public static final String LABELS_LANG = "{labels.lang}";

    /** The key of the message: Outputs */
    public static final String LABELS_OUTPUTS = "{labels.outputs}";

    /** The key of the message: Part-of-speech */
    public static final String LABELS_POS = "{labels.pos}";

    /** The key of the message: Delete old job logs */
    public static final String LABELS_PURGE_JOB_LOG_DAY = "{labels.purgeJobLogDay}";

* kubectl: Fix bug that showed terminated/evicted pods even without `--show-all`. ([#48786](https://github.com/kubernetes/kubernetes/pull/48786), [@janetkuo](https://github.com/janetkuo))
* Never prevent deletion of resources as part of namespace lifecycle ([#48733](https://github.com/kubernetes/kubernetes/pull/48733), [@liggitt](https://github.com/liggitt))

Here is a list of some of the changes that have been made to kubeadm:

- Kubeadm internal config has been promoted to `v1alpha3`:
  - `v1alpha1` has been removed.
  - `v1alpha3` has split apart `MasterConfiguration` into separate components; `InitConfiguration`, `ClusterConfiguration`, `JoinConfiguration`, `KubeletConfiguration`, and `KubeProxyConfiguration`

- In order to enable dual-stack support within kubeadm and kubernetes components, as part of the init config file, the user should set feature-gate `IPv6DualStack=true` in the ClusterConfiguration. Additionally, for each worker node, the user should set the feature-gate for kubelet using either `nodeRegistration.kubeletExtraArgs` or `KUBELET_EXTRA_ARGS`....

   *     iterator, so users should cease making direct calls to it after calling this method.
   * @return a peeking iterator backed by that iterator. Apart from the additional {@link
   *     PeekingIterator#peek()} method, this iterator behaves exactly the same as {@code iterator}.
   */
  public static <T extends @Nullable Object> PeekingIterator<T> peekingIterator(

* Third Party Resource tests in the e2e suite were incorrectly marked as part of the conformance bucket.  They are alpha and are not required for conformance. ([#52823](https://github.com/kubernetes/kubernetes/pull/52823), [@smarterclayton](https://github.com/smarterclayton))

        </field>
        <field xdoc.separator="blank">
          <name>subprojects</name>
          <version>4.1.0+</version>
          <description>The subprojects (formerly called modules) to build as a part of this
            project. Each subproject listed is a relative path to the directory containing the subproject.
            To be consistent with the way default URLs are calculated from parent, it is recommended

## Urgent Upgrade Notes
### (No, really, you MUST read this before you upgrade)
#### Cluster Lifecycle
- Kubeadm: add a new `kubelet-finalize` phase as part of the `init` workflow and an experimental sub-phase to enable automatic kubelet client certificate rotation on primary control-plane nodes.

          val result = queueDispatcher.dispatch(request)
          requestCount++
          if (requestCount == 1) {
            // Before handling call1's CONNECT we do all of call2. This part re-entrant!
            try {
              val call2 =
                client.newCall(
                  Request
                    .Builder()
                    .url("https://android.com/call2")

**Fixed Versions**:
  - kube-apiserver v1.25.4
  - kube-apiserver v1.24.8
  - kube-apiserver v1.23.14
  - kube-apiserver v1.22.16

This vulnerability was reported by Richard Turnbull of NCC Group as part of the Kubernetes Audit


**CVSS Rating:** Medium (6.5) [CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)