- The iptables mode of kube-proxy now tracks accepted packets that are destined for node-ports on localhost by introducing `kubeproxy_iptables_localhost_nodeports_accepted_packets_total` metric.

* Bump up version number of debian-base, debian-hyperkube-base and debian-iptables.  ([#67026](https://github.com/kubernetes/kubernetes/pull/67026), [@satyasm](https://github.com/satyasm))
    * Also updates dependencies of users of debian-base.
    * debian-base version 0.3.1 is already available.

* Bump ip-masq-agent to v2.1.1 ([#67916](https://github.com/kubernetes/kubernetes/pull/67916), [@MrHohn](https://github.com/MrHohn))
    * - Update debian-iptables image for CVEs.
    * - Change chain name to IP-MASQ to be compatible with the
    * pre-injected masquerade rules.

* Fix a bug in kubelet hostport logic which flushes KUBE-MARK-MASQ iptables chain ([#32413](https://github.com/kubernetes/kubernetes/pull/32413), [@freehan](https://github.com/freehan))

### Feature

- Kubernetes is now built with Golang 1.16.10 (#106224, @cpanato) [SIG Cloud Provider, Instrumentation, Release and Testing]
- Update debian-base, debian-iptables, setcap images to pick up CVE fixes
  - Debian-base to v1.9.0
  - Debian-iptables to v1.6.7
  - setcap to v2.0.4 (#106147, @cpanato) [SIG Release and Testing]

### Failing Test

- The kubelet now creates an iptables chain named `KUBE-IPTABLES-HINT` in
  the `mangle` table. Containerized components that need to modify iptables
  rules in the host network namespace can use the existence of this chain
  to more-reliably determine whether the system is using iptables-legacy or

  - update setcap/debian-base to bookworm-v1.0.1
  - update distroless-iptables to v0.4.5 ([#123228](https://github.com/kubernetes/kubernetes/pull/123228), [@cpanato](https://github.com/cpanato)) [SIG API Machinery, Architecture, Release and Testing]

### Bug or Regression

- Fixes a race condition in the iptables mode of kube-proxy in 1.27 and later

## Changelog since v1.20.12

## Changes by Kind

### Feature

- Update debian-base, debian-iptables, setcap images to pick up CVE fixes
  - Debian-base to v1.9.0
  - Debian-iptables to v1.6.7 (#106148, @cpanato) [SIG Release and Testing]

### Failing Test

- Fixes hostpath storage e2e tests within SELinux enabled env (#105788, @Elbehery) [SIG Testing]

- Added a kube-proxy flag (`--iptables-localhost-nodeports`, default true) to allow disabling NodePort services on loopback addresses. Note: this only applies to iptables mode and ipv4. ([#108250](https://github.com/kubernetes/kubernetes/pull/108250), [@cyclinder](https://github.com/cyclinder))

                        Valid Options: DEFAULT, IPTABLES, NONE
                      enum:
                      - DEFAULT
                      - IPTABLES
                      - NONE
                      type: string
                    hosts: