Maintainer Summit North America 2026 CFP CFP closes on July 19. Maintainers, project leaders, and contributors are encouraged to submit session proposals before the deadline. Registration is open for it as well.
Steering Committee election nominations continue, with Janet Kuo announcing her candidacy and Sean McGinnis receiving a community nomination. Nominations close on August 3.
Next Deadline: Code Freeze, July 23th
If your enhancement is unlikely to be ready by Code Freeze, now is the time to request a Code Freeze Exception. Review the Exceptions process to ensure your request meets the requirements and is submitted before the upcoming Code Freeze.
Patch releases for all supported Kubernetes versions are targeted for July 14th.
In this pull request Jefftree updated Kubernetes to use etcd v3.7.0, replacing the previous release candidate with the final upstream version and updating both the embedded client libraries and default etcd images. This brings Kubernetes in sync with the latest stable etcd release while enabling new storage capabilities that future Kubernetes features can build upon, including ongoing work around efficient Watch/List operations. See the related upstream discussion in the etcd v3.7.0 release and the related Watch/List streaming work in Kubernetes.
In this pull request pohly advanced the Dynamic Resource Allocation (DRA) Device Taints and Tolerations feature to General Availability via the resource.k8s.io/v1 API. Linked to KEP-5055, this milestone stabilizes how clusters restrict or allow specialized hardware access, such as GPUs, using dedicated device-level taints. Moving out of the experimental phases means cluster operators and hardware vendors can confidently implement production-ready, fine-grained resource scheduling without worrying about feature gate maintenance.
rthallisey introduced several critical, well-known node conditions into the core API, including GracefulNodeShutdownInProgress, DrainInProgress, Drained, MaintenancePlanned, and MaintenanceInProgress. This foundational change implements the initial phase of KEP-6161, designed to build explicit ecosystem awareness around structural cluster disruptions. By exposing these standardized node states, downstream automation tools, operators, and core controllers can programmatically coordinate edge cases during maintenance workflows to improve overall workload uptime.
In this pull request, luxas implemented the core engine logic for the highly anticipated Conditional Authorization feature Part of KEP-5681, this foundational work builds directly upon earlier API refinements to establish the machinery required for context-aware access control. By providing these framework hooks, the API server will soon be able to evaluate complex runtime variables and policies before granting client permissions, significantly upgrading security capabilities across multi-tenant clusters.
vshkrabkov enhanced the default scheduling flow to support PodGroups as atomic preemption victims Linked to the Workload-Aware Preemption design under KEP-5710, this change introduces clean interface abstractions for Victim and DomainVictim to group node-level state. Rather than evaluating and evicting pods individually, the scheduler can now remove an entire group as a single unit, avoiding partial preemption failures and heavily optimizing gang-scheduled AI or batch workloads.
In this pull request, GFilipek introduced the new PodGroupPostFilter extension point to the scheduling framework API. Associated with KEP-5710, this clean architectural change replaces previously hardcoded Workload-Aware Preemption logic with a fully pluggable interface. This enables out-of-tree and custom plugin authors to seamlessly build and configure their own complex preemption and scheduling rules when dealing with multi-pod groups and batch scheduling behaviors.
KEP-5963: DRA Device Compatibility Groups
This KEP extends the Dynamic Resource Allocation (DRA) ResourceSlice API to let device drivers declare mutually exclusive allocation constraints between groups of devices. This addresses hardware (such as GPUs) that support multiple incompatible partitioning or virtualization modes, where selecting one configuration prevents others from being used simultaneously.
Today, DRA cannot express these constraints, causing the scheduler to make invalid allocation decisions. As a result, conflicts are detected only during resource preparation, leading to pod startup failures, repeated scheduling retries, and a poor user experience. This proposal enables the scheduler to understand these constraints upfront, preventing incompatible allocations before scheduling.
This KEP is currently in Alpha stage.
memory.low cgroup value was ineffective due to missing ancestor cgroup coverage.PodGroupPostFilter scheduler extension point that runs after standard PostFilter for gang-scheduled workloads.--max-depth flag to truncate schema output for deeply nested resources like CRDs and Pod specs.cluster-info dump --output-directory creates output files with owner-only permissions, preventing world-readable exposure of potentially sensitive cluster state.PodGroup.Status was not updated when pods in the group had mismatched .spec.schedulerName or priority values.metrics.k8s.io API promoted to v1 GA.github.com/google/cadvisor/lib bumped from v0.60.3 to v0.60.4, which pulls in updated golang.org/x/* module versions across the tree.etcd v3.7 was released last week. Highlights include RangeStream (to be supported by Kubernetes v1.37), bootstrapping from v3store, a protobuf overhaul, and multiple performance improvements. Kubernetes v1.37 will test against etcd v3.7.
