#### Storage

- The `Node.Status.Volumes.Attached.DevicePath` field is now unset for CSI volumes. You must update any external controllers that depend on this field. ([#75799](https://github.com/kubernetes/kubernetes/pull/75799), [@msau42](https://github.com/msau42))

- The OpenAPI spec and documentation now reflect the 202 Accepted response path for delete requests. Note that this change in the openapi spec may affect some clients that depend on the error paths.  ([#63418](https://github.com/kubernetes/kubernetes/pull/63418), [@roycaihw](https://github.com/roycaihw))

The merged fix enforces validation against the proxying address for a Node. In some cases, the fix can break clients that depend on the `nodes/proxy` subresource, specifically if a kubelet advertises a localhost or link-local address to the Kubernetes control plane. Configuring an egress proxy for egress to the cluster network can also mitigate this vulnerability.

- E2e.test and e2e_node.test: tests which depend on alpha or beta feature gates now have `Feature:Alpha` or `Feature:Beta` as Ginkgo labels. The inline text is `[Alpha]` or `[Beta]`, as before. ([#124350](https://github.com/kubernetes/kubernetes/pull/124350), [@pohly](https://github.com/pohly))...

([#64706](https://github.com/kubernetes/kubernetes/pull/64706), [@liztio](https://github.com/liztio))
* The `PersistentVolumeLabel` admission controller is now disabled by default. If you depend on this feature (AWS/GCE) then ensure it is added to the `--enable-admission-plugins` flag on the kube-apiserver. ([#64326](https://github.com/kubernetes/kubernetes/pull/64326), [@andrewsykim](https://github.com/andrewsykim))

  // a single IP family on single-stack clusters), or "RequireDualStack"
  // (two IP families on dual-stack configured clusters, otherwise fail). The
  // ipFamilies and clusterIPs fields depend on the value of this field. This
  // field will be wiped when updating a service to type ExternalName.
  // +optional
  optional string ipFamilyPolicy = 17;

* Use debian-base instead of busybox as base image for server images...

                      description: The maximum amount of time that the resolver, determined
                        by the PILOT_JWT_ENABLE_REMOTE_JWKS environment variable,
                        will spend waiting for the JWKS to be fetched.
                      type: string
                      x-kubernetes-validations:
                      - message: must be a valid duration greater than 1ms

  * Marking a StorageClass as default makes it so that even a PersistentVolumeClaim without a StorageClass specified will trigger dynamic provisioning (instead of binding to an existing pool of PVs).
  * If you depend on the old behavior of volumes binding to existing pool of PersistentVolume objects then modify the StorageClass object and set `storageclass.beta.kubernetes.io/is-default-class` to `false`.

  </mime-type>

  <mime-type type="application/prs.alvestrand.titrax-sheet"/>
  <mime-type type="application/prs.cww">
    <glob pattern="*.cww"/>
  </mime-type>
  <mime-type type="application/prs.nprend"/>
  <mime-type type="application/prs.plucker"/>
  <mime-type type="application/qsig"/>

  <mime-type type="application/vnd.ms-spreadsheetml">