- Added full cgroup v2 swap support for both `Limited` and `Unlimited` swap.
  
  When `LimitedSwap` is enabled the swap limit would be automatically calculated for
  Burstable QoS pods. For Best-Effort/Guaranteed QoS pods, swap would be disabled.
  
  Containers with memory requests equal to their memory limits also won't have
  swap access, and it is a way to opt-out of swap for a single container.

  // on that node is marked deleted. If the old pod becomes unavailable for any
  // reason (Ready transitions to false, is evicted, or is drained) an updated
  // pod is immediatedly created on that node without considering surge limits.
  // Allowing surge implies the possibility that the resources consumed by the
  // daemonset on any given node can double if the readiness check fails, and

* Enable DefaultTolerationSeconds admission controller by default ([#41815](https://github.com/kubernetes/kubernetes/pull/41815), [@kevin-wangzefeng](https://github.com/kevin-wangzefeng))
* ResourceQuota ability to support default limited resources ([#36765](https://github.com/kubernetes/kubernetes/pull/36765), [@derekwaynecarr](https://github.com/derekwaynecarr))

    * Custom apiservers built with the latest apiserver library will have the 100MB limit on the body of resource requests as well. The limit can be altered via ServerRunOptions.MaxRequestBodyBytes.
    * The body size limit does not apply to subresources like pods/proxy that proxy request content to another server.

   * that they were not initialized yet.
   */
  private static final int SUFFIX_NOT_INITIALIZED = -2;

  /**
   * Maximum parts (labels) in a domain name. This value arises from the 255-octet limit described
   * in <a href="http://www.ietf.org/rfc/rfc2181.txt">RFC 2181</a> part 11 with the fact that the
   * encoding of each part occupies at least two bytes (dot plus label externally, length byte plus

//
// Whenever a branch is scanned, it is assumed that it will be un-compacted
// before it hits any of the above limits.
// This will make the branch rebalance itself when scanned if the distribution of objects has changed.

// scanDataFolder will scanner the basepath+cache.Info.Name and return an updated cache.
// The returned cache will always be valid, but may not be updated from the existing.

    canceling calls would cause the shared HTTP/2 connection to be unnecessarily released. This
    harmed connection reuse.
 *  Fix: Ensure canceled and discarded HTTP/2 data is not permanently counted against the limited
    flow control window. We had a few bugs where window size accounting was broken when streams
    were canceled or reset.
 *  Fix: Recover gracefully if the TLS session returns an unexpected version (`NONE`) or cipher

		Hidden: true,
		EnvVar: "MINIO_CROSSDOMAIN_XML",
	},
	cli.StringFlag{
		Name:   "memlimit",
		Usage:  "set global memory limit per server via GOMEMLIMIT",
		Hidden: true,
		EnvVar: "MINIO_MEMLIMIT",
	},
	cli.IntFlag{
		Name:   "send-buf-size",
		Value:  4 * humanize.MiByte,
		EnvVar: "MINIO_SEND_BUF_SIZE",
		Hidden: true,
	},

      input: String,
      pos: Int,
      limit: Int,
    ): Int {
      var i = pos
      while (i < limit) {
        when (input[i]) {
          '[' -> {
            while (++i < limit) {
              if (input[i] == ']') break
            }
          }
          ':' -> return i
        }
        i++
      }
      return limit // No colon.
    }

- Critical pods can now be created in namespaces other than kube-system. To limit critical pods to the kube-system namespace, cluster admins should create an admission configuration file limiting critical pods by default, and a matching quota object in the `kube-system` namespace permitting critical pods in that namespace. See https://kubernetes.io/docs/concepts/policy/resource-quotas/#limit-priority-class-consumption-by-default for details. ([#76310](https://github.com/kubernetes...