* After a kubelet rotates its client cert, it now closes its connections to the API server to force a handshake using the new cert. Previously, the kubelet could keep its existing connection open, even if the cert used for that connection was expired and rejected by the API server. ([#49899](https://github.com/kubernetes/kubernetes/pull/49899), [@ericchiang](https://github.com/ericchiang))

- Fixes a regression introduced in 1.29 where conntrack entries for UDP connections
  to deleted pods did not get cleaned up correctly, which could (among other things)

    // flow-control window is fully depleted.
    if (!flushHeaders) {
      withLock {
        flushHeaders = (connection.writeBytesTotal >= connection.writeBytesMaximum)
      }
    }

    connection.writeHeaders(id, outFinished, responseHeaders)

    if (flushHeaders) {
      connection.flush()
    }
  }

#### **Audit**

*   Fixed a bug so that `kube-apiserver` now waits for open connections to finish before exiting. This fix provides graceful shutdown and ensures that the audit backend no longer drops events on shutdown. ([#53695](https://github.com/kubernetes/kubernetes/pull/53695),[ @hzxuzhonghu](https://github.com/hzxuzhonghu))

- When the `PreferSameTrafficDistribution` feature gate is enabled, a new `trafficDistribution` value `PreferSameNode` is available, which attempts to always route Service connections to an endpoint on the same node as the client. Additionally, `PreferSameZone` is introduced as an alias for `PreferClose`. ([#130844](https://github.com/kubernetes/kubernetes/pull/130844), [@danwinship](https://github.com/danwinship)) [SIG API Machinery,...

          }
        } else {
          exchange.noRequestBody()
          if (!exchange.connection.isMultiplexed) {
            // If the "Expect: 100-continue" expectation wasn't met, prevent the HTTP/1 connection
            // from being reused. Otherwise we're still obligated to transmit the request body to
            // leave the connection in a consistent state.
            exchange.noNewExchangesOnConnection()
          }
        }

	"github.com/minio/minio/internal/grid"
)

// lockRESTClient is authenticable lock REST client
type lockRESTClient struct {
	connection *grid.Connection
}

// IsOnline - returns whether REST client failed to connect or not.
func (c *lockRESTClient) IsOnline() bool {
	return c.connection.State() == grid.StateConnected
}

// Not a local locker
func (c *lockRESTClient) IsLocal() bool {
	return false
}

      ioe,
    ),
  )

  override fun connectionAcquired(
    call: Call,
    connection: Connection,
  ) = onEvent(ConnectionAcquired(System.nanoTime(), call, connection))

  override fun connectionReleased(
    call: Call,
    connection: Connection,
  ) = onEvent(ConnectionReleased(System.nanoTime(), call, connection))

  override fun callStart(call: Call) = onEvent(CallStart(System.nanoTime(), call))

    }
  }

  /**
   * This test reproduces a crash where OkHttp attempted to use a deferred connection when the call
   * already had a healthy connection. It sets up a deferred connection by stalling the IPv6
   * connect, and it sets up a same-connection retry with [ErrorCode.REFUSED_STREAM].
   *
   * https://github.com/square/okhttp/pull/7190
   */
  @Test

    }
  }

  @Test
  fun testUrlConnectionDirect() {
    testRequest {
      val url = URI(mockServer.endpoint + "/person?name=peter").toURL()

      val connection = url.openConnection() as HttpURLConnection

      assertThat(
        connection.inputStream
          .source()
          .buffer()
          .readUtf8(),
      ).contains("Peter the person")
    }
  }

  @Test