- Revised the Kubelet API Authorization with new subresources, that allow finer-grained authorization checks and access control for kubelet endpoints.

- Revised the Pod API with Alpha support for volumes derived from OCI artifacts. This feature is behind the `ImageVolume` feature gate. ([#125660](https://github.com/kubernetes/kubernetes/pull/125660), [@saschagrunert](https://github.com/saschagrunert)) [SIG...

- Fixes creationTimestamp: null causing unnecessary writes to etcd ([#116865](https://github.com/kubernetes/kubernetes/pull/116865), [@alexzielenski](https://github.com/alexzielenski)) [SIG API Machinery and Testing]
- Revised the logic for DaemonSet rolling update to exclude nodes if scheduling constraints are not met.

    which was incorrectly matching prefix based on resource
    prefixes instead of exact match.
```

- There is always a possibility of a fix that is new, it is advised that the developer must make sure that the fix is sent upstream, reviewed and merged to the master branch.

## Creating a hotfix branch

    for (Entry<K, V> entry : entries) {
      Entry<V, K> reversed = reverseEntry(entry);
      BiMap<V, K> inv = getMap().inverse();
      assertFalse(
          "Inverse should not contain entry " + reversed, inv.entrySet().contains(reversed));
      assertFalse(
          "Inverse should not contain key " + reversed.getKey(),
          inv.containsKey(reversed.getKey()));
      assertFalse(

- Fixes creationTimestamp: null causing unnecessary writes to etcd ([#116865](https://github.com/kubernetes/kubernetes/pull/116865), [@alexzielenski](https://github.com/alexzielenski)) [SIG API Machinery and Testing]
- Revised the logic for DaemonSet rolling update to exclude nodes if scheduling constraints are not met.

    for (Entry<K, V> entry : entries) {
      Entry<V, K> reversed = reverseEntry(entry);
      BiMap<V, K> inv = getMap().inverse();
      assertFalse(
          "Inverse should not contain entry " + reversed, inv.entrySet().contains(reversed));
      assertFalse(
          "Inverse should not contain key " + reversed.getKey(),
          inv.containsKey(reversed.getKey()));
      assertFalse(

                      "cluster": "outbound|9080||productpage.default.svc.cluster.local",
                      "timeout": "0s",
                      "retry_policy": {
                        "retry_on": "connect-failure,refused-stream,unavailable,cancelled,retriable-status-codes",
                        "num_retries": 2,
                        "retry_host_predicate": [
                          {

   ([#123281](https://github.com/kubernetes/kubernetes/pull/123281), [@seans3](https://github.com/seans3))

- Fixed a bug where the device resources allocated to an init container, with `containerRestartPolicy` of `Always`, were erroneously reused by a regular container. ([#120461](https://github.com/kubernetes/kubernetes/pull/120461), [@gjkim...