* Support secure etcd cluster for centos provider. ([#42994](https://github.com/kubernetes/kubernetes/pull/42994), [@Shawyeok](https://github.com/Shawyeok))

- KEP-3857: Recursive Read-only (RRO) mounts: promote to GA ([#130116](https://github.com/kubernetes/kubernetes/pull/130116), [@AkihiroSuda](https://github.com/AkihiroSuda)) [SIG Apps, Node and Testing]

scrysec.com
sd
sd.cn
sd.us
sdn.gov.pl
sdscloud.pl
se
se.eu.org
se.gov.br
se.leg.br
se.net
search
seat
sebastopol.ua
sec.ps
secaas.hk
secret.jp
secure
security
securitytactics.com
seek
seg.br
seidat.net
seihi.nagasaki.jp
seika.kyoto.jp
seiro.niigata.jp
seirou.niigata.jp
seiyo.ehime.jp
sejny.pl
sekd1.beebyteapp.io

/88290), [@tallclair](https://github.com/tallclair)) [SIG API Machinery and Node]

- `kubectl` no longer defaults to `http://localhost:8080`.  If you own one of these legacy clusters, you are *strongly- encouraged to secure your server.   If you cannot secure your server, you can set `KUBERNETES_MASTER` if you were relying on that behavior and you're client-go user. Set `--server`, `--kubeconfig` or `KUBECONFIG` to make it work in `kubectl`. ([#86173](https://github.com/kubernetes/ku...

    - [IPv4/IPv6 run](#ipv4ipv6-run)
    - [go1.15.5](#go1155)
    - [CSI Volume Snapshot graduates to General Availability](#csi-volume-snapshot-graduates-to-general-availability)
    - [Non-recursive Volume Ownership (FSGroup) graduates to Beta](#non-recursive-volume-ownership-fsgroup-graduates-to-beta)
    - [CSIDriver policy for FSGroup graduates to Beta](#csidriver-policy-for-fsgroup-graduates-to-beta)

preflight check `ContainerRuntimeVersion` to validate if the installed container runtime supports the `RuntimeConfig` gRPC method. If unsupported, `kubeadm` prints a warning message.
  
  Starting with Kubernetes `v1.36`, `kubelet` might refuse to start if the CRI runtime does not support this feature. More information can be found at the [Kubernetes blog](https://kubernetes.io/blog/2025/09/12/kubernetes-v1-34-cri-cgroup-driver-lookup-now-ga/). ([#134906](https://github.com/kubernetes/k...

search

// seat : SEAT, S.A. (Sociedad Unipersonal)
// https://www.iana.org/domains/root/db/seat.html
seat

// secure : Amazon Registry Services, Inc.
// https://www.iana.org/domains/root/db/secure.html
secure

// security : XYZ.COM LLC
// https://www.iana.org/domains/root/db/security.html
security

// seek : Seek Limited

emplate")&&(e=e.content||e),ce.merge([],e.childNodes))}},function(r,i){ce.fn[r]=function(e,t){var n=ce.map(this,i,e);return"Until"!==r.slice(-5)&&(t=e),t&&"string"==typeof t&&(n=ce.filter(t,n)),1<this.length&&(j[r]||ce.uniqueSort(n),E.test(r)&&n.reverse()),this.pushStack(n)}});var D=/[^\x20\t\r\n\f]+/g;function N(e){return e}function q(e){throw e}function L(e,t,n,r){var i;try{e&&v(i=e.promise)?i.call(e).done(t).fail(n):e&&v(i=e.then)?i.call(e,t,n):t.apply(void 0,[e].slice(r))}catch(e){n.apply(void...

2B20..2B23    ; valid                  ;      ; NV8    # 5.0  WHITE PENTAGON..HORIZONTAL BLACK HEXAGON
2B24..2B4C    ; valid                  ;      ; NV8    # 5.1  BLACK LARGE CIRCLE..RIGHTWARDS ARROW ABOVE REVERSE TILDE OPERATOR
2B4D..2B4F    ; valid                  ;      ; NV8    # 7.0  DOWNWARDS TRIANGLE-HEADED ZIGZAG ARROW..SHORT BACKSLANTED SOUTH ARROW

### Skip Volume Ownership change graduates to GA

The feature to configure volume permission and ownership change policy for Pods moved to GA in 1.23.
This allows users to skip recursive permission changes on mount and speeds up the pod start up time.

### Allow CSI drivers to opt-in to volume ownership and permission change graduates to GA