Release Notes draft for k/k v1.31.0-rc.0

Signed-off-by: Sepideh <sepi.alavii@gmail.com>

Update releases/release-1.31/release-notes/maps/pr-120611-map.yaml

Co-authored-by: Nina Polshakova <nina.polshakova@solo.io>

Update releases/release-1.31/release-notes/maps/pr-124958-map.yaml

Co-authored-by: Nina Polshakova <nina.polshakova@solo.io>

Update releases/release-1.31/release-notes/maps/pr-125488-map.yaml

Co-authored-by: Nina Polshakova <nina.polshakova@solo.io>

Update releases/release-1.31/release-notes/release-notes-draft.md

Co-authored-by: Nina Polshakova <nina.polshakova@solo.io>

Update releases/release-1.31/release-notes/release-notes-draft.md

Co-authored-by: Nina Polshakova <nina.polshakova@solo.io>

Update releases/release-1.31/release-notes/release-notes-draft.md

Co-authored-by: Nina Polshakova <nina.polshakova@solo.io>

Update releases/release-1.31/release-notes/release-notes-draft.md

Co-authored-by: Nina Polshakova <nina.polshakova@solo.io>

Update releases/release-1.31/release-notes/release-notes-draft.md

Co-authored-by: Nina Polshakova <nina.polshakova@solo.io>

Update releases/release-1.31/release-notes/release-notes-draft.md

Co-authored-by: Nina Polshakova <nina.polshakova@solo.io>

Update releases/release-1.31/release-notes/release-notes-draft.md

Co-authored-by: Nina Polshakova <nina.polshakova@solo.io>

Update releases/release-1.31/release-notes/release-notes-draft.md

Co-authored-by: Nina Polshakova <nina.polshakova@solo.io>

Update releases/release-1.31/release-notes/release-notes-draft.md

Co-authored-by: Nina Polshakova <nina.polshakova@solo.io>

Update releases/release-1.31/release-notes/release-notes-draft.md

Co-authored-by: Nina Polshakova <nina.polshakova@solo.io>

Update releases/release-1.31/release-notes/release-notes-draft.md

Co-authored-by: Nina Polshakova <nina.polshakova@solo.io>

Update releases/release-1.31/release-notes/release-notes-draft.md

Co-authored-by: Nina Polshakova <nina.polshakova@solo.io>

Update releases/release-1.31/release-notes/release-notes-draft.md

Co-authored-by: Nina Polshakova <nina.polshakova@solo.io>

Apply suggestions from code review

Co-authored-by: Nina Polshakova <nina.polshakova@solo.io>

Apply suggestions from code review

Co-authored-by: Nina Polshakova <nina.polshakova@solo.io>

Update releases/release-1.31/release-notes/release-notes-draft.json

Co-authored-by: Nina Polshakova <nina.polshakova@solo.io>

Update releases/release-1.31/release-notes/release-notes-draft.md

Co-authored-by: Nina Polshakova <nina.polshakova@solo.io>

Update releases/release-1.31/release-notes/maps/pr-126237-map.yaml

Co-authored-by: Nina Polshakova <nina.polshakova@solo.io>

Apply suggestions from code review

Apply suggestions from code review

Co-authored-by: Tim Bannister <tim@scalefactory.com>
Co-authored-by: Amit Dsouza <amit@odysseycloud.io>

Apply suggestions from code review

Co-authored-by: Tim Bannister <tim@scalefactory.com>

Apply suggestions from code review

Co-authored-by: Mélony QIN <4621560+cloudmelon@users.noreply.github.com>
Co-authored-by: Tim Bannister <tim@scalefactory.com>

Apply suggestions from code review

Co-authored-by: bells17 <bells171@gmail.com>

Update releases/release-1.31/release-notes/maps/pr-125488-map.yaml

Update releases/release-1.31/release-notes/maps/pr-126205-map.yaml

releases/release-1.31/release-notes/maps/pr-120611-map.yaml

@@ -0,0 +1,6 @@
+pr: 120611
+releasenote:
+  text: 'Dynamic Resource Allocation (DRA): Added a feature so the number of ResourceClaim objects can be limited
+    per namespace and by the number of devices requested through a specific class
+    via the v1.ResourceQuota mechanism.'
+pr_body: ""

