#### Extensibility

- The community has been asking for continuing support of extensibility, so this cycle features more work around CRDs and API Machinery. Most of the enhancements in this cycle were from SIG API Machinery and related areas.

### Extensibility around core Kubernetes APIs

#### CustomResourceDefinitions Pruning

		}
		return res, err
	}

	if len(xlMeta.versions) <= 10 {
		// any number of versions beyond this is excessive
		// avoid healing such objects in this manner, let
		// it heal during the regular scanner cycle.
		dst := []byte{}
		for _, ver := range xlMeta.versions {
			dst = slices.Grow(dst, 16)
			copy(dst[len(dst):], ver.header.VersionID[:])
		}
		res.Sign = dst
	}

    * request a client certificate from the API server during the boot cycle and pause

    * waiting for the request to be satisfied. It will continually refresh the certificate

  eligible node(s) for pod with bound claim(s) to local `PersistentVolume(s)` ([#109877](https://github.com/kubernetes/kubernetes/pull/109877), [@yibozhuang](https://github.com/yibozhuang))
- Scheduling cycle now terminates immediately when any scheduler plugin returns an 
  `unschedulableAndUnresolvable` status in `PostFilter`. ([#114699](https://github.com/kubernetes/kubernetes/pull/114699), [@kerthcet](https://github.com/kerthcet))

    * a. kubectl get pod test-pod -o custom-columns=CONTAINER:.spec.containers[0:3].name
    * b. kubectl get pod test-pod -o custom-columns=CONTAINER:.spec.containers[-2:].name
* scheduler: use incremental scheduling cycle in PriorityQueue to put all in-flight unschedulable pods back to active queue if we received move request ([#73309](https://github.com/kubernetes/kubernetes/pull/73309), [@cofyc](https://github.com/cofyc))

- When using `kubectl replace` (or the equivalent API call) on a Service, the caller no longer needs to do a read-modify-write cycle to fetch the allocated values for `.spec.clusterIP` and `.spec.ports[].nodePort`.  Instead the API server will automatically carry these forward from the original object when the new object does not specify them. ([#104672](https://github.com/kube...

### SIG Auth

Work this cycle focused on graduating existing functions, and on making security functions more understandable for users.

:""}]},"scanner":{"_":[{"key":"speed","value":"default"},{"key":"idle_speed","value":""},{"key":"alert_excess_versions","value":"100"},{"key":"alert_excess_folders","value":"50000"},{"key":"delay","value":""},{"key":"max_wait","value":""},{"key":"cycle","value":""}]},"site":{"_":[{"key":"name","value":""},{"key":"region","value":""}]},"storage_class":{"_":[{"key":"standard","value":"EC:5"},{"key":"rrs","value":"EC:1"},{"key":"optimize","value":"availability"},{"key":"inline_block","value":""}]},...

- Scheduler framework permit plugins now run at the end of the scheduling cycle, after reserve plugins. Waiting on permit will remain in the beginning of the binding cycle. ([#88199](https://github.com/kubernetes/kubernetes/pull/88199), [@mateuszlitwin](https://github.com/mateuszlitwin)) [SIG Scheduling]

    * request a client certificate from the API server during the boot cycle and pause
    * waiting for the request to be satisfied. It will continually refresh the certificate
    * as the certificates expiration approaches.