Kubernetes v1.37 has reached its mid-cycle milestone with 86 tracked enhancements. Feature blog placeholders are now due, while Code Freeze begins on July 22 ahead of the planned August 26 release.
SIG etcd has released etcd v3.7.0, introducing the long-awaited RangeStream feature, performance improvements, the removal of the legacy v2store, and a major protobuf overhaul.
The Kubernetes Steering Committee election process is underway. Community member Tim Hockin has opened a self-nomination and is seeking endorsements from eligible voters to qualify for the 2026 election.
The CFP for the Maintainer Track, ContribFest, and Lightning Talks at KubeCon North America 2026 closes on July 12. Kubernetes SIGs and Working Groups are encouraged to submit session proposals before the deadline.
Next Deadline: Feature Blog Freeze, 10th July 2026
Feature Blog Freeze placeholders for Kubernetes v1.37 are due July 10th (AoE). If your enhancement is getting a feature blog, open a placeholder PR before the deadline; the Release Comms team will follow up on delivery and review from there.
Cherry-picks for the July patch releases are due July 10th, with releases targeted for July 14th.
In this pull request hakuna-matatah introduced the HPAOptimizedSelectorStore feature gate to replace the legacy, lock-heavy bimultimap datastore inside the HorizontalPodAutoscaler controller. This architectural update mitigates extreme Read/Write mutex contention, reducing average lock wait times by 214×. As a result, reconciliation throughput exploded by up to 195× under massive concurrent workloads. This optimization allows the HPA controller to scale linearly with high CPU core counts, eliminating a critical performance bottleneck for dense enterprise clusters.
In this pull request p0lyn0mial enabled the WatchListCompression feature gate by default, introducing transparent gzip compression for WatchList responses. By utilizing a recycled pool of writers via perFlushGzipWriter, this PR resolves previous memory regression bugs. Large-scale benchmarks demonstrate that this change slashes P99 latency by up to 54% and reduces baseline API server memory by 7%. It is a major scalability milestone that trades minor CPU cycles for optimized network throughput.
KEP-2021: HPA supports scaling to/from zero pods for object/external metrics
This KEP enables the Horizontal Pod Autoscaler (HPA) to scale workloads from zero to many replicas and back to zero when using object or external metrics. Since CPU and memory metrics require running pods, scale-to-zero is limited to these metric types. The feature is intended to reduce costs and energy consumption for intermittently idle, resource-intensive workloads (such as GPU-based applications) while still allowing HPA to automatically scale back up when demand returns (for example, when a queue receives new messages). As of now, the KEP is still in Alpha.
PreemptionPolicy field to PodGroupSpec as part of KEP-5710 workload-aware preemption; the field is gated behind the PodGroupPreemptionPolicy feature gate and follows the same Never / PreemptLowerPriority semantics as per-pod preemption.PodGroup API object to PodGroupInfo so scheduler plugins can obtain a consistent PodGroup state throughout the scheduling cycle.bindAddress in KubeProxyConfiguration; explicit wildcard binds (0.0.0.0 / ::) no longer trigger contradictory recommendations, invalid addresses now get their own warning, and specific non-wildcard IPs still recommend the per-family wildcard.In Open source maintainership in the age of AI, Kevin Hannon breaks down how Kubernetes is adapting to AI-assisted contributions through contributor policies, human accountability, and AI-powered review tools.
The kubernetes/cloud-provider-sample and kubernetes-sigs/cloud-provider-equinix-metal are now archived.
Maintainer Summit North America 2026 CFP closes on July 19. Submit a session proposal before the deadline.
Next Deadline: Docs placeholders, July 2
If you are responsible for an enhancement that requires documentation, make sure your placeholder documentation PR is opened by July 2. If your enhancement doesn’t require documentation, make sure to mark it No Docs Needed on the Enhancements Tracking Board.
Cherry-picks for the July patch releases are due July 10, with releases targeted for July 14.
In this pull request jsafrane advanced SELinuxMount to General Availability, completing the feature’s journey to stable Kubernetes storage behavior as part of KEP-1710. SELinuxMount allows Kubernetes to mount volumes with the appropriate SELinux context instead of relying only on recursive relabeling of files on the volume, which can be slow and expensive for large volumes or high-density nodes. Reaching GA means the feature is now considered production-ready for SELinux-enforcing environments, where it can improve both pod startup performance and operational predictability.
