- Fixed a bug in kubelet that will saturate CPU utilization after containerd got restarted. ([#97174](https://github.com/kubernetes/kubernetes/pull/97174), [@hanlins](https://github.com/hanlins)) [SIG Node]

- Fix kubelet to properly log when a container is started. Previously, kubelet may log that container is dead and was restarted when it was actually started for the first time. This behavior only happened on pods with initContainers and regular containers. ([#91469](https://github.com/kubernetes/kubernetes/pull/91469), [@rata](https://github.com/rata))...

        }
        TimeoutManager.getInstance().addTimeoutTarget(() -> {
            if (logger.isDebugEnabled()) {
                logger.debug("[scheduleParentGroupLookup] Async task started for user: {}", user.getName());
            }
            final long startTime = System.currentTimeMillis();
            try {
                final List<String> updatedGroups = new ArrayList<>(initialGroups);

- Node affinity, Node selectors, and tolerations are now mutable for Jobs that are suspended and have never been started ([#105479](https://github.com/kubernetes/kubernetes/pull/105479), [@ahg-g](https://github.com/ahg-g))
- Pod template annotations and labels are now mutable for Jobs that are suspended and have never been started ([#105980](https://github.com/kubernetes/kubernetes/pull/105980), [@ahg-g](https://github.com/ahg-g))

        checkEntryNotNull(entry.getKey(), entry.getValue());
      }
      ImmutableMap<?, ? extends V> untypedResult = ImmutableEnumMap.asImmutable(clone);
      /*
       * The result has the same type argument we started with. We just couldn't express EnumMap<K,
       * ...> or ImmutableEnumMap<K, ...> along the way because our own <K> isn't <K extends
       * Enum<K>>.
       *

        String host = sambaContainer.getHost();
        Integer port = sambaContainer.getMappedPort(SMB_PORT);
        baseUrl = "smb://" + host + ":" + port + "/";

        log.info("Samba container started - Base URL: {}", baseUrl);

        // Create authentication context - try guest auth first for broader compatibility
        try {

		err := fmt.Errorf("unexpected part result count: %d, want %d", len(partInfoFiles), len(parts))
		bugLogIf(ctx, err)
		return oi, toObjectErr(err, bucket, object)
	}

	// Checksum type set when upload started.
	var checksumType hash.ChecksumType
	if cs := fi.Metadata[hash.MinIOMultipartChecksum]; cs != "" {
		checksumType = hash.NewChecksumType(cs, fi.Metadata[hash.MinIOMultipartChecksumType])

		return
	}

	var forceMD5 []byte
	// Optimization: If SSE-KMS and SSE-C did not request Content-Md5. Use uuid as etag. Optionally enable this also
	// for server that is started with `--no-compat`.
	kind, _ := crypto.IsRequested(formValues)
	if !etag.ContentMD5Requested(formValues) && (kind == crypto.SSEC || kind == crypto.S3KMS || !globalServerCtxt.StrictS3Compat) {
		forceMD5 = mustGetUUIDBytes()

annotations to include with deployment or statefulset additionalAnnotation: [] ## Typically the deployment/statefulset includes checksums of secrets/config, ## So that when these change on a subsequent helm install, the deployment/statefulset ## is restarted. This can result in unnecessary restarts under GitOps tooling such as ## flux, so set to "true" to disable this behaviour. ignoreChartChecksums: false ## Additional arguments to pass to minio binary extraArgs: [] ## Port number for MinIO S3 API Access...

The external cloud provider was established and reached feature parity with in-tree, and we expect to stabilize it and have it as preferred deployment model by 1.13. We are also getting started on externalizing the vSphere volume functionalities in a CSI plugin to fully reproduce the current in-tree storage functionality.