### (No, really, you MUST read this before you upgrade)

- The StreamingProxyRedirects feature and `--redirect-container-streaming` flag are deprecated, and will be removed in a future release. The default behavior (proxy streaming requests through the kubelet) will be the only supported option.

pkg syscall (freebsd-386), const O_APPEND = 8
pkg syscall (freebsd-386), const O_ASYNC = 64
pkg syscall (freebsd-386), const O_CLOEXEC = 0
pkg syscall (freebsd-386), const O_CREAT = 512
pkg syscall (freebsd-386), const O_DIRECT = 65536
pkg syscall (freebsd-386), const O_DIRECTORY = 131072
pkg syscall (freebsd-386), const O_EXCL = 2048
pkg syscall (freebsd-386), const O_EXEC = 262144
pkg syscall (freebsd-386), const O_EXLOCK = 32

    /** The key of the message: Token Server URL */
    public static final String LABELS_oic_token_server_url = "{labels.oic_token_server_url}";

    /** The key of the message: Redirect URL */
    public static final String LABELS_oic_redirect_url = "{labels.oic_redirect_url}";

    /** The key of the message: Scope */
    public static final String LABELS_oic_scope = "{labels.oic_scope}";

* Add OAuth2 redirect page for Swagger UI. This allows having delegated authentication in the Swagger UI docs. For this to work, you need to add `{your_origin}/docs/oauth2-redirect` to the allowed callbacks in your OAuth2 provider (in Auth0, Facebook, Google, etc).
    * For example, during development, it could be `http://localhost:8000/docs/oauth2-redirect`.

- kubeadm: Use generic terminology in logs instead of direct mentions of YAML/JSON  ([#130345](https://github.com/kubernetes/kubernetes/pull/130345), [@HirazawaUi](https://github.com/HirazawaUi))
- kubeadm: removed preflight check for `ip`, `iptables`, `ethtool` and `tc` on Linux nodes. 

- Kube-apiserver: redirect responses are no longer returned from backends by default. Set `--aggregator-reject-forwarding-redirect=false` to continue forwarding redirect responses. ([#112331](https://github.com/kubernetes/kubernetes/pull/112331), [@enj](https://github.com/enj)) [SIG API Machinery]

zero after it restarts. If the extended resource is exported by a device plugin, its capacity will change to a valid value after the device plugin re-connects with the Kubelet. If the extended resource is exported by an external component through direct node status capacity patching, the component should repatch the field after kubelet becomes ready again. During the time gap, pods previously assigned with such resources may fail kubelet admission but their controller should create new pods in response...

* Fix issue where masquerade rules are flushed in GCE k8s clusters. ([#56729](https...

- To enhance usability and developer experience, CRD validation rules now support direct use of (CEL) reserved keywords as field names in object validation expressions.

  users on the system.) ([#124152](https://github.com/kubernetes/kubernetes/pull/124152), [@danwinship](https://github.com/danwinship)) [SIG Network]