In this pull request benluddy added support for CBOR encoding on Kubernetes non-resource endpoints as part of KEP-4222. While Kubernetes already supports multiple content types for API resources, this work extends encoding support to endpoints outside the standard resource CRUD paths, improving consistency in how the API server can serialize responses. Because it touches API machinery and request/response handling in the control plane, this PR is notable beyond a single feature area and may influence downstream clients, proxies, and ecosystem tooling that interact with those endpoints.
KEP-5532: Restart All Containers on Container Exits
This KEP extends the container restart rules introduced in KEP-5307 by allowing a container’s exit to trigger an in-place restart of the entire pod. Instead of recreating the pod, Kubernetes restarts all containers—including init and sidecar containers—while preserving the pod’s sandbox, UID, network namespace, IP address, and attached devices. This approach is more efficient for workloads such as AI/ML training, where recreating and rescheduling pods is expensive. It also ensures init containers are re-executed, providing a clean and correctly initialized environment after a restart. Additionally, it supports workflows where init containers prepare or fetch new work items before the main application runs again.
This KEP is currently graduated to Alpha in Kubernetes v1.35.
startPodSync to fix a memory leak regression introduced when each pod sync allocated a new context.(nil, nil) sync path, leaving stale backoff state across sync iterations.FailedToRetrieveImagePullSecret events when an image pull actually fails, eliminating spurious warnings for pods that pull cleanly with missing optional pull secrets.resourceVersion in Pod status patches, preventing lost updates when concurrent components race to patch the same Pod.ResourceSlice validRange, preventing DRA drivers from advertising malformed numeric ranges.github.com/google/cadvisor/lib, a slimmer cadvisor subpackage that reduces the kubelet’s overall dependency footprint.e2e_node_windows suite, continuing the Windows node-level test coverage build-out.CrossVersionObjectReference.Kind and .Name fields have been migrated to declarative validation.Naadir Jeewa proposed creating WG Node Identity, a new Working Group intended to coordinate cross-SIG efforts around secure node identity. The effort aims to develop a common approach to hardware-backed node attestation and node identity verification in Kubernetes.
The 2026 Kubernetes Steering Committee election season has begun, with nominations now open for three Steering Committee seats, each serving a two-year term. It is also time to submit voter exception requests.
Mario Fahlandt has been nominated to serve as an additional SIG ContribEx Co-Chair. He has contributed across several community initiatives, including Contributor Summits, New Contributor Orientation, and contributor outreach efforts. The leadership team is being expanded to help share the growing responsibilities of SIG ContribEx.
After serving as co-chair of Kubernetes SIG Storage for over 10 years, Saad has announced that he will be stepping down from the role. Hemant Kumar has been nominated as the new co-chair, bringing long-term involvement with the SIG and a strong understanding of its goals and direction.
Please sign-up for the KubeCon NA 2026 Project Pavilion and onsite PR support program.. SIGs, WGs, Committees, and Subprojects planning to showcase their work or announce major updates at KubeCon should apply for participation and communications support before July 19, 2026.
Next Deadline: Docs placeholders, July 2nd
If you are responsible for an enhancement that requires documentation, you must create a placeholder PR by July 2. If your enhancement doesn’t require docs, make sure to tag that.
Patch releases v1.33.13, v1.34.9, v1.35.6, and v1.36.2 came out June 12. This includes a golang update and a multitude of bug fixes.
In this pull request p0lyn0mial introduced the new WatchListCompression feature gate, bringing gzip compression support to Kubernetes WatchList responses when clients advertise Accept-Encoding: gzip. Since many controllers and operators perform an initial LIST before transitioning to WATCH, this feature can significantly reduce network bandwidth and improve efficiency in large clusters. Regular WATCH requests remain unchanged, making the rollout low risk for existing clients. This feature is enabled by default in Beta and is an important improvement for API server scalability.
aojea improved how the kube-apiserver communicates with admission webhooks when --enable-aggregator-routing=true is enabled. Previously, HTTP connection reuse could unintentionally direct most concurrent admission requests to a single webhook backend, creating uneven load across replicas. This PR introduces round-trip load balancing between webhook endpoints through the WebhookRoundTripLoadBalancing feature gate (Beta, enabled by default), improving availability and scalability for highly available webhook deployments.
In this pull request adrianmoisey advanced Relaxed DNS Names to General Availability, completing the feature’s journey from Alpha through Beta to a stable Kubernetes API. The work is part of KEP-5311, which expands supported DNS naming rules while maintaining compatibility with existing workloads. Reaching GA signals that the feature is production-ready and no longer experimental, allowing users and downstream projects to rely on it without feature gate concerns.
KEP-5471: Extended Toleration Operators for Threshold-Based Placement
This enhancement extends Kubernetes taints and tolerations by adding numeric comparison operators (Lt, Gt) to core/v1 Tolerations, alongside the existing Equal and Exists operators. It enables threshold-based scheduling decisions, such as allowing workloads to run only on nodes with an SLA above a specified value (e.g., SLA ≥ 95%). The change only impacts the existing TaintToleration scheduler plugin and does not introduce new scheduling algorithms or stages.
The primary motivation is to support clusters with mixed-capacity nodes (e.g., on-demand and spot instances) through a node-centric policy model. Unlike NodeAffinity, which requires configuring every workload individually and lacks eviction capabilities, taints allow nodes to advertise risk levels while workloads explicitly opt in. This preserves existing taint semantics, including NoExecute-based eviction, provides centralized operational control, reduces configuration drift, and aligns with other Kubernetes safety mechanisms such as memory-pressure and disk-pressure taints. The KEP is currently in the Alpha stage.
apiserver/storage, simplifying how the cacher pulls events from etcd watch streams.WatchListCompression feature gate, enabling compressed responses for streaming LIST requests served through the watch cache.GangScheduling plugin is missing from a GenericWorkload configuration, making misconfiguration easier to diagnose.--event-burst CLI flag description is updated to match its actual default, correcting documentation drift.SIG-ContribEx will be managing all SIG/WG involvement in KubeCon NA this year, including Project Pavillion kiosks and onsite PR support for Kubernetes project groups. Interested SIGs, WGs, Committees, and Subprojects should apply using the form by July 19.
Next Tuesday is the monthly New Contributor Orientation. Join at one of two times to learn all about starting your contribution journey.
This month’s Steering Committee Meeting started out by discussing the 2026 Steering Committee Elections. Based on the feedback from last year’s election retro, we are starting the process earlier this year. Antonio Ojea, Benjamin Elder and Sascha Grunert will be stepping down this year and there will be 3 spots to be elected. One feedback from the steering committee was to announce the elections earlier before folks are out for their summer vacations. Keep a lookout for the steering committee elections anouncement soon!
The details of the Maintainer Summit was also discussed. The Maintainer Summit event will happen on the day before the colocated events and will only be happening at KubeCon EU and NA. If you want to have a booth in the project pavillion for a SIG or a subproject, you can request this via SIG ContribEx. The CFP announcement for the Maintainer Summit at KubeCon NA 2026 is not out yet, but is expected to be announced soon.
Next Deadline: Enhancements Freeze, 17th June 2026
Kubernetes v1.37 enters Enhancements Freeze on June 17th. Ensure all enhancement tracking issues, KEP requirements, and Production Readiness Review requirements are completed before the deadline.
June patch releases were targeted for June 9th for all supported Kubernetes versions.
In this pull request, yliaog promoted Dynamic Resource Allocation (DRA) Extended Resources to GA for the v1.37 milestone to establish a stable interface for managing specialized hardware accelerators. Driven and approved by contributors like pohly , liggitt , and bart0sh , the PR resolves tracking issue #138376 and aligns with the wg/device-management working group.
In this pull request, soltysh advanced a long-awaited capability by enabling the maxUnavailable rolling update strategy configuration by default for KEP-961. This change allows for tighter control over application availability and faster rollout tempos during workload updates without relying on manual feature gate activation.
adrianmoisey introduced a brand-new feature gate structurally isolating IPVS (IP Virtual Server) logic within kube-proxy for KEP-5495. This lays the crucial architectural groundwork for how the networking subsystem is managed, configured, and potentially decoupled in future releases, affecting both contributors modifying proxy code and users leveraging high-performance IPVS routing modes. Please test that this feature gate functions correctly in your networking setup.
EtcdRangeStream feature gate which initializes the watch cache via a single server-streaming etcd RangeStream RPC instead of paginated range requests, reducing apiserver memory pressure during bootstrap as part of KEP-5966.KubeProxyIPVS feature gate as Phase 2 of KEP-5495, gating IPVS mode in kube-proxy on an opt-in basis ahead of full removal in a future release.PublicKeysECDSA feature gate; users still on v1beta3 must migrate to v1beta4 before upgrading.WasFlushedFromUnschedulable after a flush event, causing them to be repeatedly re-evaluated.memory.high cgroup value, affecting memory-pressure behaviour for those workloads.memory.high on containers when MemoryQoS is disabled, preventing residual cgroup configuration when the feature is toggled off.test/e2e_node_windows, closing a long-standing Windows test coverage gap.The Kubernetes Node Lifecycle Working Group is seeking community feedback on node lifecycle use cases where components need node-state information that is not currently available through a common API. The collected feedback will help the group scope KEPs for the next Kubernetes release cycle.
SIG-etcd has nominated Fu Wei as a co-Tech Lead, recognizing his sustained technical contributions, leadership, and commitment to the etcd project and community
Next Deadline: Production Readiness Freeze, 10th June 2026
Production Readiness Freeze for Kubernetes v1.37 lands on 10th June. Ensure all required Production Readiness Reviews are completed and any outstanding issues are addressed before the deadline.
Cherry-picks for the June patch releases are due June 5th. The release is expected on the 9th.
Argh4k has landed a reader-facing improvement to kube-scheduler error messages: every error emitted by the pod-group preemption path is now prefixed with pod group preemption: so operators can immediately tell which preemption flow produced a given SchedulerError. This mirrors the existing behavior of the default per-pod preemption path, which already prefixes errors with preemption:, and is part of the v1.37 milestone under SIG Scheduling.
The change is part of KEP-5710: Workload-Aware Preemption, which introduces a parallel preemption path for pod groups (gang-scheduled workloads) alongside the existing per-pod preemption. With two preemption flows now writing into the same SchedulerError stream, error logs that previously could only have come from default per-pod preemption can now come from either path, and without a prefix, it was effectively impossible to tell which one. This is especially painful when triaging gang-scheduling failures in batch and AI/ML workloads, where pod-group preemption is the common case.
139251: Rename Signal enum keys in CRI API
SergeyKanzhelev has renamed all enum keys in the Signal type within api.proto to carry a SIGNAL_ prefix (e.g., SIGABRT becomes SIGNAL_SIGABRT). This resolves a long-standing naming collision between the CRI API’s enum identifiers and standard C signal macros, which caused build failures in environments where C signal headers were present.
The change is part of KEP-4960: ContainerStopSignals (introduced in v1.33, currently Alpha). Because the feature hasn’t yet reached Beta, the rename was done directly without a deprecation period. While this is a breaking change for developers, anyone building against cri-api will need to update their code and rebuild binaries; the underlying integer values are unchanged, so the wire format remains compatible and cross-version communication is unaffected. Downstream projects like containerd and CRI-O will need to update their internal references to match the new names.
KEP-2535: Ensure Secret Pulled Images
This enhancement improves Kubernetes image security by ensuring that access to container images is authenticated even when images are already present on a node. It introduces kubelet-based image verification for IfNotPresent and Never pull policies, allowing administrators to enforce authorization checks without requiring the Always pull policy. The feature provides configurable verification modes, strengthens control over private image access, and addresses long-standing security concerns around image reuse while reducing dependence on registry availability during container startup.
KEP-2535 graduated to Beta in Kubernetes v1.35, strengthening image access security through credential-aware verification of previously pulled images and enhanced kubelet credential caching.
pod group preemption: message.SIGNAL_ in api.proto definition to avoid conflicts with C++ macroses.PlacementCycleState to the scheduling framework, providing per-placement state to PlacementScore plugins under the alpha TopologyAwareWorkloadScheduling feature gate.wg-batch co-chair Kevin Hannon is stepping down to focus on workload-aware scheduling efforts and will become co-chair of wg-workload-aware-scheduling. He has nominated Amy Chen (@amy) as the new wg-batch co-chair, citing her work on Kueue observability, end-user advocacy, and community engagement.
KubeCon North America Maintainer Track CFP is open until July 12. Maintainer Track speaking slots are reserved for SIG Chairs and Tech Leads; contributors interested in presenting should coordinate with their SIG Chair to submit through the SIG’s allocated slot.
Kubernetes v1.37 Release Schedule is out!
The v1.37 release schedule is now available. The cycle began May 18 and is targeting August 26 for the final release. Key milestones include Enhancements Freeze on June 17 and Code Freeze on July 23.
Dipesh Rawat will serve as Release Lead for v1.37 alongside the release team and shadows. The Call for Enhancements is now open, and SIGs should begin preparing KEPs for the upcoming cycle.
The cherry-pick deadline for the June patch releases is June 5.
139232: validation-gen: elide RegisterValidations for packages with no TypeMeta validations
The declarative-validation toolchain has been graduating quickly over the past several weeks, first the introduction of the +k8s:eachVal tag chain in #138629, then the coverage guardrail in #138872. One side effect of running validation-gen across every API package was a long tail of generated files that registered nothing; empty RegisterValidations functions whose bodies were just return nil. They added no behaviour, but they did add review burden, vendor noise, and confusion for contributors trying to understand which packages actually participate in declarative validation.
