- Windows nodes on GCE can use TPM-based authentication to the master. (#85466, @pjh) [SIG Cluster Lifecycle]
- kubectl/drain: add disable-eviction option. Force drain to use delete, even if eviction is supported. This will bypass checking PodDisruptionBudgets, and should be used with caution. (#85571, @michaelgugino) [SIG CLI]
- kubelet now exports a "server_expiration_renew_failure" and "client_expiration_renew_failure" metric counter if the certificate rotations cannot be performed. (#84614, @rphillips) [SIG API Machinery, SIG Auth, SIG CLI, SIG Cloud Provider, SIG Cluster Lifecycle, SIG Instrumentation, SIG Node, and SIG Release]
- kubeadm: add a upgrade health check that deploys a Job ([#81319](https://github.com/kubernetes/kuberne