3BvF,EAAEgE,GAAGc,GAAoBS,EAAMkB,iBAC/BzG,EAAEgE,GAAGc,GAAMmC,YAAc1B,EACzBvF,EAAEgE,GAAGc,GAAMoC,WAAc,WAEvB,OADAlH,EAAEgE,GAAGc,GAAQG,EACNM,EAAMkB,kBChKf,IAAM3B,EAAsB,SAEtBC,EAAsB,YACtBC,EAAS,IAAiBD,EAC1BoC,EAAsB,YACtBlC,EAAsBjF,EAAEgE,GAAGc,GAE3BQ,EACK,SADLA,EAEK,MAFLA,EAGK,QAGL8B,EACmB,0BADnBA,EAEmB,0BAFnBA,EAGmB,yBAHnBA,EAImB,+BAJnBA,EAKmB,6BALnBA,EAMmB,UANnBA,EAOmB,OAGnBlC,EAAQ,CACZG,eAAc,QAAgBL,EAAYmC,EAC1CE,oBAAsB,QAAQrC,EAAYmC,EAApB,QACSnC,EAAYmC,EAC3CG,cAAa,OAAgBtC,EAAYmC,GASrCI,aACJ,SAAA...

			return false
		}

		// Finally, if there is no parent policy, check if a policy claim is
		// present in the session token.
		if len(policies) == 0 {
			// If there is no parent policy mapping, we fall back to
			// using policy claim from JWT.
			policySet, ok := args.GetPolicies(iamPolicyClaimNameOpenID())
			if !ok {
				// When claims are set, it should have a policy claim field.
				return false
			}

  - build: Use go-runner:buster-v2.0.1 (built using go1.15.1)
  - bazel: Replace --features with Starlark build settings flag
  - hack/lib/util.sh: some bash cleanups
    
    - switched one spot to use kube::logging
    - make kube::util::find-binary return an error when it doesn't find
      anything so that hack scripts fail fast instead of with '' binary not
      found errors.

raw string literals and interpreted string literals.
</p>

<p>
Raw string literals are character sequences between back quotes, as in
<code>`foo`</code>.  Within the quotes, any character may appear except
back quote. The value of a raw string literal is the
string composed of the uninterpreted (implicitly UTF-8-encoded) characters
between the quotes;

### Bug or Regression

- Client-go: resolves an issue with informers falling back to full list requests when timeouts are encountered, rather than re-establishing a watch. ([#89977](https://github.com/kubernetes/kubernetes/pull/89977), [@liggitt](https://github.com/liggitt)) [SIG API Machinery and Testing]

- Fix memory leak in kube-apiserver when underlying time goes forth and back. ([#96266](https://github.com/kubernetes/kubernetes/pull/96266), [@chenyw1990](https://github.com/chenyw1990)) [SIG API Machinery]

   ([#123261](https://github.com/kubernetes/kubernetes/pull/123261), [@skitt](https://github.com/skitt))
- Reverted the `EventedPLEG` feature (beta, but disabled by default) back to alpha due to a known issue.
   ([#122697](https://github.com/kubernetes/kubernetes/pull/122697), [@pacoxu](https://github.com/pacoxu))
- Used `errors.Is()` to handle errors returned by `LookPath()`.

- Updates `debian-iptables` to v1.6.7 to pick up CVE fixes. ([#104970](https://github.com/kubernetes/kubernetes/pull/104970), [@PushkarJ](https://github.com/PushkarJ))
- Updates the following images to pick up CVE fixes:
  - `debian` to v1.9.0
  - `debian-iptables` to v1.6.6

the pool of Service IP addresses thereby reducing the risk of collision.

A Service `ClusterIP` can be assigned:

* dynamically, which means the cluster will automatically pick a free IP within the configured Service IP range.
* statically, which means the user will set one IP within the configured Service IP range.

}

// Represents an empty directory for a pod.
// Empty directory volumes support ownership management and SELinux relabeling.
message EmptyDirVolumeSource {
  // medium represents what type of storage medium should back this directory.
  // The default is "" which means to use the node's default medium.
  // Must be an empty string (default) or Memory.
  // More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir