Week Ending October 04, 2026

Developer News

A new security advisory, CVE-2026-19444 (kubectl cp path traversal on Windows allows arbitrary file writes), was published on September 28; a malicious tar archive can cause kubectl cp on Windows to write files outside the intended destination.

Shu Muto (@shu-mutou) has moved to SIG UI emeritus, following the earlier SIG UI leadership transitions covered in prior editions.

WG Node Identity has added a dedicated Slack channel for its working group discussions.

SIG ContribEx has added vetting criteria for the #announcements Slack channel to clarify what messages are appropriate for posting there.

Election Update

The 2026 Kubernetes Steering Committee election results were announced at the public Steering meeting on October 7: Michael McCune, Janet Kuo, and Priyanka Saggu were elected to the three open seats for two-year terms. 308 of 1547 eligible voters cast ballots, for a turnout of 19.91%.

Release Schedule

Next Deadline: Docs: Open placeholder PRs, October 29

The Kubernetes v1.38 Enhancements Freeze began September 30. Of 102 enhancements opted in, 86 are being tracked and 16 were removed from the milestone.

October patch releases are targeted for October 13.

Featured PRs

142693: Add CSIControllerGetNodeInfo feature gate and driverRegistrations field

torredil added the alpha CSIControllerGetNodeInfo feature gate and the driverRegistrations field to CSINode as part of KEP-6011. The change enables CSI node registration to split node-side identity reporting from controller-side discovery of topology and volume attachment limits. This allows CSI drivers to obtain information that may require cloud API access from the controller rather than requiring those credentials on worker nodes. The controller-side flow also enables more accurate volume capacity tracking using VolumeAttachment information while preserving the existing node-side registration flow for drivers that do not opt in.

142789: KEP-[6283]: use kubernetes.io/kube-apiserver-serving CTB to mount kube-apiserver trust

stlaz introduced a feature gate, as part of KEP-6283, to switch ServiceAccount token volume trust from the kube-root-ca.crt ConfigMap to the kubernetes.io/kube-apiserver-serving ClusterTrustBundle. This provides a newer mechanism for making the kube-apiserver serving CA available to workloads using automatically mounted ServiceAccount token volumes, while allowing the existing behavior to remain available behind the feature gate.

KEP of the Week

KEP-4412: Projected Service Account Tokens for Kubelet Image Credential Providers

Private image pulls commonly use imagePullSecrets stored in the Kubernetes API or credentials supplied to the kubelet for an entire node. KEP-4412 lets a configured credential provider receive a short-lived ServiceAccount token bound to the Pod and scoped to an audience. The plugin can exchange it for registry credentials or return it directly as a pull credential. This lets image access follow the workload’s identity without requiring a long-lived pull Secret in the cluster.

Before an image pull, kubelet requests the token and passes it to the plugin with selected ServiceAccount annotations. Administrators opt a provider in through tokenAttributes and set cacheType to key cached credentials per token or per ServiceAccount. The API server restricts which token audiences a node may request. Because the container runtime receives credentials only when a pull starts, a pull longer than their lifetime can fail, and lazy image streaming is not supported.

aramase and mainred authored the KEP with SIG Auth and SIG Node. The feature reached Alpha in v1.33 and Beta in v1.34. The KEP is targeting GA in v1.38 and the GA update merged on September 29 documents test evidence, operational limits, and the plan to lock its two feature gates on; the enhancement issue tracks the work.

Other Merges

• Fixed refcounting leak in the node authorizer graph for pods which reference secrets, configmaps, or pvcs multiple times
• Fixed kubectl kuberc set leaving a stale credential plugin allowlist when the policy is changed to AllowAll or DenyAll, which caused kubectl to fail
• Added consistency store to client-go and deprecated it from pkg/controller
• Fixed k8s.io/apimachinery/pkg/util/yaml silently dropping the last line of a YAML stream when it has no trailing newline and its length is an exact multiple of the reader buffer size
• Separated deleteGet and updateGet etcd operation in etcd_request_* metrics and added reason label to error
• kubelet: the pods API gRPC server now limits concurrent streams per connection to 100 and applies its request rate limit to WatchPods stream openings
• kubelet: gRPC probes fail immediately when the connection is refused instead of retrying until the probe timeout
• kubectl label now prints messages about nonexistent labels to stderr instead of stdout, so they no longer break JSON or YAML output
• hack/local-up-cluster.sh now supports quantum crypto keys and certs for testing
• Kubelet now reports allocated resource health statuses in deterministic order, preventing unnecessary Pod status updates when resource health is unchanged
• Fixed the HorizontalPodAutoscaler utilization and usage calculations wrapping to a wrong or negative current value when pod metric or request totals exceeded int64 or the utilization percentage exceeded int32; the reported percentage now saturates at the int32 limit
• Fixed the taint_eviction_controller_pod_deletion_duration_seconds metric, which recorded nanoseconds scaled by 1e9 instead of seconds
• Creating or updating a resource.k8s.io object with a qualified name that contains more than one slash, such as a device attribute key a/b/c, is now rejected
• Added CloudNodeAdditionalLabelsReconciliation feature gate
• Fixed the field path in CSIDriver validation errors for spec.attachRequired, which was previously reported as spec.attachedRequired — a field that does not exist in the API
• kube-controller-manager: informer metrics now use correctly pluralized resource names
• kubelet: fixed invalid user range selection for user namespaces
• Fixed the ResourceClaim controller repeatedly restoring terminal Pod entries in status.reservedFor for allocated claims that remain in use by other consumers
• Fixed ResourceSlice validation to reject a per-device nodeSelector with more than one node selector term, as it already does for the slice-level nodeSelector
• Fixed a panic in kubectl kuberc view when no kuberc file exists and the user declines to generate a default one
• Fixed kubelet so that pods using dnsPolicy: Default no longer inherit scoped IPv6 link-local nameservers from the node resolver configuration unless the pod uses the host network namespace
• Fixed equality.Semantic.DeepDerivative for slices by rejecting prefix-only matches
• Fixed JSONSchemaProps comment to properly render JSON Schema URL as a valid link

Promotions

• HPAGeneration to GA

Deprecated

• MatchLabelKeysInPodAffinity feature gate has been removed

Version Updates

• Bumped golangci-lint v2.14.0

Shoutouts

• No shoutouts this week. Want to thank someone for special efforts to improve Kubernetes? Tag them in the #shoutouts channel.

Last Week In Kubernetes Development (LWKD) is a product of multiple contributors participating in Kubernetes SIG Contributor Experience. All original content is licensed Creative Commons Share-Alike, although linked content and images may be differently licensed. LWKD does collect some information on readers, see our privacy notice for details.

You may contribute to LWKD by submitting pull requests or issues on the LWKD github repo.