* Fix a race condition in which kubeadm only waits for the kubelets kubeconfig file when it has performed the TLS bootstrap, but wasn't waiting for certificates to be present in the filesystem ([#72030](https://github.com/kubernetes/kubernetes/pull/72030), [@ereslibre](https://github.com/ereslibre))

- `etcd: Update etcd to `v3.6.6`. (#135271, @bzsuni) [SIG API Machinery, Cloud Provider, Cluster Lifecycle, Etcd and Testing]
- Fix a bug in the kube-apiserver where a malformed Service without name can cause high CPU usage. The bug is present on the new Cluster IP allocators enabled with the feature MultiCIDRServiceAllocator (enabled by default since 1.33)


## Dependencies

### Added
- cyphar.com/go-pathrs: v0.2.1

* kubeadm: prevent overriding of certain kubelet security configuration parameters if the user wished to modify them ([#81903](https://github.com/kubernetes/kubernetes/pull/81903), [@jfbai](https://github.com/jfbai))

- Ensure that volume capability and staging target fields are present in nodeExpansion CSI calls

- Prevent unnecessary Endpoints and EndpointSlice updates caused by Pod ResourceVersion change ([#108078](https://github.com/kubernetes/kubernetes/pull/108078), [@tnqn](https://github.com/tnqn)) [SIG Apps and Network]

- During device plugin allocation, resources requested by the pod can only be allocated if the device plugin has registered itself to kubelet AND healthy devices are present on the node to be allocated. If these conditions are not sattsfied, the pod would fail with `UnexpectedAdmissionError` error. ([#117738](https://github.com/kubernetes/kubernetes/pull/117738), [@swatisehgal](https://github.com/swatisehgal)) [SIG Node...

- The OpenAPI version field will now be properly autopopulated without needing other OpenAPI fields present in generic API server code. ([#66411](https://github.com/kubernetes/kubernetes/pull/66411), [@DirectXMan12](https://github.com/DirectXMan12))

session.tracking.modes=cookie

# Comma-separated list of request parameter keys to store in cookies before SSO login.
cookie.search.parameter.keys=q,num,sort
# Comma-separated list of required parameter keys that must be present to store in cookies.
cookie.search.parameter.required_keys=q
# Maximum length of the encoded search parameters stored in cookies.
cookie.search.parameter.max.length=1000

            return this.isExists;
        }

        // Fast path for already resolved existence with recent cache
        if (this.isExists && (currentTime - (this.attrExpiration - getContext().getConfig().getAttributeCacheTimeout())) < 5000) {
            log.trace("Using recent positive existence cache");
            return true;
        }

        this.attributes = ATTR_READONLY | ATTR_DIRECTORY;

        .build()
    val response = get(url)
    assertThat(response.body.string()).isEqualTo(entryBody)
    assertThat(response.header("Content-Length")).isEqualTo("3")
  }

  /** The TLS version is present in OkHttp 3.0 and beyond.  */
  @Test
  fun testGoldenCacheHttpsResponseOkHttp30() {
    val url = server.url("/")
    val urlKey = key(url)
    val prefix = get().getPrefix()
    val entryMetadata =