Week Ending July 19, 2026

Developer News

Maintainer Summit North America 2026 will take place on November 8 in Salt Lake City ahead of KubeCon + CloudNativeCon North America. Registration is open to Kubernetes and CNCF project maintainers, organization members, and community leaders.

Janet Kuo announced her self-nomination for the 2026 Kubernetes Steering Committee election, highlighting her long-standing contributions to Kubernetes, leadership in SIG Apps, and work on AI initiatives including Agent Sandbox and AI Conformance.

Node Feature Discovery v0.19.0 has been released. Highlights include immediate node re-labeling after node rebuilds, configurable NodeFeature owner references, new x86-64 microarchitecture labels, topology updater scalability improvements, and reconciliation performance enhancements. Contributors upgrading should review the release’s action-required notes, including the required RBAC update.

Release Schedule

Next Deadline: Code Freeze and Test Freeze, July 22nd

Kubernetes v1.37 has entered Code Freeze and Test Freeze. Enhancements targeting this release should now be merge-ready with the required approvals, passing tests, and documentation PRs opened. From this point onward, only release-blocking changes should proceed.

Patch releases v1.36.3, v1.35.7, and v1.34.10 are now available. These releases include Go updates and bug fixes.

Featured PRs

140085: Enable EtcdRangeStream feature gate by default

In this pull request, Jefftree enabled the EtcdRangeStream feature gate by default, advancing the feature to Beta as part of KEP-5966: Etcd Range Streaming. Instead of retrieving entire response sets from etcd in a single, memory-intensive operation, the kube-apiserver can now stream large LIST responses incrementally in smaller chunks. This significantly reduces peak memory usage during large list operations and watch cache initialization while improving performance. Benchmark results on 5,000-node clusters show approximately a 1.4× improvement in watch cache initialization time, making this an important scalability enhancement for large production Kubernetes clusters. See also the related implementation work in the ongoing Watch/List streaming effort, including PRs such as #139692.

139437: ClusterTrustBundles reaches General Availability

In this pull request, stlaz promoted ClusterTrustBundles and ClusterTrustBundleProjection to General Availability (GA), completing the work tracked by KEP-3257. The stable certificates.k8s.io/v1 API enables cluster administrators to distribute cluster-wide X.509 trust anchors (CA certificates) to workloads through projected volumes, providing a standardized and production-ready mechanism for managing trust bundles. This eliminates the need for custom ConfigMaps or out-of-band certificate distribution methods, simplifying certificate management while improving security and portability for workloads that depend on dynamically managed trust anchors.

KEP of the Week

KEP-5972: SIG Node: Dynamic Containers

KEP-5972, authored by Tim Allclair (@tallclair) in June 2026, proposes allowing main containers to be added to and removed from running Pods, making containers mutable after Pod creation. It is intended to support modern AI and agentic workloads, including high-performance batch jobs and low-latency AI agents, but would also change Kubernetes’ long-standing assumption that Pods are immutable execution envelopes.

If adopted, it would require updates to existing ecosystem components such as third-party controllers, service meshes, and logging tools that assume .spec.containers never changes after Pod creation. It also introduces two new Pod subresources: /dynamic for adding and removing containers in running Pods, and /allocated, which returns the allocated version of the Pod directly from the Kubelet. The KEP is currently undergoing broader design review, with discussion focused on its architectural scope and the impact such a fundamental change could have across the Kubernetes ecosystem.

As this proposal changes one of Kubernetes’ core assumptions about Pod immutability, it remains under active discussion for a future Kubernetes release. Follow the ongoing discussion in the KEP pull request or the SIG Architecture mailing list.

