- Make kubectl diff --prune behave correctly with the --selector/-l flag ([#116149](https://github.com/kubernetes/kubernetes/pull/116149), [@nathanmartins](https://github.com/nathanmartins)) [SIG CLI and Testing]

- Fixes hostpath storage e2e tests within SELinux enabled env (#105788, @Elbehery) [SIG Testing]

### Bug or Regression

- EndpointSlice Mirroring controller now cleans up managed EndpointSlices when a Service selector is added (#106136, @robscott) [SIG Apps, Network and Testing]
- Fix concurrent map access causing panics when logging timed-out API calls. (#106124, @marseel) [SIG API Machinery]

### Documentation

- Added an example of set-based requirements for the  `-l` / `--selector` command line option to `kubectl`. ([#129106](https://github.com/kubernetes/kubernetes/pull/129106), [@rotsix](https://github.com/rotsix))

			t.Fatalf("NewReader panicked: %s", r)
		}
	}()
	// Previously, this would trigger a panic as we attempt to read from
	// an io.SectionReader which would access a slice at a negative offset
	// as the section reader offset & size were < 0.
	NewReader(bytes.NewReader(data), int64(len(data))+1875)
}

func BenchmarkReaderOneDeepDir(b *testing.B) {
	var buf bytes.Buffer
	zw := NewWriter(&buf)

  * Enhancement

    * `kubectl auth can-i` now supports non-resource URLs ([#46432](https://github.com/kubernetes/kubernetes/pull/46432), [@CaoShuFeng](https://github.com/CaoShuFeng))

pkg debug/pe, method (*File) Section(string) *Section
pkg debug/pe, method (*FormatError) Error() string
pkg debug/pe, method (*Section) Data() ([]uint8, error)
pkg debug/pe, method (*Section) Open() io.ReadSeeker
pkg debug/pe, method (Section) ReadAt([]uint8, int64) (int, error)
pkg debug/pe, type File struct
pkg debug/pe, type File struct, Sections []*Section
pkg debug/pe, type File struct, embedded FileHeader

- JWT authenticators specified via the `AuthenticationConfiguration.jwt` array can now optionally specify either the `controlplane` or `cluster` egress selector by setting the `issuer.egressSelectorType` field.  When unset, the prior behavior of using no egress selector is retained.  The StructuredAuthenticationConfigurationEgressSelector beta feature (default on) must be enabled to use this functionality. ([#132768](https://github.com/kubernetes/kubernetes/pull/132768),...

dnsalias.com
dnsalias.net
dnsalias.org
dnsdojo.com
dnsdojo.net
dnsdojo.org
dnsfor.me
dnshome.de
dnsiskinky.com
dnsking.ch
dnsup.net
dnsupdate.info
dnsupdater.de
do
docs
doctor
does-it.net
doesntexist.com
doesntexist.org
dog
dojin.com
domains
donetsk.ua
dongnai.vn
dongthap.vn
donna.no
dontexist.com
dontexist.net
dontexist.org

    * setting `KUBE_PROXY_DAEMONSET=true` in kube-up will now set a `node.kubernetes.io/kube-proxy-ds-ready=true` label on new nodes. In v1.16, the kube-proxy daemonset add-on will switch to using that label as a node selector.
    * In 1.16, the masq-agent daemonset add-on will switch to using `node.kubernetes.io/masq-agent-ds-ready` as a node selector.

* IngressTLS: allow secretName to be blank for SNI routing ([#23500](https://github.com/kubernetes/kubernetes/pull/23500), [@tam7t](https://github.com/tam7t))
* don't sync deployment when pod selector is empty ([#23467](https://github.com/kubernetes/kubernetes/pull/23467), [@mikedanese](https://github.com/mikedanese))