- Terminating a restartPolicy=Never pod no longer has a chance to report the pod succeeded when it actually failed. ([#88440](https://github.com/kubernetes/kubernetes/pull/88440), [@smarterclayton](https://github.com/smarterclayton)) [SIG Node and Testing]

* Advanced audit allows logging failed login attempts ([#51119](https://github.com/kubernetes/kubernetes/pull/51119), [@soltysh](https://github.com/soltysh))
* kubeadm: Add support for using an external CA whose key is never stored in the cluster ([#50832](https://github.com/kubernetes/kubernetes/pull/50832), [@nckturner](https://github.com/nckturner))

- The pod phase lifecycle guarantees that terminal Pods, those whose states are Unready or Succeeded, can not regress and will have all container stopped. Hence, terminal Pods will never be reachable and should not publish their IP addresses on the Endpoints or EndpointSlices, independently of the Service TolerateUnready option. ([#110260](https://github.com/kubernetes/kubernetes/pull/110260), [@robscott](https://github.com/robscott))...

- Fix a bug where kubelet would not retry pod sandbox creation when the restart policy of the pod is Never ([#79451](https://github.com/kubernetes/kubernetes/pull/79451), [@yujuhong](https://github.com/yujuhong))

        if you see such issues, please use the legacy optimizer, and file
        an issue in the Keras GitHub repo.

    The old Keras optimizer will never be deleted, but will not see any
    new feature additions.
    New optimizers (e.g., `Adafactor`) will
    only be implemented based on `tf.keras.optimizers.Optimizer`, the new
    base class.

* Fix a bug where kubelet would not retry pod sandbox creation when the restart policy of the pod is Never ([#79451](https://github.com/kubernetes/kubernetes/pull/79451), [@yujuhong](https://github.com/yujuhong))

- Fixed a bug where the Kubelet miscalculated the process usage of pods, causing pods to never get evicted for PID usage. ([#124101](https://github.com/kubernetes/kubernetes/pull/124101), [@haircommander](https://github.com/haircommander)) [SIG Node and Testing]

- The pod phase lifecycle guarantees that terminal Pods, those whose states are `Unready` or `Succeeded`, can not regress and will have all container stopped. Hence, terminal Pods will never be reachable and should not publish their IP addresses on the `Endpoints` or `EndpointSlices`, independently of the Service `TolerateUnready` option. ([#110255](https://github.com/kubernetes/kubernetes/pull/110255), [@robscott](https://github.com/robscott))...

* Fix a bug where kubelet would not retry pod sandbox creation when the restart policy of the pod is Never ([#79451](https://github.com/kubernetes/kubernetes/pull/79451), [@yujuhong](https://github.com/yujuhong))

drbg.Reseed(getEntropy(), additionalInput) additionalInput = nil continue } b = b[size:] } } var testingReader io.Reader // SetTestingReader sets a global, deterministic cryptographic randomness source // for testing purposes. Its Read method must never return an error, it must // never return short, and it must be safe for concurrent use. // // This is only intended to be used by the testing/cryptotest package. func SetTestingReader(r io.Reader) { testingReader = r } // DefaultReader is a sentinel type, embedded...