This change moves a hasRootTypesWithValidations() check into emitRegisterFunction itself so the generator simply no-ops when there’s nothing to register, removing 26 empty generated files across pkg/apis/admission, pkg/apis/apps, pkg/apis/policy, and other API package directories. It is also a prerequisite now, for #139101, the next step in the same series. This is scoped to SIG API Machinery, and is targeted at the v1.37 milestone.
KEP-5237: Convert route controller to watch-based reconciliation
This enhancement introduces a watch-based reconciliation mechanism for the Kubernetes route controller using informers, replacing the previous fixed 10-second polling loop. The change reduces unnecessary API requests to infrastructure providers, improves responsiveness when nodes are added or updated, and aligns the route controller with other informer-driven Kubernetes controllers. Additional work also introduced route synchronization metrics along with supporting documentation and feature blog updates.
The watch-based route controller reconciliation enhancement is currently in Alpha stage.
apiserver_storage_list_* metrics now include storage and index labels to distinguish the storage backend and lookup path used to serve LIST requests.ContainerRuntimeVersion validates if the installed container runtime supports the RuntimeConfig gRPC method.nominatedNodeName, just like a normal preempting pod does.syncProxyRules could take tens of seconds in clusters with many Services because GetAllLocalAddressesExcept issued one full netlink address dump per interface. The function now issues a single dump per address family, reducing syncProxyRules latency by orders of magnitude on large clusters.DisruptionMode enum field to struct to support future extensibility.AnnotatedEventf method to the new events API (EventRecorder and EventRecorderLogger interfaces in client-go/tools/events),kubectl describe statefulset output.apiserver_cache_list_total, apiserver_cache_list_fetched_objects_total, and apiserver_cache_list_returned_objects_total are no longer exposed by default. Should migrate to the unified apiserver_storage_list_* metrics with storage="watchcache" label.DefaultWatchCacheSize field of k8s.io/apiserver/pkg/server/options.EtcdOptions is now removed.apiserver_watch_events_total and apiserver_watch_events_sizes to BETAserviceaccount_legacy_tokens_total, serviceaccount_stale_tokens_total, serviceaccount_valid_tokens_total to betaapiserver_webhooks_x509_missing_san_total and apiserver_webhooks_x509_insecure_sha1_total metrics to BETA.The 2026 Steering Election cycle has officially begun, with ContribEx appointing Nina Polshakova, Sreeram Venkitesh, and Rey Lejano as this year’s Election Officers. Xander Grzywinski and Christopher Tineo will serve as Alternate Officers.
KubeCon North America CFP closes on May 31. Submit your talks before the deadline.
KubeCon North America Maintainer Track CFP is open until July 12. Maintainer Track speaking slots are reserved for SIG Chairs and Tech Leads; contributors interested in presenting should coordinate with their SIG Chair to submit through the SIG’s allocated slot.
Kubernetes v1.37 Release Cycle Kicks Off, 18th May 2026
The v1.37 release schedule has been posted, with the release cycle beginning May 18.
Applications for the Kubernetes v1.37 Release Team shadow program closed on May 15, with selected applicants announced on May 22.
Kubernetes Patches v1.33.12, v1.34.8, v1.35.5, and v1.36.1 have been released.
Common Expression Language (CEL) admission evaluation pipeline has been optimized to avoid repeatedly converting the same API object during policy evaluation. The CEL admission plugin backs ValidatingAdmissionPolicy and related features, and converts each runtime.Object into a CEL-evaluable representation before a policy expression can run against it. When a request is subject to multiple policies or webhooks, the same object was being converted again for every evaluation, and that conversion became a measurable CPU bottleneck on busy API servers. Under a 200 QPS load test with five ValidatingAdmissionPolicies, the change reduces API server CPU usage from roughly 1.10 cores to 0.93 cores, an approximately 15% reduction, while leaving light-policy workloads functionally unchanged.
The fix introduces a LazyObject abstraction wrapping VersionedObject and VersionedOldObject in VersionedAttributes. LazyObject caches the CEL ref.Val representation on first use and automatically clears it whenever the underlying object is mutated via Set(), so the conversion cost is paid at most once per object per request, and not at all when CEL evaluation is skipped, such as for empty expression groups. Encapsulating the cache this way also resolves a class of desynchronization bugs where an object mutated during mutating admission could leave a stale CEL representation behind. The PR is scoped to SIG API Machinery, and is targeted at the v1.37 milestone.