releases/release-1.31/release-notes/maps/pr-122628-map.yaml

@@ -0,0 +1,5 @@
+pr: 122628
+releasenote:
+  text: Implemented new cluster events UpdatePodScaleDown and UpdatePodLabel for scheduler
+    plugins.
+pr_body: ""

releases/release-1.31/release-notes/maps/pr-124012-map.yaml

@@ -0,0 +1,7 @@
+pr: 124012
+releasenote:
+  text: Added Coordinated Leader Election as Alpha under the `CoordinatedLeaderElection`
+    feature gate. With the feature enabled, the control plane can use LeaseCandidate
+    objects (coordination.k8s.io/v1alpha1 API group) to participate in a leader election
+    and let the kube-apiserver select the best instance according to some strategy.
+pr_body: ""

releases/release-1.31/release-notes/maps/pr-124101-map.yaml

@@ -0,0 +1,5 @@
+pr: 124101
+releasenote:
+  text: Fixed a bug where the Kubelet miscalculated the process usage of pods,
+    causing pods to never get evicted for PID usage.
+pr_body: ""

releases/release-1.31/release-notes/maps/pr-124430-map.yaml

@@ -0,0 +1,5 @@
+pr: 124430
+releasenote:
+  text: Fixed node reporting "notReady" with the reason 'container runtime status check may
+    not have completed yet' after kubelet restart.
+pr_body: ""

releases/release-1.31/release-notes/maps/pr-124530-map.yaml

@@ -0,0 +1,6 @@
+pr: 124530
+releasenote:
+  text: Finished initial generic controlplane refactor of kube-apiserver, providing
+    a sample binary building a Kubernetes-like control plane, but without container orchestration
+    resources.
+pr_body: ""

releases/release-1.31/release-notes/maps/pr-124819-map.yaml

@@ -0,0 +1,5 @@
+pr: 124819
+releasenote:
+  text: Added a warning when creating or updating a PersistentVolume (PV) with the
+    deprecated annotation `volume.beta.kubernetes.io/mount-options`.
+pr_body: ""

releases/release-1.31/release-notes/maps/pr-124884-map.yaml

@@ -0,0 +1,5 @@
+pr: 124884
+releasenote:
+  text: Added a feature to report an event about a Pod if kubelet observes a failed attach
+    operation, even if the kubelet is running with `--enable-controller-attach-detach=false`.
+pr_body: ""

releases/release-1.31/release-notes/maps/pr-124958-map.yaml

@@ -0,0 +1,6 @@
+pr: 124958
+releasenote:
+  text: |-
+    The kube-scheduler added support for scheduling hints for the StorageClass resource within the VolumeBinding plugin.
+    The scheduling hints allowed the scheduler to retry scheduling a Pod that was previously rejected by the VolumeBinding plugin only if a new resource referenced by the plugin was created or an existing resource referenced by the plugin was updated.
+pr_body: ""

releases/release-1.31/release-notes/maps/pr-124959-map.yaml

@@ -0,0 +1,6 @@
+pr: 124959
+releasenote:
+  text: |-
+    The kube-scheduler added support for scheduling hints for the PersistentVolumeClaim resource within the VolumeBinding plugin.
+    The scheduling hints allowed the scheduler to retry scheduling a Pod that was previously rejected by the VolumeBinding plugin only if a new resource referenced by the plugin was created or an existing resource referenced by the plugin was updated.
+pr_body: ""

releases/release-1.31/release-notes/maps/pr-124961-map.yaml

@@ -0,0 +1,6 @@
+pr: 124961
+releasenote:
+  text: |-
+    The kube-scheduler added support for scheduling hints for the CSIStorageCapacity resource within the VolumeBinding plugin.
+    The scheduling hints allowed the scheduler to retry scheduling a Pod that was previously rejected by the VolumeBinding plugin only if a new resource referenced by the plugin was created or an existing resource referenced by the plugin was updated.
+pr_body: ""

releases/release-1.31/release-notes/maps/pr-125163-map.yaml

@@ -0,0 +1,6 @@
+pr: 125163
+releasenote:
+  text: 'ACTION REQUIRED: The Dynamic Resource Allocation (DRA) driver's DaemonSet must be deployed
+    with a service account that enables writing ResourceSlice and reading ResourceClaim
+    objects.'
+pr_body: ""

