#### kube-apiserver:
- in an `--encryption-provider-config` config file, an explicit `cacheSize: 0` parameter previously silently defaulted to caching 1000 keys. In Kubernetes 1.18, this now returns a config validation error. To disable caching, you can specify a negative cacheSize value in Kubernetes 1.18+.

 - Kubeadm: remove the automatic detection and matching of cgroup drivers for Docker. For new clusters if you have not configured the cgroup driver explicitly you might get a failure in the `kubelet` on driver mismatch (kubeadm clusters should be using the `systemd` driver). Also remove the `IsDockerSystemdCheck`...

* kubectl cp now safely allows unpacking of symlinks that may point outside the destination directory ([#82384](https://github.com/kubernetes/kubernetes/pull/82384), [@tallclair](https://github.com/tallclair))
* fix azure disk naming matching issue due to case sensitive comparison ([#81720](https://github.com/kubernetes/kubernetes/pull/81720), [@andyzhangx](https://github.com/andyzhangx))

### Bug or Regression

- Namespace API objects now have a `kubernetes.io/metadata.name` label matching their metadata.name field to allow selecting any namespace by its name using a label selector. ([#96968](https://github.com/kubernetes/kubernetes/pull/96968), [@jayunit100](https://github.com/jayunit100)) [SIG API Machinery, Apps, Cloud Provider,...

            }
        } finally {
            deleteScrollContext(scrollId);
        }
        return count;
    }

    /**
     * Deletes documents in an index matching a query.
     *
     * @param index        the index name
     * @param queryBuilder the query to match documents for deletion
     * @return the number of documents deleted
     */

been, leading to rare cases of infinite retries. Please upgrade to this release!

 *  Fix: don't return stale DNS entries in `DnsOverHttps`. We were caching DNS results indefinitely
    rather than the duration specified in the response's cache-control header.
 *  Fix: Verify certificate IP addresses in canonical form. When a server presents a TLS certificate

* When prompting for passwords, don't echo to the terminal ([#31586](https://github.com/kubernetes/kubernetes/pull/31586), [@brendandburns](https://github.com/brendandburns))
* add group prefix matching for kubectl usage ([#32140](https://github.com/kubernetes/kubernetes/pull/32140), [@deads2k](https://github.com/deads2k))

     *
     * @param document the parsed HTML document
     * @param xpath the XPath expression to evaluate
     * @return the concatenated text content from all matching nodes
     */
    protected String getMultipleNodeValue(final Document document, final String xpath) {
        XPathNodes nodeList = null;
        final StringBuilder buf = new StringBuilder(100);
        try {

      return ((Collection<T>) removeFrom).removeIf(predicate);
    }
    return Iterators.removeIf(removeFrom.iterator(), predicate);
  }

  /** Removes and returns the first matching element, or returns {@code null} if there is none. */
  static <T extends @Nullable Object> @Nullable T removeFirstMatching(
      Iterable<T> removeFrom, Predicate<? super T> predicate) {
    checkNotNull(predicate);