This release contains changes that address the following vulnerabilities:

### CVE-2022-3162: Unauthorized read of Custom Resources

A security issue was discovered in Kubernetes where users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group they are not authorized to read.

**Affected Versions**:
  - kube-apiserver v1.25.0 - v1.25.3

   * with a differently behaving {@code loader}. For example, a call that requests a short timeout
   * for an RPC may wait for a similar call that requests a long timeout, or a call by an
   * unprivileged user may return a resource accessible only to a privileged user making a similar
   * call. To prevent this problem, create a key object that includes all values that affect the

### Pod resource metrics

On-demand metrics calculation is now available through `/metrics/resources`. [When enabled](
https://docs.k8s.io/concepts/cluster-administration/system-metrics#kube-scheduler-metrics), the endpoint will report the requested resources and the desired limits of all running pods.

### Introducing `RootCAConfigMap`

You could need to tell the client that:

* The client doesn't have enough privileges for that operation.
* The client doesn't have access to that resource.
* The item the client was trying to access doesn't exist.
* etc.

In these cases, you would normally return an **HTTP status code** in the range of **400** (from 400 to 499).

     * @param tc the CIFS context to use for the connection
     * @throws SmbException if an SMB error occurs
     * @throws MalformedURLException if the URL is malformed
     */
    @SuppressWarnings("resource")
    public SmbRandomAccessFile(final String url, final String mode, final int sharing, final CIFSContext tc)
            throws SmbException, MalformedURLException {
        this(new SmbFile(url, tc), mode, sharing, true);

- Kube-scheduler now retries scheduling Pods rejected by the PodTopologySpread plugin...

            final AcknowledgedResponse putMappingResponse = fesenClient.get(c -> {
                final String source = FileUtil.readText("mapping/" + mappingName + ".json");
                return c.admin().indices().preparePutMapping(index).setSource(source, XContentType.JSON).execute();
            });
            if (putMappingResponse.isAcknowledged()) {

```
{
  "version": "2012-10-17",
  "statement": [
    {
      "effect": "Allow",
      "action": [
        "s3:ListAllMyBuckets"
      ],
      "resource": [
        "arn:aws:s3:::*"
      ]
    }
  ]
}
```

## Authorization Flow

        `tf.lookup.StaticHashTable.__init__` to create the table in anonymous
        mode. In this mode, the table resource can only be accessed via resource
        handles (not resource names) and will be deleted automatically when all
        resource handles pointing to it are gone.
*   `tf.data`:
    *   Introduce the `tf.data.experimental.at` API which provides random access

    a `Content-Length`.
 *  Fix: Don't crash if the thread is interrupted while reading the public
    suffix database.
 *  Fix: Use relative resource path when loading the public suffix database.
    Loading the resource using a path relative to the class prevents conflicts
    when the OkHttp classes are relocated (shaded) by allowing multiple private
    copies of the database.