## Changes by Kind

### API Change

- Added the feature gates `StrictCostEnforcementForVAP` and `StrictCostEnforcementForWebhooks` to enforce the strct cost calculation for CEL extended libraries. It is strongly recommended to turn on the feature gates as early as possible. ([#124676](https://github.com/kubernetes/kubernetes/pull/124676), [@cici37](https://github.com/cici37)) [SIG API Machinery, Auth, Node and Testing]

		return errUnsupportedDisk
	}

	// We know XFS already supports O_DIRECT no need to check.
	if fsType == "XFS" {
		return nil
	}

	// For all other FS pay the price of not using our recommended filesystem.

	// Check if backend is writable and supports O_DIRECT
	uuid := mustGetUUID()
	filePath := pathJoin(s.drivePath, minioMetaTmpDeletedBucket, ".writable-check-"+uuid+".tmp")

> NOTE:  While MinIO does not implement an upper boundary on buckets, your cluster's hardware has natural limits that depend on the workload and its scaling patterns. We strongly recommend [MinIO SUBNET](https://min.io/pricing) for architecture and sizing guidance for your production use case.

                final int port = runner.node().settings().getAsInt("http.port", 9200);
                httpAddress = "http://localhost:" + port;
                logger.warn("Embedded OpenSearch is running. This configuration is not recommended for production use.");
                break;
            }
        }
        client = createHttpClient(fessConfig, httpAddress);

        if (StringUtil.isNotBlank(httpAddress)) {

    * If you are not switching kube-proxy between different modes, this change should not require any action....

For more information, see [#53288](https://issue.k8s.io/53288).

` is now deprecated and will be removed in a future release. You can migrate to using the new flag `--patches`. Add a new field `{Init|Join}Configuration.patches.directory` that can be used for the same purpose. For `init` and `join` it is now recommended that you migrate to configure patches via `{Init|Join}Configuration.patches.directory`. For the time being, these flags can be mixed with `--config`, but that might change in the future. On a command line, the last *patches flag takes precedence...

            project. Each subproject listed is a relative path to the directory containing the subproject.
            To be consistent with the way default URLs are calculated from parent, it is recommended
            to have subproject names match artifact ids.</description>
          <association>
            <type>String</type>
            <multiplicity>*</multiplicity>
          </association>
        </field>

- kube-apiserver

  - the `--basic-auth-file` flag and authentication mode is deprecated and will be removed in a future release. It is not recommended for production environments. ([#81152](https://github.com/kubernetes/kubernetes/pull/81152), [@tedyu](https://github.com/tedyu))

(No, really, you MUST read this before you upgrade)

- Added the ability to reduce both the initial delay and the maximum delay accrued between container restarts for a node for containers in `CrashLoopBackOff` across the cluster to the recommended values of `1s` initial delay and `60s` maximum delay. To set this for a node, turn on the feature gate `ReduceDefaultCrashLoopBackOffDecay`. If you are also using the feature gate `KubeletCrashLoopBackOffMax` with a configured per-node `CrashLo...