* allow restricting subresource access ([#30001](https://github.com/kubernetes/kubernetes/pull/30001), [@deads2k](https://github.com/deads2k))
* Fix PVC.Status.Capacity and AccessModes after binding ([#29982](https://github.com/kubernetes/kubernetes/pull/29982), [@jsafrane](https://github.com/jsafrane))

    This command will be run from the **current working directory**, the same `/code` directory you set above with `WORKDIR /code`.

/// tip

Review what each line does by clicking each number bubble in the code. 👆

///

/// warning

Make sure to **always** use the **exec form** of the `CMD` instruction, as explained below.

///

#### Use `CMD` - Exec Form

- Fixed a regression preventing garbage collection of RBAC role and binding objects ([#90534](https://github.com/kubernetes/kubernetes/pull/90534), [@apelisse](https://github.com/apelisse)) [SIG Auth]

	cred, owner, s3Err := validateAdminSignature(ctx, r, "")
	if s3Err != ErrNone {
		writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(s3Err), r.URL)
		return
	}

	var targetAccount string

	// If listing is requested for a specific user (who is not the request
	// sender), check that the user has permissions.
	user := r.Form.Get("user")
	if user != "" && user != cred.AccessKey {
		if !globalIAMSys.IsAllowed(policy.Args{

for # # bucket [true|false] # versioning: false # # set objectlocking for # # bucket [true|false] NOTE: versioning is enabled by default if you use locking # objectlocking: false # - name: bucket2 # policy: none # purge: false # versioning: true # # set objectlocking for # # bucket [true|false] NOTE: versioning is enabled by default if you use locking # objectlocking: false ## Additional Annotations for the Kubernetes Job makeBucketJob makeBucketJob: podAnnotations: {} annotations: {} securityContext:...

* Reverts to looking up the current VM in vSphere using the machine's UUID, either obtained via sysfs or via the `vm-uuid` parameter in the cloud configuration file. ([#40892](https://github.com/kubernetes/kubernetes/pull/40892), [@robdaemon](https://github.com/robdaemon))...

  - Clone `kubernetes/kubernetes` in `update-vendor.sh` shallowly, instead of fetching all revisions
  - Speed up binpacking by reducing the number of PreFilter calls (call once per pod instead of #pods*#nodes times)
  - Speed up finding unneeded nodes by 5x+ in very large clusters by reducing the number of PreFilter calls
  - Expose `--max-nodes-total` as a metric
  - Errors in `IncreaseSize` changed from type `apiError` to `cloudProviderError`

for # # bucket [true|false] # versioning: false # # set objectlocking for # # bucket [true|false] NOTE: versioning is enabled by default if you use locking # objectlocking: false # - name: bucket2 # policy: none # purge: false # versioning: true # # set objectlocking for # # bucket [true|false] NOTE: versioning is enabled by default if you use locking # objectlocking: false ## Additional Annotations for the Kubernetes Job makeBucketJob makeBucketJob: securityContext: enabled: false runAsUser: 1000...

for # # bucket [true|false] # versioning: false # # set objectlocking for # # bucket [true|false] NOTE: versioning is enabled by default if you use locking # objectlocking: false # - name: bucket2 # policy: none # purge: false # versioning: true # # set objectlocking for # # bucket [true|false] NOTE: versioning is enabled by default if you use locking # objectlocking: false ## Additional Annotations for the Kubernetes Job makeBucketJob makeBucketJob: securityContext: enabled: false runAsUser: 1000...

for # # bucket [true|false] # versioning: false # # set objectlocking for # # bucket [true|false] NOTE: versioning is enabled by default if you use locking # objectlocking: false # - name: bucket2 # policy: none # purge: false # versioning: true # # set objectlocking for # # bucket [true|false] NOTE: versioning is enabled by default if you use locking # objectlocking: false ## Additional Annotations for the Kubernetes Job makeBucketJob makeBucketJob: securityContext: enabled: false runAsUser: 1000...