releases/release-1.31/release-notes/maps/pr-125257-map.yaml

@@ -0,0 +1,5 @@
+pr: 125257
+releasenote:
+  text: Graduated Kubernetes' support for AppArmor to GA. You now cannot disable the `AppArmor`
+    feature gate.
+pr_body: ""

releases/release-1.31/release-notes/maps/pr-125259-map.yaml

@@ -0,0 +1,4 @@
+pr: 125259
+releasenote:
+  text: Promoted the `ProcMountType` feature gate to beta.
+pr_body: ""

releases/release-1.31/release-notes/maps/pr-125374-map.yaml

@@ -0,0 +1,6 @@
+pr: 125374
+releasenote:
+  text: Promoted `StatefulSetStartOrdinal` to stable. This means `--feature-gates=StatefulSetStartOrdinal=true`
+    are not needed on kube-apiserver and kube-controller-manager binaries and they'll
+    be removed soon following policy at https://kubernetes.io/docs/reference/using-api/deprecation-policy/#deprecation.
+pr_body: ""

releases/release-1.31/release-notes/maps/pr-125470-map.yaml

@@ -0,0 +1,5 @@
+pr: 125470
+releasenote:
+  text: Added a `.status.features.supplementalGroupsPolicy` field to Nodes. The field is
+    true when the feature is implemented in the CRI implementation (KEP-3619).
+pr_body: ""

releases/release-1.31/release-notes/maps/pr-125488-map.yaml

@@ -0,0 +1,4 @@
+pr: 125488
+releasenote:
+  text: 'Enhanced the Dynamic Resource Allocation (DRA) with an updated version of the resource.k8s.io API group. The primary user-facing type remains the ResourceClaim, however significant changes have been made, resulting in the new version, v1alpha3, which is not compatible with the previous version.'
+pr_body: ""

releases/release-1.31/release-notes/maps/pr-125571-map.yaml

@@ -0,0 +1,7 @@
+pr: 125571
+releasenote:
+  text: |-
+    kube-apiserver: Added Alpha features to allow API server authz to check the context of requests:
+    - The `AuthorizeWithSelectors` feature gate enables including field and label selector information from requests in webhook authorization calls.
+    - The `AuthorizeNodeWithSelectors` feature gate changes node authorizer behavior to limit requests from node API clients, so that each Node can only get / list / watch its own Node API object, and can also only get / list / watch Pod API objects bound to that node. Clients using kubelet credentials to read other nodes or unrelated pods must change their authentication credentials (recommended), adjust their usage, or obtain broader read access independent of the node authorizer.
+pr_body: ""

releases/release-1.31/release-notes/maps/pr-125656-map.yaml

@@ -0,0 +1,5 @@
+pr: 125656
+releasenote:
+  text: 'kubelet/stats: set INFO log level for stats not found in cadvisor memory
+    cache error.'
+pr_body: ""

releases/release-1.31/release-notes/maps/pr-125660-map.yaml

@@ -0,0 +1,5 @@
+pr: 125660
+releasenote:
+  text: Revised the Pod API with Alpha support for volumes derived from OCI artifacts.
+    This feature is behind the `ImageVolume` feature gate.
+pr_body: ""

releases/release-1.31/release-notes/maps/pr-125661-map.yaml

@@ -0,0 +1,4 @@
+pr: 125661
+releasenote:
+  text: Cleaned deprecated `context.StopCh` in favor of ctx.
+pr_body: ""

releases/release-1.31/release-notes/maps/pr-125782-map.yaml

@@ -0,0 +1,6 @@
+pr: 125782
+releasenote:
+  text: |-
+    Fixed the documentation for the default value of the `procMount` entry in `securityContext` within a Pod.
+    The documentation was previously using the name of the internal variable `DefaultProcMount`, rather than the actual value, "Default".
+pr_body: ""

releases/release-1.31/release-notes/maps/pr-125813-map.yaml

@@ -0,0 +1,8 @@
+pr: 125813
+releasenote:
+  text: Enforced kubelet to request serving certificates only once it has at least
+    one IP address in the `.status.addresses` of its associated Node object. This
+    avoids requesting DNS-only serving certificates before externally set addresses
+    are in place. Until 1.33, the previous behavior can be opted back into by setting
+    the deprecated `AllowDNSOnlyNodeCSR` feature gate to true in the kubelet.
+pr_body: ""

