LWKD logo

Last Week in Kubernetes Development

Stay up-to-date on Kubernetes development in 15 minutes a week.

Subscribe
Mastodon
BlueSky
RSS

View LWKD on GitHub

Week Ending September 13, 2026

Developer News

Dims has proposed building kubelet as a static binary (CGO_ENABLED=0) to remove the last remaining CGO dependency in Kubernetes binaries; discussion has surfaced concerns about DNS resolution changes, glibc/NSS behavior differences, and userns account lookup.

Kahiro Okina (@kahirokunn) has been appointed as a SIG UI Lead following a lazy consensus period; Kahiro has been contributing to Headlamp on multi-cluster UI, plugin ecosystem work, and mentoring.

SIG Node has added security-profiles-merger as a subproject.

SIG Instrumentation have added kubernetes-mixin as a subproject.

The AI Conformance program now supports hybrid verification starting with v1.37, letting vendors submit automated test results alongside documentation evidence; Kubernetes releases prior to v1.34 can no longer be certified.

Agent Sandbox v1.0 has been released, consolidating on v1beta1 APIs, adding a Go sandbox-router for browser-based interactive sessions, and adding a TypeScript SDK alongside existing Go and Python SDKs.

Election Update

The Steering Committee election voting will remain open through October 1, with exception requests due by September 29. If you are marked as not eligible despite your contributions, please request an exception.

Release Schedule

Next Deadline: KEP Readiness Deadline, September 22, 2026 (AoE) / September 23, 2026 at 12:00 UTC

The Kubernetes v1.38 release cycle is underway. The schedule has been finalized and you can find the full timeline here. Enhancements targeted for this cycle are expected to be opted in for the release by the KEP Readiness Deadline. Enhancements that miss it would require an exception. KEP authors should have their PRs to the kubernetes/enhancements repo opened by the KEP Readiness Deadline on September 22nd. The Enhancements Freeze is scheduled for September 29 (AoE) / September 30 at 12:00 UTC. Please reach out in the #sig-release channel in Slack if you have any questions!

142121: kubelet: add memoryManagerPolicyOptions with memory-drift-tolerance (KEP-6232)

AI-Armless added the memoryManagerPolicyOptions configuration and memory-drift-tolerance setting described in KEP-6232. The tolerance allows the Memory Manager to account for small differences between expected and observed memory assignments instead of treating every drift as an allocation failure. This gives operators more control over memory-management behavior on nodes using the Memory Manager while preserving strict accounting when required.

142108: update podcertificaterequest and podcertificateprojection to allow setting ML-DSA algorithms

everraven extended Pod certificate request and projection APIs to support selecting ML-DSA signature algorithms. This allows workloads to request certificates using post-quantum-capable cryptographic algorithms and makes the selected algorithm available through the Pod certificate flow. The change affects certificate request APIs, kubelet projection behavior, and authentication-related integrations as Kubernetes evolves its support for post-quantum cryptography.

142074: [KEP-2172] warn about implicitly insecure container UIDs/GIDs

Priyankasaggu11929 implemented the warning described in KEP-2172. Kubernetes now provides visibility when container UID/GID settings may result in an implicitly insecure configuration instead of leaving users to discover the risk through runtime behavior or external security checks. This helps operators identify potentially unsafe workload configuration earlier and improves the security guidance available during Pod setup.

142071: kube-apiserver: add watch-cache-max-average-object-size flag and byte budget bypass

wdoekes added kube-apiserver controls for limiting the average object size stored in the watch cache and introduced a byte-budget bypass for objects that exceed the configured limit. These controls give cluster operators more visibility and control over watch-cache memory usage, especially for resource types containing large objects. The change affects API-server cache behavior and can help prevent unusually large objects from consuming a disproportionate share of watch-cache capacity.

KEP of the Week

KEP-6249: Publish Graceful Node Shutdown state for DaemonSet coordination

When a node enters Graceful Node Shutdown, kubelet knows that it is terminating Pods but the control plane does not. The DaemonSet controller can therefore see a missing DaemonSet Pod, create a replacement, and have kubelet reject it because the node is shutting down, causing repeated create and reject churn. This KEP makes the shutdown state visible on the Node object through the conditions introduced by KEP-5683.

The proposal has kubelet publish GracefulNodeShutdownInProgress=True and DrainInProgress=True before terminating Pods. The DaemonSet controller suppresses new Pod creation while both conditions are true, while the Node Lifecycle Controller clears lingering conditions if kubelet is lost. This follows the approach discussed for kubernetes/kubernetes#122912, avoids introducing new API types or condition constants, and helps operators distinguish intentional node shutdown from a broken DaemonSet rollout.

danbruno101 is developing the proposal with SIG Node and SIG Apps. The KEP was reviewed in WG Node Lifecycle meetings on August 10, 17, and 24, and its current PR is seeking SIG Node review and Production Readiness Review ownership.

KEP 6249 is targeting Alpha in Kubernetes v1.38 behind the DaemonSetGracefulNodeShutdown feature gate.

Other Merges

Promotions

Deprecated

Shoutouts

Last Week In Kubernetes Development (LWKD) is a product of multiple contributors participating in Kubernetes SIG Contributor Experience. All original content is licensed Creative Commons Share-Alike, although linked content and images may be differently licensed. LWKD does collect some information on readers, see our privacy notice for details.

You may contribute to LWKD by submitting pull requests or issues on the LWKD github repo.