This enhancement simplifies Kubernetes node troubleshooting by allowing cluster administrators to securely stream logs from control-plane and worker nodes through a kubelet API or kubectl plugin, eliminating the need to SSH into nodes or build custom log readers. In the past, debugging components such as the kubelet, kube-proxy, or API server often requires direct node access just to inspect logs, which can be cumbersome and operationally inefficient. This feature provides centralized access to logs from Linux nodes using systemd/journald, services writing to /var/log/, and supported Windows worker nodes logging to C:\var\log and Application logs. Since node logs may contain sensitive information, access would be restricted to cluster administrators. The KEP does not cover support for non-systemd Linux distributions, nodes with cluster connectivity or configuration issues, or services that do not log to standard locations like /var/log/.
KEP-2258 (Node Log Query) was introduced in Alpha in v1.27, moved to Beta in v1.30, and has now graduated to GA in v1.36.
apiserver_watch_cache_initialization_duration_seconds recording the duration of the most recent watch cache initialization, labeled by group and resource.dynamic_resource_allocation_resourceclaim_creates_total as metric for number of ResourceClaims created, replacing differently names metrics in each component.net.ipv4.tcp_slow_start_after_idle and net.ipv4.tcp_notsent_lowat to the allowed safe sysctls list.",inline" to simply "".PatchPodStatus API in the scheduler framework to accept a [slice of Pod conditions ([]*v1.PodCondition)(https://github.com/kubernetes/kubernetes/pull/135160) instead of a single condition (*v1.PodCondition). This allows scheduler plugins to update multiple Pod conditions in a single API call, preventing newer calls from overwriting older ones when multiple conditions need to be updated concurrently.SIG Autoscaling has nominated Jack Francis as a new SIG Chair as Guy Templeton steps down from the role after years of leadership and contributions to the SIG. Thank you, Guy Templeton, for everything you’ve done for SIG Autoscaling. The proposal also names Omer Aplatony as Tech Lead and adds dedicated Node Autoscaling and Workload Autoscaling Tech Lead roles.
Next Tuesday is the monthly New Contributor Orientation. As part of a new SIG-focused format for NCOs, next week’s AMER session will be focused on SIG Release, hosted by @Kat Cosgrove. Join the AMER session to learn how SIG Release helps deliver Kubernetes releases and how you can get involved.
Next Deadline: 1.37 Release Team Shadow Program, May 15th
Applications for the Kubernetes v1.37 Release Team shadow program closes on May 15, with selected applicants announced on May 22. If you want to learn how Kubernetes release team work and contribute to the release process, this is a great opportunity to get involved. Learn more in the Release Team Overview, Shadows Guide, Role Handbooks, and Selection Criteria.
Kubernetes Patches v1.33.12, v1.34.8, v1.35.5, and v1.36.1 have been released.
yongruilin has landed an in-process coverage gate for declarative-validation rules that fails CI when a +k8s: DV tag has no test exercising it. The PR spans SIG API Machinery, SIG Scheduling, and SIG Testing, and is targeted at the v1.37 milestone. Declarative validation moves API field validation rules out of hand-written Go code and into struct-tag annotations on the API types, generated into validators by validation-gen. The benefit is enormous; co-located rules, version-consistent validation, and a clear audit surface but until now there was no way to prove that every declared rule was actually being exercised by tests. A contributor could add a +k8s:maxBytes=64 tag to a field, regenerate validators, and merge a green PR even if no test ever fed that field a value over 64 bytes. This guardrail closes that gap.
authorizer.Authorizer interface to authorizer.UnconditionalAuthorizerluxas has landed the kickoff of a five-part series introducing conditional authorization to Kubernetes by renaming every existing usage of authorizer.Authorizer to authorizer.UnconditionalAuthorizer, and renaming initializer.WantsAuthorizer to initializer.WantsUnconditionalAuthorizer. The PR spans SIG Auth, SIG API Machinery, SIG Node, SIG Scheduling, and WG Device Management, and is targeted at the v1.37 milestone. Today, the authorizer.Authorizer interface is the only authorization contract in tree, and any function that takes one can issue arbitrary authorization decisions even if it only ever needs to ask simple “is this principal allowed to do X” questions. The refactor splits this into two contracts: a small UnconditionalAuthorizer that callers ask for when they only need traditional unconditional decisions, and a fuller Authorizer interface (extended in #137204) that callers must explicitly opt into when they need to evaluate conditions on the request. This narrows the API surface receivers can use and makes it visible in the type system which call sites can take conditional logic.
KEP-127: Support User Namespaces
The Kubernetes User Namespaces KEP introduces support for Linux user namespaces to improve pod security and isolation by allowing processes inside containers to run with different user and group IDs than on the host system. This means a process can run as root inside the container while remaining an unprivileged user on the host, significantly reducing the impact of container breakout vulnerabilities. The feature strengthens defense-in-depth, improves multi-tenant security, and helps mitigate several known and future container escape vulnerabilities by limiting host-level privileges even if a workload escapes the container boundary.