releases/release-1.31/release-notes/maps/pr-125929-map.yaml

@@ -0,0 +1,5 @@
+pr: 125929
+releasenote:
+  text: Implemented `event_handling_duration_seconds` metric, which is the time the
+    scheduler takes to handle each kind of events.
+pr_body: ""

releases/release-1.31/release-notes/maps/pr-126014-map.yaml

@@ -0,0 +1,6 @@
+pr: 126014
+releasenote:
+  text: Promoted `LocalStorageCapacityIsolation` to beta; the behaviour is enabled by default.
+        Within the kubelet, storage capacity isolation is active if the feature gate
+        is enabled and the specific Pod is using a user namespace.
+pr_body: ""

releases/release-1.31/release-notes/maps/pr-126031-map.yaml

@@ -0,0 +1,4 @@
+pr: 126031
+releasenote:
+  text: Introduced a new boolean kubelet flag `--fail-cgroupv1`.
+pr_body: ""

releases/release-1.31/release-notes/maps/pr-126047-map.yaml

@@ -0,0 +1,4 @@
+pr: 126047
+releasenote:
+  text: Updated kubernetes to build with Go 1.23rc2.
+pr_body: ""

releases/release-1.31/release-notes/maps/pr-126067-map.yaml

@@ -0,0 +1,9 @@
+pr: 126067
+releasenote:
+  text: |-
+    Graduated the Job `successPolicy` field to beta.
+
+    The new reason label, "SuccessPolicy" and "CompletionsReached" are added to the "jobs_finished_total" metric.
+    Additionally, if you enable the `JobSuccessPolicy` feature gate, the Job gets "CompletionsReached" reason for the "SuccessCriteriaMet" and "Complete" condition type
+    when the number of succeeded Job Pods (`.status.succeeded`) reached the desired completions (`.spec.completions`).
+pr_body: ""

releases/release-1.31/release-notes/maps/pr-126072-map.yaml

@@ -0,0 +1,5 @@
+pr: 126072
+releasenote:
+  text: Made kube-proxy Windows service control manager integration (`--windows-service`)
+    configurable in v1alpha1 component configuration via `windowsRunAsService` field.
+pr_body: ""

releases/release-1.31/release-notes/maps/pr-126073-map.yaml

@@ -0,0 +1,4 @@
+pr: 126073
+releasenote:
+  text: Fixed fake clientset ApplyScale subresource from `status` to `scale`.
+pr_body: ""

releases/release-1.31/release-notes/maps/pr-126108-map.yaml

@@ -0,0 +1,10 @@
+pr: 126108
+releasenote:
+  text: |-
+    Reduced state change noise when volume expansion fails. Also mark certain failures as infeasible.
+
+ ACTION REQUIRED:  If you are using the `RecoverVolumeExpansionFailure` alpha feature gate
+ then after upgrading to this release, you need to update some objects.
+ For any existing PersistentVolumeClaimss with `status.allocatedResourceStatus` set to either
+ "ControllerResizeFailed" or "NodeResizeFailed", clear the `status.allocatedResourceStatus`.
+pr_body: ""

releases/release-1.31/release-notes/maps/pr-126125-map.yaml

@@ -0,0 +1,4 @@
+pr: 126125
+releasenote:
+  text: Allowed calling Stop multiple times on RetryWatcher without panicking.
+pr_body: ""

releases/release-1.31/release-notes/maps/pr-126139-map.yaml

@@ -0,0 +1,4 @@
+pr: 126139
+releasenote:
+  text: Reverted a [change](https://github.com/kubernetes/kubernetes/pull/123513) where `ConsistentListFromCache` was moved to beta and enabled by default.
+pr_body: ""

releases/release-1.31/release-notes/maps/pr-126145-map.yaml

@@ -0,0 +1,6 @@
+pr: 126145
+releasenote:
+  text: |-
+    Promoted feature-gate `VolumeAttributesClass` to beta (disabled by default). Users need to enable the feature gate and the `storage.k8s.io/v1beta1` API group to use this feature.
+    Promoted the VolumeAttributesClass API to beta.
+pr_body: ""

releases/release-1.31/release-notes/maps/pr-126163-map.yaml

@@ -0,0 +1,6 @@
+pr: 126163
+releasenote:
+  text: 'kube-apiserver: when the Alpha `UserNamespacesPodSecurityStandards` feature
+    gate is enabled, Pod Security Admission enforcement of the baseline policy now
+    allows `procMount: Unmasked` for user namespace pods that set `hostUsers: false`.'
+pr_body: ""