Other Merges

• Fixes a DRA bug where CapacityRequestPolicyRange did not support fractional quantities, aligning capacity-range behaviour with resource.Quantity semantics.
• Fixes the kube-proxy --metrics-bind-address flag documentation, which incorrectly described the default binding behaviour.
• Adds PodGroup-level scheduling metrics so operators can observe pod-group counts in scheduling queues, complementing the existing per-pod metrics.
• Introduces the Recreate update strategy for StatefulSets, giving operators a StatefulSet analog to the Deployment Recreate strategy.
• apiserver: MutatingAdmissionPolicy and MutatingAdmissionPolicyBinding (GA in 1.36) are now stored as v1, fixing autocalculation of the emulated storage version.
• The EtcdRangeStream feature gate is enabled by default (Beta); watch-cache initialization is ~1.4× faster in unit benchmarks.
• Fixes a kube-apiserver deadlock on SIGTERM when its identity Lease cannot be created (e.g. hostname longer than 63 bytes), a regression since v1.35.
• Fixes a shared resource.Quantity mutation bug in DRA counter caches that could corrupt device accounting.
• Fixes DistinctAttribute handling for DRA requests with multiple devices in the consumable-capacity path.
• Adds workload-aware preemption metrics covering the new preemption paths introduced by KEP-5710.
• PodLevelResourceManagers metrics gain a stability level and allocation is now skipped for zero-memory containers.
• Fixes an ordering bug in the API definitions test suite that let incorrect GetResetFields implementations slip through undetected.
• kubelet: pod resizes are now retried when resources are shrunk, fixing a case where the retry path was skipped.
• DRA: adds the resource.kubernetes.io/numaNode standard device attribute (KEP-6072), enabling cross-driver NUMA co-placement via matchAttribute.
• Fixes a nil pointer dereference in the storage version migrator when a target resource is not in the RESTMapper.
• Implements the core CompositePodGroup API under KEP-6012.
• Container status now accepts uint32 Linux UIDs, removing an incorrect signed-integer validator applied to unsigned UIDs.
• kubectl: improves error messages when users pass invalid values to --restart or --image-pull-policy (e.g. --restart=never instead of Never).
• Fixes a CEL reflective wrapper bug so list concatenation keeps set-list union semantics rather than mutating the LHS.
• The scheduler flushes pending PodGroup members after others have been assumed, fixing a scheduling flake in gang-scheduling flows.
• Fixes an overestimation of the pod’s resource footprint for multi-container pods undergoing a resize, aggregating desired/allocated/actuated resources per container.
• Fixes a DRA bug where the structured allocator left reserved state behind after abandoning a candidate device.
• Fixes handling of empty pod-level resources in the PodLevelResources feature.
• Uses NNN from pod group preemption for all pods in a group, rather than only the suggested pod.
• Adds validation that all pods in a pod group share a matching preemption policy under KEP-5710.
• Fixes a bug in CEL where quantity.Add would mutate the receiver.
• Implements exclusion of virtual resources from admission webhooks.
• Adds a DRA e2e test for discoverable device metadata under KEP-5304.
• Rebuilds kube-proxy with distroless-iptables v0.9.4 (nft 1.0.6.1) to fix crashes on systems with nft 1.1.3.
• Adds a PreemptionPolicy field to PodGroupTemplate under KEP-5710.
• Fixes SelectionPredicate.Empty() to be aware of sharding, correcting selector-emptiness reporting when sharding is in use.
• Fixes a DRA matchAttribute constraint bug under KEP-5491 so the intersection is properly restored on backtrack when DRAListTypeAttributes is enabled.

Subprojects and Dependency Updates

• cluster-api v1.14.0-beta.0: beta release, 24 new features, 20 bug fixes, 4 breaking changes

Shoutouts

• bentheelder: Shoutout to Mario Fahlandt(@mfahlandt) for building awesome public visibility on #sig-k8s-infra spend for the Kubernetes project. Check it out: mfahlandt.github.io/k8s-cost

Last Week In Kubernetes Development (LWKD) is a product of multiple contributors participating in Kubernetes SIG Contributor Experience. All original content is licensed Creative Commons Share-Alike, although linked content and images may be differently licensed. LWKD does collect some information on readers, see our privacy notice for details.

You may contribute to LWKD by submitting pull requests or issues on the LWKD github repo.