* `v1beta1` RoleBinding/ClusterRoleBinding subjects changed `apiVersion` to `apiGroup` to fully-qualify a subject. ServiceAccount...

includes changes suggested by tools.

We sometimes reject contributions due to the low quality of the submission
since low-quality submissions tend to take unreasonable effort to review
properly. Quality is rather subjective so it is hard to describe exactly how to
avoid this, but there are some basic steps you can take to reduce the chances
of rejection. Follow the guidelines listed above when preparing your changes.

### Action Required

* `kubectl create rolebinding` and `kubectl create clusterrolebinding` no longer allow specifying multiple subjects as comma-separated arguments. Use repeated `--user`, `--group`, or `--serviceaccount` arguments to specify multiple subjects.  ([#43903](https://github.com/kubernetes/kubernetes/pull/43903), [@xilabao](https://github.com/xilabao))

### Other notable changes

             name: system:azure-cloud-provider
           roleRef:
             apiGroup: rbac.authorization.k8s.io
             kind: ClusterRole
             name: system:azure-cloud-provider
           subjects:
           - kind: ServiceAccount
             name: azure-cloud-provider
             namespace: kube-system
    ```

* Add support for --image-pull-policy to 'kubectl run' ([#30614](https://github.com/kubernetes/kubernetes/pull/30614), [@AdoHe](https://github.com/AdoHe))
* x509 authenticator: get groups from subject's organization field ([#30392](https://github.com/kubernetes/kubernetes/pull/30392), [@ericchiang](https://github.com/ericchiang))

*   RBAC ClusterRoles can now select other roles to aggregate. ([#54005](https://github.com/kubernetes/kubernetes/pull/54005),[ @deads2k](https://github.com/deads2k))
*   Fixed an issue with RBAC reconciliation that caused duplicated subjects in some bootstrapped RoleBinding objects on each restart of the API server. ([#53239](https://github.com/kubernetes/kubernetes/pull/53239),[ @enj](https://github.com/enj))

#### **Other**

  Alice did not feel encouraged to ask any more questions about
it, so she turned to the Mock Turtle, and said `What else had you
to learn?'

  `Well, there was Mystery,' the Mock Turtle replied, counting
off the subjects on his flappers, `--Mystery, ancient and modern,
with Seaography:  then Drawling--the Drawling-master was an old
conger-eel, that used to come once a week:  HE taught us
Drawling, Stretching, and Fainting in Coils.'

  Alice did not feel encouraged to ask any more questions about
it, so she turned to the Mock Turtle, and said `What else had you
to learn?'

  `Well, there was Mystery,' the Mock Turtle replied, counting
off the subjects on his flappers, `--Mystery, ancient and modern,
with Seaography:  then Drawling--the Drawling-master was an old
conger-eel, that used to come once a week:  HE taught us
Drawling, Stretching, and Fainting in Coils.'

* Fixes an issue with RBAC reconciliation that could cause duplicated subjects in some bootstrapped rolebindings on each restart of the API server. ([#53239](https://github.com/kubernetes/kubernetes/pull/53239), [@enj](https://github.com/enj))

* You can now display requests/limits of extended resources in node allocated resources. ([#46079](https://github.com/kubernetes/kubernetes/pull/46079), [@xiangpengzhao](https://github.com/xiangpengzhao))
* The `--remove-extra-subjects` and `--remove-extra-permissions` flags have been enabled for `kubectl auth reconcile` ([#64541](https://github.com/kubernetes/kubernetes/pull/64541), [@mrogers950](https://github.com/mrogers950))