V31 // These macros set up the initial value // for a single encryption, or 4 or 8 // stitched encryptions implemented // with interleaving vciphers. // // The input value for each encryption // is generated by XORing the counter // from V30 with the first key in VS0 // and incrementing the counter. // // Single encryption in V15 #define GEN_VCIPHER_INPUT \ XXLOR VS0, VS0, V29 \ VXOR V30, V29, V15; \ VADDUWM V30, V31, V30 // 4 encryptions in V15 - V18 #define GEN_VCIPHER_4_INPUTS \ XXLOR VS0, VS0,...

* Encryption key and encryption provider rotation now works properly. ([#58375](https://github.com/kubernetes/kubernetes/pull/58375), [@liggitt](https://github.com/liggitt))

  certSecret: ""
  publicCrt: public.crt
  privateKey: private.key

## Trusted Certificates Settings for MinIO. Ref: https://docs.min.io/community/minio-object-store/operations/network-encryption.html#third-party-certificate-authorities
## Bundle multiple trusted certificates into one secret and pass that here. Ref: https://github.com/minio/minio/tree/master/docs/tls/kubernetes#2-create-kubernetes-secret

* `AlwaysCheckAllPredicates` is deprecated in scheduler Policy API. ([#86369](https://github.com/kubernetes/kubernetes/pull/86369), [@Huang-Wei](https://github.com/Huang-Wei))
* Kubernetes KMS provider for data encryption now supports disabling the in-memory data encryption key (DEK) cache by setting cachesize to a negative value. ([#86294](https://github.com/kubernetes/kubernetes/pull/86294), [@enj](https://github.com/enj))

	NOOP                                    // 1f2003d5
	HINT $0                                 // 1f2003d5
	DMB	$1
	SVC
	SB                                      // ff3003d5

// encryption
	SHA256H	V9.S4, V3, V2                   // 6240095e
	SHA256H2	V9.S4, V4, V3           // 8350095e
	SHA256SU0	V8.S4, V7.S4            // 0729285e
	SHA256SU1	V6.S4, V5.S4, V7.S4     // a760065e

V31 // These macros set up the initial value // for a single encryption, or 4 or 8 // stitched encryptions implemented // with interleaving vciphers. // // The input value for each encryption // is generated by XORing the counter // from V30 with the first key in VS0 // and incrementing the counter. // // Single encryption in V15 #define GEN_VCIPHER_INPUT \ XXLOR VS0, VS0, V29 \ VXOR V30, V29, V15; \ VADDUWM V30, V31, V30 // 4 encryptions in V15 - V18 #define GEN_VCIPHER_4_INPUTS \ XXLOR VS0, VS0,...

### Kube-proxy images are now based on distroless images

- Added support for max attach limit for Cinder ([#72980](https://github.com/kubernetes/kubernetes/pull/72980), [@gnufied](https://github.com/gnufied))
- Enabled mTLS encryption between etcd and kube-apiserver in GCE ([#70144](https://github.com/kubernetes/kubernetes/pull/70144), [@wenjiaswe](https://github.com/wenjiaswe))

- API server's deprecated `--experimental-encryption-provider-config` flag is now removed. Adapt your machinery to use the `--encryption-provider-config` flag that is available since v1.13. ([#108423](https://github.com/kubernetes/kubernetes/pull/108423), [@ialidzhikov](https://github.com/ialidzhikov))

* Fixed encryption key and encryption provider rotation ([#58375](https://github.com/kubernetes/kubernetes/pull/58375), [@liggitt](https://github.com/liggitt))