- `kubeadm`: a separate "super-admin.conf" file is now deployed. The User in `admin.conf` is now bound to a new RBAC Group `kubeadm:cluster-admins` that has `cluster-admin` `ClusterRole` access. The User in `super-admin.conf` is now bound to the `system:masters` built-in super-powers / break-glass Group that can bypass RBAC. Before this change, the default `admin.conf` was bound to `system:masters` Group, which was undesired. Executing `kubeadm init phase kubeconfig all` or just `kubeadm...

   * methods as implementations of normal converters do?
   *
   * But no matter what we do, it's worth remembering that the resulting code is going to be unsound
   * in the presence of LegacyConverter, at least in the case of users who view the converter as a
   * Function<A, B> or who call convertAll (and for any checkers that apply @PolyNull-like semantics

				return
			}
		default:
			bts, err = msgp.Skip(bts)
			if err != nil {
				err = msgp.WrapError(err)
				return
			}
		}
	}
	o = bts
	return
}

// Msgsize returns an upper bound estimate of the number of bytes occupied by the serialized message
func (z *healingTracker) Msgsize() (s int) {

  //     @JointlyNullable T defaultValue);
  //
  // ...where "@JointlyNullable" is similar to @PolyNull but slightly different:
  //
  // - @PolyNull means "@Nullable or @Nonnull"
  //   (That would be unsound for an input Iterable<@Nullable Foo>. So, if we wanted to use
  //   @PolyNull, we would have to restrict this method to non-null <T>. But it has users who pass
  //   iterables with null elements.)
  //

- Added enforcement of an upper cost bound for DRA evaluations of CEL. The API server and scheduler now enforce an upper bound on the cost and runtime steps required for evaluating a CEL expression. ([#128101](https://github.com/kubernetes/kubernetes/pull/128101), [@pohly](https://github.com/pohly)) [SIG API Machinery and Node]

          if (++thatSize > thisSize) {
            return false;
          }
        }
        return true; // that.size() == this.size()
      }
    }

    /**
     * Returns a lower bound for {@link #size()} based on the sizes of the backing sets.
     *
     * <p>This is more efficient than {@link #size()}, which iterates over the entire {@link
     * SetView}.
     */
    abstract int minSize();

  //     @JointlyNullable T defaultValue);
  //
  // ...where "@JointlyNullable" is similar to @PolyNull but slightly different:
  //
  // - @PolyNull means "@Nullable or @Nonnull"
  //   (That would be unsound for an input Iterable<@Nullable Foo>. So, if we wanted to use
  //   @PolyNull, we would have to restrict this method to non-null <T>. But it has users who pass
  //   iterables with null elements.)
  //

				return
			}
		default:
			bts, err = msgp.Skip(bts)
			if err != nil {
				err = msgp.WrapError(err)
				return
			}
		}
	}
	o = bts
	return
}

// Msgsize returns an upper bound estimate of the number of bytes occupied by the serialized message
func (z *BucketMetadata) Msgsize() (s int) {

              + " called");
    }
  }

  public void testNullBounds() {
    // NullBounds has methods whose parameters are type variables that have
    // "extends @Nullable Object" as a bound. This test ensures that NullPointerTester considers
    // those parameters to be @Nullable, so it won't call the methods.
    NullBounds<?, ?, ?> nullBounds = new NullBounds<>();

- Allowed creating ServiceAccount tokens bound to Node objects.
  This allows users to bind a service account token's validity to a named Node object, similar to Pod bound tokens.