// loadFactor is 0.75 by default. So with the calculation here we ensure that the
      // threshold is equal to ceilingPowerOfTwo(expectedSize). There is a separate code
      // path when the first operation on the new map is putAll(otherMap). There, prior to
      // https://github.com/openjdk/jdk/commit/3e393047e12147a81e2899784b943923fc34da8e, a bug

- Fluentd: isolate logging resources in separate namespace `logging` ([#68004](https://github.com/kubernetes/kubernetes/pull/68004), [@saravanan30erd](https://github.com/saravanan30erd))

* kube-up: install new Docker pre-requisite (libltdl7) when not in image ([#28745](https://github.com/kubernetes/kubernetes/pull/28745), [@justinsb](https://github.com/justinsb))
* Separate rate limiters for Pod evictions for different zones in NodeController ([#28843](https://github.com/kubernetes/kubernetes/pull/28843), [@gmarek](https://github.com/gmarek))

* [AppArmor] Hold bad AppArmor pods in pending rather than rejecting ([#35342](https://github.com/kubernetes/kubernetes/pull/35342), [@timstclair](https://github.com/timstclair))
* Federation: separate notion of zone-name & dns-suffix ([#35372](https://github.com/kubernetes/kubernetes/pull/35372), [@justinsb](https://github.com/justinsb))

- Provider/azure: Network security groups can now be in a separate resource group. ([#87035](https://github.com/kubernetes/kubernetes/pull/87035), [@CecileRobertMichon](https://github.com/CecileRobertMichon)) [SIG Cloud Provider]

 - It can be used to provide scratch storage that is different from the root disk, for example persistent memory, or a separate local disk on that node.
 - All StorageClass parameters for volume provisioning are supported.

### Other (Cleanup or Flake)

- "Removed the ability to run `kubectl exec [POD] [COMMAND]` without a `--` separator.
  The `--` separator has been recommended since the Kubernetes v1.18 release, which also deprecated the legacy way of invoking `kubectl exec`.
  

  }

  // Inner Classes

  /**
   * Segments are specialized versions of hash tables. This subclass inherits from ReentrantLock
   * opportunistically, just to simplify some locking and avoid separate construction.
   */
  @SuppressWarnings("serial") // This class is never serialized.
  static final class Segment<K, V> extends ReentrantLock {

    /*

(*[32]byte)(random)), nil } func computeMessageHash(tr []byte, msg []byte, context string) ([64]byte, error) { if len(context) > 255 { return [64]byte{}, errContextTooLong } H := sha3.NewShake256() H.Write(tr) H.Write([]byte{0}) // ML-DSA / HashML-DSA domain separator H.Write([]byte{byte(len(context))}) H.Write([]byte(context)) H.Write(msg) var μ [64]byte H.Read(μ[:]) return μ, nil } func signInternal(priv *PrivateKey, μ *[64]byte, random *[32]byte) []byte { p, k, l := priv.pub.p, priv.pub.p.k, priv.pub.p.l A,...

* ReplicationController now shares its underlying controller implementation with ReplicaSet to reduce the maintenance burden going forward. However, they are still separate resources and there should be no externally visible effects from this change. ([#49429](https://github.com/kubernetes/kubernetes/pull/49429), [@enisoc](https://github.com/enisoc))