is an internal function that records the use of an approved // service. It does not override RecordNonApproved calls in the same span. // // It should be called by exposed functions that perform a whole cryptographic // alrgorithm (e.g. by Sum, not by New, unless a cryptographic Instantiate // algorithm is performed) and should be called after any checks that may cause // the function to error out or panic. func RecordApproved() { if getIndicator() == indicatorUnset { setIndicator(indicatorTrue) }...

- Kubeadm: graduated the kubeadm specific feature gate `WaitForAllControlPlaneComponents` to GA. The feature gate is was locked to always be enabled and on node initialization kubeadm performed a health check for all control plane components and not only the `kube-apiserver`. ([#132594](https://github.com/kubernetes/kubernetes/pull/132594), [@neolit123](https://github.com/neolit123))

    *   Added 16-bit support for `top_k`.

*   `tf.function`

    *   ConcreteFunction (`tf.types.experimental.ConcreteFunction`) as generated through `get_concrete_function` now performs holistic input validation similar to calling `tf.function` directly. This can cause breakages where existing calls pass Tensors with the wrong shape or omit certain non-Tensor arguments (including default values).

*   `tf.nn`

- Kubernetes is now built using go 1.17. ([#103692](https://github.com/kubernetes/kubernetes/pull/103692), [@justaugustus](https://github.com/justaugustus))
- Performs strict server side schema validation requests via the `fieldValidation=[Strict,Warn,Ignore]`. ([#105916](https://github.com/kubernetes/kubernetes/pull/105916), [@kevindelgado](https://github.com/kevindelgado))

## Changes since v1.3.0-beta.1

### Experimental Features

- Kubeadm: when adding new control plane nodes with "kubeadm join", ensure that the etcd member addition is performed only if a given member URL does not already exist in the list of members. Similarly, on "kubeadm reset" only remove an etcd member if its ID exists. ([#127620](https://github.com/kubernetes/kubernetes/pull/127620), [@SataQiu](https://github.com/SataQiu))...

func (er erasureObjects) updateRestoreMetadata(ctx context.Context, bucket, object string, objInfo ObjectInfo, opts ObjectOptions) error {
	oi := objInfo.Clone()
	oi.metadataOnly = true // Perform only metadata updates.

	// allow retry in the case of failure to restore
	delete(oi.UserDefined, xhttp.AmzRestore)

	if _, err := er.CopyObject(ctx, bucket, object, bucket, object, oi, ObjectOptions{

- Kubeadm: when adding new control plane nodes with "kubeadm join", ensure that the etcd member addition is performed only if a given member URL does not already exist in the list of members. Similarly, on "kubeadm reset" only remove an etcd member if its ID exists. ([#127619](https://github.com/kubernetes/kubernetes/pull/127619), [@SataQiu](https://github.com/SataQiu))...

is an internal function that records the use of an approved // service. It does not override RecordNonApproved calls in the same span. // // It should be called by exposed functions that perform a whole cryptographic // alrgorithm (e.g. by Sum, not by New, unless a cryptographic Instantiate // algorithm is performed) and should be called after any checks that may cause // the function to error out or panic. func RecordApproved() { if getIndicator() == indicatorUnset { setIndicator(indicatorTrue) }...

- Scheduler throughput has been improved by ~50% in large clusters (>2000 nodes).

### SIG-service-catalog
- The Originating Identity feature, which lets the broker know which user that performed an action, is now GA.
- [Namespaced Brokers](https://svc-cat.io/docs/namespaced-broker-resources/), which enable operators to install a broker into a namespace instead of the cluster level, reached GA.