KEP #5343 (Make nftables the default kube-proxy backend)

Kubernetes 1.37: the hardening you did not ask for is the part you have to test

Sysdig counts 19 security-relevant changes in the release. The ones that arrive switched on, led by SELinuxMount at stable, are the ones that can break a running cluster.