Week Ending October 11, 2026

Developer News

Wei Fu (@fuweid) has joined SIG etcd as a lead.

SIG Apps has added workload-class as a new subproject.

SIG Autoscaling has added model-serving-signals as a new subproject.

WG LTS has been wound down and its documentation archived under archive/wg-lts.

SIG Architecture has fixed inverted SPDY and WebSocket client guidance in the developer guide; contributors building clients should re-read the corrected section.

The Kubernetes SIG Meet & Greet at KubeCon NA 2026 will take place in Salt Lake City November 10 at 12:30 PM, giving contributors a chance to meet SIG leads in person before KubeCon sessions. Please sign up to staff your SIG table.

Release Schedule

Next Deadline: Docs: Open placeholder PRs, October 29

Contributors with enhancements that require documentation should prepare placeholder docs PRs against the dev-1.38 branch ahead of the October 29 deadline.

Kubernetes v1.38.0-alpha.2 has been built and pushed using Go 1.27.1 on October 7. The release notes are updated in CHANGELOG-1.38.md, with a pointer to them on GitHub.

October patch releases are postponed by one week to October 20 to include the latest Go releases and CVE fixes. Cherry-picks are now due this Friday, October 16.

Featured PRs

142913: [KEP-4443] Add more granular job failure condition reasons

ameukam added more granular failure condition reasons for Jobs using PodFailurePolicy. Previously, multiple rules using the FailJob action could produce the same generic failure reason, making it difficult for higher-level controllers to determine why a Job failed. This change allows rules to be named so that the resulting Job failure condition can identify the rule responsible, falling back to the rule’s index when no name is specified. This gives controllers such as JobSet more precise information to make decisions about retries and recovery. The change is part of KEP-4443.

142898: e2e: test KEP-4006 WebSocket exec, attach and port-forward without SPDY fallback

seans3 added end-to-end tests for exec, attach, and port-forward over WebSockets without allowing a fallback to SPDY. Tests that permit fallback can pass even when the WebSocket path is broken, leaving gaps in coverage for Kubernetes’ transition away from SPDY. By explicitly exercising these operations without fallback, this change helps verify that WebSocket streaming works independently and provides stronger confidence in the new protocol paths. The work is part of KEP-4006, with promotion of the tests to conformance planned as a follow-up after a soak period.

142897: apiserver, kubelet: graduate the KEP-4006 WebSocket streaming metrics to BETA

seans3 graduated WebSocket streaming metrics in the API server and kubelet from Alpha to Beta as part of KEP-4006. The metrics provide visibility into WebSocket streaming requests handled by the API server and kubelet, including requests processed through the API server’s stream translator and tunnel. Advancing these metrics to Beta improves their stability and makes them more useful for monitoring and troubleshooting as Kubernetes continues its transition from SPDY to WebSockets.

KEP of the Week

KEP-5945: DRA Optional Node Operations

Dynamic Resource Allocation (DRA) normally makes kubelet call a node-local driver to prepare a device before a container starts and clean it up when its Pod ends. Some controller-managed resources need neither call, yet still require a no-op driver on every node. Others need preparation but clean up automatically.

KEP-5945 adds skipNodeOperations to ResourceSlice and carries it into ResourceClaim allocation results. Kubelet skips a gRPC call only when all devices from a driver in the claim mark that operation to skip. A driver can skip NodeUnprepareResources alone or both it and NodePrepareResources. Custom allocators must copy the field for the kubelet to apply this choice.

Troy Chiu drafted the KEP with SIG Node in May 2026 after discussion in the WG Device Management meeting. It reached Alpha in v1.37 with the DRAOptionalNodeOperations gate off by default. KEP 5945 is implementable; its Beta update merged September 28 targets Beta in v1.38 with the gate on by default and Stable in v1.40. The enhancement issue tracks the work.

Other Merges

kubectl kustomize no longer loads kustomize Go (.so) plugins; exec and KRM function plugins are unaffected
Updated TokenReview internal type to improve cast speed from latest external version
Strengthened runtime PodGroup and CompositePodGroup hierarchy validation in kube-scheduler to verify maximum tree depth, Workload reference consistency, scheduling policies, and disruption modes
applyconfiguration-gen now honors +k8s:openapi-model-package when looking up OpenAPI definitions, and fails if the schema has no definition for a root type
kube-apiserver and other servers built on k8s.io/apiserver now accept up to 16384 request header values
API server now returns 400 instead of 500 status code on GET request with invalid revision
Fixed API warnings on ReplicationController updates, which described the previous pod template instead of the new one
DRA consumable capacity + CEL: fixed name comparisons and lookup
Fix: kubectl create ingress panics on rules with extra equals signs
kubectl: keep a multi-line event message inside its table row
ktesting: the former internal packages are now available as k8s.io/ktesting and k8s.io/client-go/ktesting
DRA: fixed a deadlock when an ErrorHandler calls Update, or a kubelet plugin’s HandleError calls PublishResources, in response to pools that do not match ReconcilePoolWithName
Added percentageOfPlacementsToScore to the scheduler config
Strengthened runtime PodGroup and CompositePodGroup hierarchy validation in kube-scheduler to verify maximum tree depth, workload reference consistency, scheduling policies, and disruption modes
The deployment controller now retries when scaling down an old ReplicaSet fails during a rolling update, instead of treating that failure as success
The metrics apiserver_resource_size_estimate_bytes and apiserver_resource_objects now include explicit observation timestamps
Added conditional authorization support to kube-apiserver
kubemark has been removed from the kubernetes repository

Promotions

Version Updates

Kubernetes is now built with Go v1.27.2
otel to v1.47.0
node local DNS to v1.27.1

Subprojects and Dependency Updates

cluster-api v1.14.3: Fixes a race in KCP proxy DialContext, matches etcd members to machines being deleted by KCP, and bumps grpc to 1.83.2 for security advisories; also v1.13.7
cri-o v1.37.2: Switches release bundle SBOMs to SPDX 3.0.1 JSON-LD format
prometheus v3.13.4: Fixes GO-2026-6348 HTTP/2 DATA frame fragmentation memory exhaustion and corruption of float native histograms in federation
nerdctl v2.4.1: Fixes CDI support in compose, fixes port forwarding on Windows, and updates bundled containerd to 2.4.1

Shoutouts

No shoutouts this week. Want to thank someone for special efforts to improve Kubernetes? Tag them in the #shoutouts channel.

Last Week In Kubernetes Development (LWKD) is a product of multiple contributors participating in Kubernetes SIG Contributor Experience. All original content is licensed Creative Commons Share-Alike, although linked content and images may be differently licensed. LWKD does collect some information on readers, see our privacy notice for details.

You may contribute to LWKD by submitting pull requests or issues on the LWKD github repo.