releases/release-1.31/release-notes/maps/pr-126165-map.yaml

@@ -0,0 +1,5 @@
+pr: 126165
+releasenote:
+  text: Starting in 1.31, `container_engine_t` was added to the list of allowed SELinux
+    types in the baseline Pod Security Standard.
+pr_body: ""

releases/release-1.31/release-notes/maps/pr-126167-map.yaml

@@ -0,0 +1,5 @@
+pr: 126167
+releasenote:
+  text: 'kube-apiserver: fixed a potential crash serving CustomResourceDefinitions
+    that combine an invalid schema and CEL validation rules.'
+pr_body: ""

releases/release-1.31/release-notes/maps/pr-126174-map.yaml

@@ -0,0 +1,4 @@
+pr: 126174
+releasenote:
+  text: 'mount-utils: treated syscall.ENODEV as corrupted mount.'
+pr_body: ""

releases/release-1.31/release-notes/maps/pr-126191-map.yaml

@@ -0,0 +1,5 @@
+pr: 126191
+releasenote:
+  text: Reverted "Graduates the `WatchList` feature gate to beta for kube-apiserver
+    and enables `WatchListClient` for kube-controller-manager (KCM)".
+pr_body: ""

releases/release-1.31/release-notes/maps/pr-126205-map.yaml

@@ -0,0 +1,5 @@
+pr: 126205
+releasenote:
+  text: The `KubeletSeparateDiskGC` feature gate is now beta. This split image filesystem feature enables kubelet to perform garbage collection of images (read-only layers) and/or containers (writeable layers) deployed on separate filesystems.
+        gate is now beta.
+pr_body: ""

releases/release-1.31/release-notes/maps/pr-126227-map.yaml

@@ -0,0 +1,5 @@
+pr: 126227
+releasenote:
+  text: Implemented `queueing_hint_execution_duration_seconds` metric, which is the
+    time the QueueingHint function takes.
+pr_body: ""

releases/release-1.31/release-notes/maps/pr-126237-map.yaml

@@ -0,0 +1,4 @@
+pr: 126237
+releasenote:
+  text: Promoted the metrics for both ValidatingAdmissionPolicy (VAP) and CustomResourceDefinition (CRD) validation rules to beta.
+pr_body: ""

releases/release-1.31/release-notes/maps/pr-126243-map.yaml

@@ -0,0 +1,5 @@
+pr: 126243
+releasenote:
+  text: Added an `allocatedResourcesStatus` to each container status to indicate the
+    health status of devices exposed by the device plugin.
+pr_body: ""

releases/release-1.31/release-notes/maps/pr-126330-map.yaml

@@ -0,0 +1,4 @@
+pr: 126330
+releasenote:
+  text: Updated kubernetes to build with Go 1.22.5.
+pr_body: ""

releases/release-1.31/release-notes/maps/pr-126335-map.yaml

@@ -0,0 +1,5 @@
+pr: 126335
+releasenote:
+  text: Fixed bug in kubelet if the `SplitImageFilesystem` feature gate is turned on but the container runtime is
+    not configured.
+pr_body: ""

releases/release-1.31/release-notes/maps/pr-126355-map.yaml

@@ -0,0 +1,5 @@
+pr: 126355
+releasenote:
+  text: Set `LocalStorageCapacityIsolationFSQuotaMonitoring` to false by default, to
+    match `UserNamespacesSupport` (which the feature relies on).
+pr_body: ""

releases/release-1.31/release-notes/maps/pr-126441-map.yaml

@@ -0,0 +1,9 @@
+pr: 126441
+releasenote:
+  text: Ensured that the Node Admission plugin to reject CSR requests created by a
+    node identity for the signers `kubernetes.io/kubelet-serving` or `kubernetes.io/kube-apiserver-client-kubelet`
+    with a CN starting with `system:node:`, but where the CN is not `system:node:${node-name}`.
+    The feature gate `AllowInsecureKubeletCertificateSigningRequests` defaults to
+    `false`, but can be enabled to revert to the previous behavior. This feature gate
+    will be removed in Kubernetes v1.33.
+pr_body: ""