.</b>
 *
 * <p>A generated static class containing public members which provide domain name patterns used in