User Namespaces became GA in 1.36.
StorageVersionMigration to use merge patch over SSAauthorizer.Authorizer might now choose to accept only a smaller interface, authorizer.UnconditionalAuthorizer, in case only the receiver only needs to perform unconditional authorization requests and wants to signal this in the code for clarity. Any authorizer implementation must still implement the full authorizer.Authorizer interface.GetPerformanceInfo() fails.[ConsistentListFromCacheSkipTimeoutFallback](https://github.com/kubernetes/kubernetes/pull/138701/changes) .When enabled, kube-apiserver returns HTTP 429 for consistent LIST requests that cannot be served from watch cache within the timeout window, instead of falling back to storage.KUBECTL_PATH environment variable when executing a plugin.v2 for aggregated discovery and not fall back to v2beta1kubectl drain --disable-eviction --dry-run=server no longer hangs indefinitely.OnDelete update strategy now correctly updates Status.CurrentRevision after all pods are recreated with the new revision.The Agent Sandbox subproject has published a Kubernetes blog post, Running Agents on Kubernetes with Agent Sandbox, and progressed to v0.4.3 since v0.1.1. Updates include default network isolation, persistent storage support, Python SDK improvements, a new Go client, and controller stability enhancements.
The Kubernetes v1.37 Release Team shadow application is open until May 15, 2026, with results announced on May 22. The release cycle is expected to run from May 18 to August 26. Learn more in the Release Team Overview, Shadows Guide, Role Handbooks, and Selection Criteria. Updates will be shared in the #sig-release Slack channel and kubernetes/sig-release repository.
KubeCon North America CFP closes on May 31. Submit your talks before the deadline.
KubeCon North America Maintainer Track CFP is also open. Submit your sessions by July 12.
Next Deadline: Release Cycle Starts, soon
Cherry-picks for the next patch releases are due this Friday, May 8.
aaron-prindle has migrated handwritten per-item byte-length validation for ResourceSlice.spec.devices[*].attributes[*].strings[*] to declarative validation as part of KEP-5073: Declarative Validation with validation-gen. The PR was reviewed and approved by thockin and contributors from SIG API Machinery and WG Device Management, and is the first use of the +k8s:eachVal tag in the kubernetes/kubernetes API surface.
Declarative validation moves API field validation from hand-written Go code into machine-generated code driven by struct-tag annotations on the API types themselves. The benefit for contributors is that validation rules become co-located with the field they validate, far easier to audit, and consistent across all API versions. The benefit for users is reduced surface area for subtle validation drift between API versions and improved API server performance over time.
This PR adds the +k8s:alpha(since: "1.37")=+k8s:eachVal=+k8s:maxBytes=64 tag chain to the v1, v1beta1, and v1beta2 resource API types, regenerates the declarative validation code, and adds equivalence coverage tests verifying the byte-count semantics on both create and update boundary cases. Notably, the PR uses +k8s:maxBytes rather than +k8s:maxLength because the existing handwritten validation enforces a byte limit via Go’s len(string) and field.TooLong, so the tests use the two-byte UTF-8 character é to confirm byte-count behaviour. The handwritten validation remains authoritative; this migration begins the soak period required to graduate the +k8s:eachVal tag to StabilityLevelBeta.
KEP-5710: Workload-aware preemption
This KEP proposes enhancing the Kubernetes scheduler with workload-aware preemption, shifting from a pod-centric to a workload-centric approach. Building on KEP-4671’s Workload and PodGroup APIs, it introduces concepts like pod group priority and defining preemption units at the workload level, starting with a simple implementation based on existing pod preemption. The motivation stems from tightly coupled workloads such as AI training and multihost inference that depend on continuous coordination across multiple pods, where disruption of even a single pod halts overall progress. Current preemption mechanisms fail to account for this, especially in resource constrained environments where prioritization and efficient hardware utilization are critical. By standardizing workload-aware preemption within core Kubernetes, this proposal aims to better support such workloads, improve resource utilization, and enable deeper integration with other features like autoscaling and disruption management.
This KEP is currently in Alpha stage for Kubernetes v1.36.
kubeadm init, if the default admin.conf and super-admin.conf paths are used, load the files but construct in-memory kubeconfigs that point to the InitConfiguration.localAPIEndpoint instead of the ClusterConfiguration.controlPlaneEndpoint, resolving issues with delayed load balancers provisioned only after the first kube-apiserver instance startsorValue() and has()