tempDir.mkdirs();

            // robots.txt
            StringBuilder buf = new StringBuilder();
            buf.append("User-agent: *").append('\n');
            buf.append("Disallow: /admin/").append('\n');
            buf.append("Disallow: /websvn/").append('\n');
            final File robotTxtFile = new File(tempDir, "robots.txt");
            FileUtil.writeBytes(robotTxtFile.getAbsolutePath(), buf.toString().getBytes("UTF-8"));

     */
    protected void initDisallowCompound(final String prop) {
        if (prop == null) {
            return;
        }
        final Set<String> disallow = new HashSet<>();
        final StringTokenizer st = new StringTokenizer(prop, ",");
        while (st.hasMoreTokens()) {
            disallow.add(st.nextToken().trim());
        }

        this.redirectHttpStatusPattern = redirectHttpStatusPattern;
    }

    /**
     * Sets whether to use robots.txt disallow rules.
     *
     * @param useRobotsTxtDisallows True to use disallow rules, false otherwise
     */
    public void setUseRobotsTxtDisallows(final boolean useRobotsTxtDisallows) {
        this.useRobotsTxtDisallows = useRobotsTxtDisallows;
    }

        // Check protocol versions
        assertNotNull(testConfig.getMinimumVersion());
        assertNotNull(testConfig.getMaximumVersion());

        // Check disallow compound
        assertNotNull(testConfig.disallowCompound);
        assertTrue(testConfig.disallowCompound.contains("Smb2SessionSetupRequest"));
        assertTrue(testConfig.disallowCompound.contains("Smb2TreeConnectRequest"));

    /*
     * Note that we allow (in contravention of a strict interpretation of the relevant RFCs) domain
     * parts other than the last may begin with a digit (for example, "3com.com"). It's important to
     * disallow an initial digit in the last part; it's the only thing that stops an IPv4 numeric
     * address like 127.0.0.1 from looking like a valid domain name.
     */

    if (isFinalPart && DIGIT_MATCHER.matches(part.charAt(0))) {

    // contain non-decimal characters.
    int length = end - start;
    if (length <= 0 || length > 3) {
      throw new NumberFormatException();
    }
    // Disallow leading zeroes, because no clear standard exists on
    // whether these should be interpreted as decimal or octal.
    if (length > 1 && ipString.charAt(start) == '0') {
      throw new NumberFormatException();
    }

    // contain non-decimal characters.
    int length = end - start;
    if (length <= 0 || length > 3) {
      throw new NumberFormatException();
    }
    // Disallow leading zeroes, because no clear standard exists on
    // whether these should be interpreted as decimal or octal.
    if (length > 1 && ipString.charAt(start) == '0') {
      throw new NumberFormatException();
    }

- Service loadBalancerSourceRanges doesn't respect updates ([#33033](https://github.com/kubernetes/kubernetes/issues/33033))
- disallow user to update loadbalancerSourceRanges ([#33346](https://github.com/kubernetes/kubernetes/issues/33346))

## Notable Changes to Existing Behavior

### Deployments

### Bug or Regression

- Changed the node restrictions to disallow the node to change it's ownerReferences. ([#133469](https://github.com/kubernetes/kubernetes/pull/133469), [@natherz97](https://github.com/natherz97)) [SIG Auth]

## Dependencies

### Added
_Nothing has changed._

### SIG API Machinery

This release SIG API Machinery focused mainly on CustomResources. For example, subresources for CustomResources are now beta and enabled by default. With this, updates to the `/status` subresource will disallow updates to all fields other than `.status` (not just `.spec` and `.metadata` as before). Also, `required` and `description` can be used at the root of the CRD OpenAPI validation schema when the `/status` subresource is enabled.