- Register/Deregister Targets in chunks for AWS TargetGroup ([#101592](https://github.com/kubernetes/kubernetes/pull/101592), [@M00nF1sh](https://github.com/M00nF1sh)) [SIG Cloud Provider]

- Mount-utils: treat syscall.ENODEV as corrupted mount ([#126174](https://github.com/kubernetes/kubernetes/pull/126174), [@dobsonj](https://github.com/dobsonj)) [SIG Storage]
- StatefulSet autodelete will respect controlling owners on PVC claims as described in https://github.com/kubernetes/enhancements/pull/4375 ([#126581](https://github.com/kubernetes/kubernetes/pull/126581), [@mattcary](https://github.com/mattcary)) [SIG Apps, Storage and Testing]

decl.(type) { case *ast.GenDecl: if d.Tok == token.CONST { continue // Skip const declarations } if d.Tok == token.IMPORT { cmap[decl] = nil // Drop pre-import comments. } } newDecls = append(newDecls, decl) } f.Decls = newDecls // Replace identifiers. ast.Inspect(f, func(n ast.Node) bool { switch x := n.(type) { case *ast.Ident: if replacement, ok := replacements[x.Name]; ok { x.Name = replacement } } return true }) // Replace identifiers in comments. for _, c := range f.Comments { for _, l := range c.List...

- Images for cloud-controller-manager, kube-apiserver, kube-controller-manager, and kube-scheduler now contain a minimal /etc/nsswitch.conf and should respect /etc/hosts for lookups ([#69238](https://github.com/kubernetes/kubernetes/pull/69238), [@BenTheElder](https://github.com/BenTheElder))

### SIG Scheduling

     * read operations in Map. For example, no operation can reveal that the table has grown but the
     * threshold has not yet been updated, so there are no atomicity requirements for this with
     * respect to reads.
     *
     * As a guide, all critical volatile reads and writes to the count field are marked in code
     * comments.
     */

    @Weak final LocalCache<K, V> map;

decl.(type) { case *ast.GenDecl: if d.Tok == token.CONST { continue // Skip const declarations } if d.Tok == token.IMPORT { cmap[decl] = nil // Drop pre-import comments. } } newDecls = append(newDecls, decl) } f.Decls = newDecls // Replace identifiers. ast.Inspect(f, func(n ast.Node) bool { switch x := n.(type) { case *ast.Ident: if replacement, ok := replacements[x.Name]; ok { x.Name = replacement } } return true }) // Replace identifiers in comments. for _, c := range f.Comments { for _, l := range c.List...

  The Cat only grinned when it saw Alice.  It looked good-
natured, she thought:  still it had VERY long claws and a great
many teeth, so she felt that it ought to be treated with respect.

  `Cheshire Puss,' she began, rather timidly, as she did not at
all know whether it would like the name:  however, it only
grinned a little wider.  `Come, it's pleased so far,' thought

### Other (Cleanup or Flake)

- Bump distroless-iptables to 0.2.8 based on Go 1.20.11 ([#121962](https://github.com/kubernetes/kubernetes/pull/121962), [@cpanato](https://github.com/cpanato)) [SIG Testing]
- Makefile and scripts now respect GOTOOLCHAIN and otherwise ensure ./.go-version is used ([#122077](https://github.com/kubernetes/kubernetes/pull/122077), [@BenTheElder](https://github.com/BenTheElder)) [SIG Release and Testing]

## Dependencies

### Added

- AppArmor profiles specified in the pod or container SecurityContext are no longer copied to deprecated AppArmor annotations (prefix `container.apparmor.security.beta.kubernetes.io/`). Anything that inspects the deprecated annotations must be migrated to use the SecurityContext fields instead. ([#131989](https://github.com/kubernetes/kubernetes/pull/131989), [@tallclair](https://github.com/tallclair)) [SIG Node]

* kubeadm: Enable kubelet client certificate rotation ([#52196](https://github.com/kubernetes/kubernetes/pull/52196), [@luxas](https://github.com/luxas))
* Scheduler predicate developer should respect equivalence class cache ([#52146](https://github.com/kubernetes/kubernetes/pull/52146), [@resouer](https://github.com/resouer))