**How can I mitigate this prior to installing 1.5.5?**

1. Export existing PodSecurityPolicy objects:
  * `kubectl get podsecuritypolicies -o yaml > psp.yaml`
2. Review and delete any PodSecurityPolicy objects you do not want all pod-creating users to be able to use (NOTE: Privileged users that were making use of those policies will also lose access to those policies). For example:

* Fixed a panic in `kubectl run --attach ...` when the api server failed to create the runtime object (due to name conflict, PSP restriction, etc.) ([#61713](https://github.com/kubernetes/kubernetes/pull/61713), [@mountkin](https://github.com/mountkin))

## External Dependencies

*   The PodSecurityPolicy annotation kubernetes.io/psp on pods is set only once on create. ([#55486](https://github.com/kubernetes/kubernetes/pull/55486),[ @sttts](https://github.com/sttts))

#### **API & API server**

### Ephemeral Containers Graduate to Stable

profesional.bo
progressive
project.space
promo
properties
property
protection
protonet.io
pru
prudential
pruszkow.pl
prvcy.page
przeworsk.pl
ps
psc.br
psi.br
psp.gov.pl
psse.gov.pl
pstmn.io
pt
pt.eu.org
pt.it
pu.it
pub
pub.instances.scw.cloud
pub.sa
publ.cv
publ.pt
public-inquiry.uk
pubtls.org
pueblo.bo
pug.it

- kubeadm: treat non-fatal errors as warnings when doing reset ([#80862](https://github.com/kubernetes/kubernetes/pull/80862), [@drpaneas](https://github.com/drpaneas))
- kubeadm: prevent PSP blocking of upgrade image prepull by using a non-root user ([#77792](https://github.com/kubernetes/kubernetes/pull/77792), [@neolit123](https://github.com/neolit123))

## Changelog since v1.20.0

## What's New (Major Themes)

### Deprecation of PodSecurityPolicy

profesional.bo
progressive
project.space
promo
properties
property
protection
protonet.io
pru
prudential
pruszkow.pl
prvcy.page
przeworsk.pl
ps
psc.br
psi.br
psp.gov.pl
psse.gov.pl
pstmn.io
pt
pt.eu.org
pt.it
pu.it
pub
pub.instances.scw.cloud
pub.sa
publ.cv
publ.pt
public-inquiry.uk
pubtls.org
pueblo.bo
pug.it

- Kube-apiserver: the alpha PodSecurity feature can be enabled by passing `--feature-gates=PodSecurity=true`, and enables controlling allowed pods using namespace labels. See https://git.k8s.io/enhancements/keps/sig-auth/2579-psp-replacement for more details. ([#103099](https://github.com/kubernetes/kubernetes/pull/103099), [@liggitt](https://github.com/liggitt)) [SIG API Machinery, Auth, Instrumentation, Release, Security and Testing]