A security issue was discovered in Kubernetes where users may have access to secure endpoints in the control plane network. Kubernetes clusters are only affected if an untrusted user can to modify Node objects and send requests proxying through them.

  }

  /** @return the request with the conditional get headers. */
  private fun assertConditionallyCached(response: MockResponse): RecordedRequest {
    // scenario 1: condition succeeds
    server.enqueue(
      response.newBuilder()
        .body("A")
        .status("HTTP/1.1 200 A-OK")
        .build(),
    )
    server.enqueue(
      MockResponse.Builder()

- Fix a concurrent map access in TopologyCache's `HasPopulatedHints` method. ([#120372](https://github.com/kubernetes/kubernetes/pull/120372), [@Miciah](https://github.com/Miciah)) [SIG Network]

 - `kubeadm`: a separate "super-admin.conf" file is now deployed. The User in `admin.conf` is now bound to a new RBAC Group `kubeadm:cluster-admins` that has `cluster-admin` `ClusterRole` access. The User in `super-admin.conf` is now bound to the `system:masters` built-in super-powers / break-glass Group that can bypass RBAC. Before this change, the default `admin.conf` was bound to `system:masters` Group, which was undesired. Executing `kubeadm...

A security issue was discovered in Kubernetes where users may have access to secure endpoints in the control plane network. Kubernetes clusters are only affected if an untrusted user can to modify Node objects and send requests proxying through them.

	defer func() {
		if r := recover(); r != nil {
			t.Fatalf("NewReader panicked: %s", r)
		}
	}()
	// Previously, this would trigger a panic as we attempt to read from
	// an io.SectionReader which would access a slice at a negative offset
	// as the section reader offset & size were < 0.
	NewReader(bytes.NewReader(data), int64(len(data))+1875)

        // Contract is we always delete input_values[i].
        return false;
      }
      // Note: session->session is not modified if Extend() fails, so
      // we only set last_num_graph_nodes if it succeeds.
      session->last_num_graph_nodes = num_nodes;
    } else {
      session->graph->mu.unlock();
    }
  }
  return true;
}

}  // namespace tensorflow

- Kube-apiserver: ControllerRevision objects...

            # Let from_orm extract the data from this model instead of converting
            # it now to a dict.
            # Otherwise, there's no way to extract lazy data that requires attribute
            # access instead of dict iteration, e.g. lazy relationships.
            return res
        return _model_dump(
            res,
            by_alias=True,
            exclude_unset=exclude_unset,

    data[i] = 0;
  }
  if (TF_TensorDefaultAlignment() > 0) {
    EXPECT_TRUE(TF_TensorIsAligned(a));
  }
  TF_DeleteTensor(a);
}

TEST(CAPI, TestTensorIsNotAligned) {
  // Test unaligned access via a Slice.
  Tensor x(DT_FLOAT, TensorShape({30}));
  x.flat<float>().setConstant(0.0);

  // Take an unaligned slice.
  Tensor y = x.Slice(1, 13);
  absl::Status status;