- Privilege escalation has been disabled for all containers. ([#82347](https://github.com/kubernetes/kubernetes/pull/82347), [@pjbgf](https://github.com/pjbgf))
- Kubernetes no longer monitors firewalld. On systems using firewalld for firewall
  maintenance, kube-proxy will take slightly longer to recover from disruptive
  firewalld operations that delete kube-proxy's iptables rules.

* Fixes issue for readOnly subpath mounts for SELinux systems and when the volume mountPath already existed in the container image. ([#64351](https://github.com/kubernetes/kubernetes/pull/64351), [@msau42](https://github.com/msau42))

kiyokawa.kanagawa.jp
kiyosato.hokkaido.jp
kiyose.tokyo.jp
kiyosu.aichi.jp
kizu.kyoto.jp
klabu.no
klepp.no
klodzko.pl
klæbu.no
km
km.ua
kmpsp.gov.pl
kn
knightpoint.systems
knowsitall.info
knx-server.net
kobayashi.miyazaki.jp
kobierzyce.pl
kochi.jp
kochi.kochi.jp
kodaira.tokyo.jp
koeln
kofu.yamanashi.jp
koga.fukuoka.jp
koga.ibaraki.jp

In addition, the NodeRestriction admission plugin now prevents kubelets from modifying taints on their Node API objects, making it easier to keep track of which nodes should be in use.

### SIG CLI

     *
     * For Win95/98/Me this is actually the last write time. It is currently
     * not possible to retrieve the create time from files on these systems.
     *
     * @return The number of milliseconds since the 00:00:00 GMT, January 1,
     *         1970 as a <code>long</code> value
     * @throws SmbException if an error occurs while retrieving the creation time

### SIG Windows

- Kubelet no longer attempts to sync iptables on non-Linux systems.. ([#67690](https://github.com/kubernetes/kubernetes/pull/67690), [@feiskyer](https://github.com/feiskyer))
- Kubelet no longer applies default hard evictions of nodefs.inodesFree on non-Linux systems. ([#67709](https://github.com/kubernetes/kubernetes/pull/67709), [@feiskyer](https://github.com/feiskyer))

kiyokawa.kanagawa.jp
kiyosato.hokkaido.jp
kiyose.tokyo.jp
kiyosu.aichi.jp
kizu.kyoto.jp
klabu.no
klepp.no
klodzko.pl
klæbu.no
km
km.ua
kmpsp.gov.pl
kn
knightpoint.systems
knowsitall.info
knx-server.net
kobayashi.miyazaki.jp
kobierzyce.pl
kochi.jp
kochi.kochi.jp
kodaira.tokyo.jp
koeln
kofu.yamanashi.jp
koga.fukuoka.jp
koga.ibaraki.jp

## Known Issues

- The etcd and KMS plugin health checks are not exposed in the new `livez` and `readyz` endpoints. This will be fixed in 1.16.1.

## Changelog since v1.10.3

### Other notable changes

* Fixes issue for readOnly subpath mounts for SELinux systems and when the volume mountPath already existed in the container image. ([#64351](https://github.com/kubernetes/kubernetes/pull/64351), [@msau42](https://github.com/msau42))

### CSI Volume health monitoring
 
The alpha version of CSI health monitoring is being released with Kubernetes 1.19. This feature enables CSI Drivers to share abnormal volume conditions from the underlying storage systems with Kubernetes so that they can be reported as events on PVCs or Pods. This feature serves as a stepping stone towards programmatic detection and resolution of individual volume health issues by Kubernetes.