try {
      val response = completableFuture.get(10, TimeUnit.SECONDS)

      assertEquals(200, response.code)
      assertEquals("h3", response.negotiatedProtocol)
      assertTrue(response.content.contains("Disallow"))
    } catch (ee: ExecutionException) {
      throw ee.cause?.cause ?: ee.cause!!
    }
  }

  data class Response(
    val code: Int,
    val negotiatedProtocol: String,
    val content: String,

    /*
     * Note that we allow (in contravention of a strict interpretation of the relevant RFCs) domain
     * parts other than the last may begin with a digit (for example, "3com.com"). It's important to
     * disallow an initial digit in the last part; it's the only thing that stops an IPv4 numeric
     * address like 127.0.0.1 from looking like a valid domain name.
     */

    if (isFinalPart && DIGIT_MATCHER.matches(part.charAt(0))) {

    // contain non-decimal characters.
    int length = end - start;
    if (length <= 0 || length > 3) {
      throw new NumberFormatException();
    }
    // Disallow leading zeroes, because no clear standard exists on
    // whether these should be interpreted as decimal or octal.
    if (length > 1 && ipString.charAt(start) == '0') {
      throw new NumberFormatException();
    }

    // contain non-decimal characters.
    int length = end - start;
    if (length <= 0 || length > 3) {
      throw new NumberFormatException();
    }
    // Disallow leading zeroes, because no clear standard exists on
    // whether these should be interpreted as decimal or octal.
    if (length > 1 && ipString.charAt(start) == '0') {
      throw new NumberFormatException();
    }

- Service loadBalancerSourceRanges doesn't respect updates ([#33033](https://github.com/kubernetes/kubernetes/issues/33033))
- disallow user to update loadbalancerSourceRanges ([#33346](https://github.com/kubernetes/kubernetes/issues/33346))

## Notable Changes to Existing Behavior

### Deployments

### Bug or Regression

- Changed the node restrictions to disallow the node to change it's ownerReferences. ([#133469](https://github.com/kubernetes/kubernetes/pull/133469), [@natherz97](https://github.com/natherz97)) [SIG Auth]

## Dependencies

### Added
_Nothing has changed._

### SIG API Machinery

This release SIG API Machinery focused mainly on CustomResources. For example, subresources for CustomResources are now beta and enabled by default. With this, updates to the `/status` subresource will disallow updates to all fields other than `.status` (not just `.spec` and `.metadata` as before). Also, `required` and `description` can be used at the root of the CRD OpenAPI validation schema when the `/status` subresource is enabled.

  // execution significantly)

  /**
   * This classloader disallows {@link java.lang.invoke.VarHandle}, which will prevent us from
   * selecting the {@code VarHandleAtomicHelper} strategy.
   */
  private static final ClassLoader NO_VAR_HANDLE =
      getClassLoader(ImmutableSet.of("java.lang.invoke.VarHandle"));

  /**
   * This classloader disallows {@link java.lang.invoke.VarHandle} and {@link sun.misc.Unsafe},

  // execution significantly)

  /**
   * This classloader disallows {@link java.lang.invoke.VarHandle}, which will prevent us from
   * selecting the {@code VarHandleAtomicHelper} strategy.
   */
  private static final ClassLoader NO_VAR_HANDLE =
      getClassLoader(ImmutableSet.of("java.lang.invoke.VarHandle"));

  /**
   * This classloader disallows {@link java.lang.invoke.VarHandle} and {@link sun.misc.Unsafe},

* Disallow PriorityClass names with 'system-' prefix for user defined priority classes. ([#59382](https://github.com/kubernetes/kubernetes/pull/59382), [@bsalamat](https://github.com/bsalamat))