Week Ending September 6, 2026

Developer News

SIG Architecture has completed a review of feature gates on master (v1.38 development) against the feature gates documentation. The review identified overdue feature gates, gates due for removal in v1.38, GA/deprecated gates that are not locked to their default, and several stale alpha/beta gates across SIG Node, API Machinery, Auth, Scheduling, Network, Windows, Storage, Instrumentation, Apps, and Cloud Provider.

SIG UI has nominated Kahiro Okina (@kahirokunn) as a new SIG UI Lead, following a recommendation from current SIG UI Chairs. Kahiro has been a contributor and reviewer to Headlamp, contributing to its multi-cluster UI, plugin ecosystem, mentoring, and community growth. The nomination is now in a one-week lazy consensus period.

Election Update

The Steering Committee election voting will remain open through October 1, with exception requests due by September 29. If you are marked as not eligible despite your contributions, please request an exception.

Release Schedule

Next Deadline: KEP Readiness Deadline, September 22, 2026 (AoE) / September 23, 2026 at 12:00 UTC

The Kubernetes v1.38 release cycle began on August 31, with the final release targeted for December 16, 2026. The KEP Readiness Deadline is scheduled for September 22, 2026 (AoE) / September 23, 2026 at 12:00 UTC. Enhancements are expected to complete their Production Readiness Review by this deadline; enhancements that miss it require an exception. The Enhancements Freeze is scheduled for September 29 (AoE) / September 30 at 12:00 UTC. If you’d like to include your KEP in the v1.38 release cycle, please reach out to your SIG leads to get your KEP tracked for the release. Find more information in the Call for Enhancements announcement.

Featured PRs

141959: Conditional Authz [4/n]: Add conditional authz support to kube-apiserver

luxas advanced KEP-5681: Conditional Authorization by adding conditional authorization support to the kube-apiserver. Conditional authorization lets an authorizer return requirements that depend on request-object content, which the API server can evaluate later during admission instead of making a decision solely from request metadata. This PR is the fourth part of the implementation series and builds on earlier core machinery, enabling more context-aware authorization policies for Kubernetes APIs.

141878: scheduler, api: implement alpha allowDisruptionByPriorityGreaterThanOrEqual (KEP-3280)

NAVEENKUMARRK777 implemented the alpha allowDisruptionByPriorityGreaterThanOrEqual capability described in KEP-3280. The change adds API and scheduler support for controlling which lower-priority workloads may be disrupted, based on a priority threshold. This gives workload authors and cluster operators more precise control over disruption behavior for priority-sensitive applications.

141860: Implement recursive statuses for Composite Pod Groups

jdizkowski implemented recursive status handling for CompositePodGroups, part of the CompositePodGroup API proposal (KEP-6012). CompositePodGroups are intended to represent hierarchical, heterogeneous workloads whose components may have different scheduling requirements. This PR propagates status through the hierarchy, allowing users and controllers to observe the aggregate state of complex workload groups instead of inspecting each child PodGroup separately.

KEP of the Week

KEP-6058: CSI global mount fallback for volume reconstruction

This enhancement extends KEP-3756 to recover CSI volumes after a kubelet restart when pod-local vol_data.json metadata is missing or corrupt. Without the fallback, a global mount can remain active after its Pod directory disappears, causing the volume to leave node.status.volumesInUse and potentially allowing a ReadWriteOnce filesystem to be attached to another node. The proposal lets kubelet reconstruct the volume from metadata stored beside the global mount, then verify or unstage it through the normal volume-manager flow.

The work builds on a long-standing reconstruction problem tracked in kubernetes/kubernetes#101791 and the manual-cleanup procedure documented by KEP-3756. cniackz, with SIG Storage and SIG Node contributors including jsafrane and gnufied, is implementing the fallback in kubernetes/kubernetes#138454. The KEP is implementable, and its KEP and implementation updates are currently under review.

KEP 6058 is targeting Alpha in Kubernetes v1.38.

The change is opt-in behind a new alpha feature gate and affects kubelet CSI reconstruction and unmounting. It is intended to prevent leaked global mounts and reduce the risk of double-mounting and data corruption on storage systems such as Fibre Channel, iSCSI, and EBS.

Other Merges

kubectl: documentation for the --restart flag values on kubectl run has been improved.
Adds a +k8s:immutable tag to validation-gen so declarative validation can express immutable field semantics.
kube-scheduler adds a PostBind extension point under KEP-6021 for plugins that run after a Pod has been bound to a Node.
The cluster-autoscaler now integrates with the Cluster API directly for machine-lifecycle operations rather than via a shim.
kubectl: adds --warnings-as-errors support to kubectl apply and kubectl apply --dry-run=server, so CI pipelines can fail on server-side warning conditions.
kubelet: fixes swap accounting for pods with cgroups v2 memory.swap.max so allocated swap is now correctly reflected in Pod status.
kube-controller-manager adds a new _total counter for controller reconciliation errors.
kubelet: PodSandboxConfig.resource_claims is now propagated to the runtime for DRA-enabled pods.
validation-gen: eliminates zero-value comparison in +k8s:required codegen so pointer-typed required fields don’t incorrectly reject zero values.
kube-proxy nftables: fixes cross-namespace hairpin traffic for NodePort services.
DRA: the scheduler filter now checks device tainted state under KEP-5055 (DRA Device Taints and Tolerations), rejecting pods that don’t tolerate the taint.
Adds DRA Extended Resource support to scheduler_perf so DRA benchmarks can measure Extended Resource pathways.
validation-gen: fixes ProtocolIsProto codegen for the slice-to-pointer path.
apiserver: structured logging trace context is now propagated through request paths.
DRA: introduces a prioritized-list ordering algorithm for PrioritizedList requests.
scheduler: attaches a SchedulingResult to Pod events so future scheduling events can reference the prior decision.
kubelet DRA: fixes a bug where shared claims were dropped across kubelet restarts.
Fixes an apiserver watch cache metric bug where events_dispatched_total was incremented for undispatched bookmarks.
Renames endpoint_slice_controller_changes to endpoint_slice_controller_changes_total to add the conventional _total suffix; the old name is retained temporarily for backward compatibility.
Clarifies that the /flagz endpoint reflects flag layer, not effective config.

Promotions

DRA discoverable device metadata to Beta under KEP-5304.
ImageVolume to GA.

Version Updates

Subprojects and Dependency Updates

containerd v2.3.5: fix CVE-2026-53495, avoid hangs and data races when streaming container I/O in CRI, fix EROFS unpack failure; also v2.2.8, v2.0.12, v1.7.35
cri-o v1.36.5: deduplicate concurrent image volume MountImage calls, fix cpuset leak from init containers in high performance hooks; also v1.35.8, v1.34.13
cluster-api v1.14.1: fix CRD migrator cache usage, fix ParseSecretName round-trip for hyphenated purposes, bump Go to 1.26.6

Shoutouts

No shoutouts this week. Want to thank someone for special efforts to improve Kubernetes? Tag them in the #shoutouts channel.

Last Week In Kubernetes Development (LWKD) is a product of multiple contributors participating in Kubernetes SIG Contributor Experience. All original content is licensed Creative Commons Share-Alike, although linked content and images may be differently licensed. LWKD does collect some information on readers, see our privacy notice for details.

You may contribute to LWKD by submitting pull requests or issues on the LWKD github repo.