Wei Fu (@fuweid) has joined SIG etcd as a lead.
SIG Apps has added workload-class as a new subproject.
SIG Autoscaling has added model-serving-signals as a new subproject.
WG LTS has been wound down and its documentation archived under archive/wg-lts.
SIG Architecture has fixed inverted SPDY and WebSocket client guidance in the developer guide; contributors building clients should re-read the corrected section.
The Kubernetes SIG Meet & Greet at KubeCon NA 2026 will take place in Salt Lake City November 10 at 12:30 PM, giving contributors a chance to meet SIG leads in person before KubeCon sessions. Please sign up to staff your SIG table.
Next Deadline: Docs: Open placeholder PRs, October 29
Contributors with enhancements that require documentation should prepare placeholder docs PRs against the dev-1.38 branch ahead of the October 29 deadline.
Kubernetes v1.38.0-alpha.2 has been built and pushed using Go 1.27.1 on October 7. The release notes are updated in CHANGELOG-1.38.md, with a pointer to them on GitHub.
October patch releases are postponed by one week to October 20 to include the latest Go releases and CVE fixes. Cherry-picks are now due this Friday, October 16.
ameukam added more granular failure condition reasons for Jobs using PodFailurePolicy. Previously, multiple rules using the FailJob action could produce the same generic failure reason, making it difficult for higher-level controllers to determine why a Job failed. This change allows rules to be named so that the resulting Job failure condition can identify the rule responsible, falling back to the rule’s index when no name is specified. This gives controllers such as JobSet more precise information to make decisions about retries and recovery. The change is part of KEP-4443.
seans3 added end-to-end tests for exec, attach, and port-forward over WebSockets without allowing a fallback to SPDY. Tests that permit fallback can pass even when the WebSocket path is broken, leaving gaps in coverage for Kubernetes’ transition away from SPDY. By explicitly exercising these operations without fallback, this change helps verify that WebSocket streaming works independently and provides stronger confidence in the new protocol paths. The work is part of KEP-4006, with promotion of the tests to conformance planned as a follow-up after a soak period.
seans3 graduated WebSocket streaming metrics in the API server and kubelet from Alpha to Beta as part of KEP-4006. The metrics provide visibility into WebSocket streaming requests handled by the API server and kubelet, including requests processed through the API server’s stream translator and tunnel. Advancing these metrics to Beta improves their stability and makes them more useful for monitoring and troubleshooting as Kubernetes continues its transition from SPDY to WebSockets.
Dynamic Resource Allocation (DRA) normally makes kubelet call a node-local driver to prepare a device before a container starts and clean it up when its Pod ends. Some controller-managed resources need neither call, yet still require a no-op driver on every node. Others need preparation but clean up automatically.
KEP-5945 adds skipNodeOperations to ResourceSlice and carries it into
ResourceClaim allocation results. Kubelet skips a gRPC call only when all
devices from a driver in the claim mark that operation to skip. A driver can
skip NodeUnprepareResources alone or both it and NodePrepareResources.
Custom allocators must copy the field for the kubelet to apply this choice.
Troy Chiu drafted the KEP with SIG Node in May 2026 after discussion in the WG
Device Management meeting. It reached Alpha in v1.37 with the
DRAOptionalNodeOperations gate off by default. KEP 5945 is implementable; its
Beta update merged September 28 targets
Beta in v1.38 with the gate on by default and Stable in v1.40. The
enhancement issue tracks
the work.
.so) plugins; exec and KRM function plugins are unaffected+k8s:openapi-model-package when looking up OpenAPI definitions, and fails if the schema has no definition for a root typeErrorHandler calls Update, or a kubelet plugin’s HandleError calls PublishResources, in response to pools that do not match ReconcilePoolWithNamepercentageOfPlacementsToScore to the scheduler configapiserver_resource_size_estimate_bytes and apiserver_resource_objects now include explicit observation timestampsWindowsCPUAndMemoryAffinity to BetaKubeProxyNFTablesLocalhostNodePorts to Betakuberc support to stableA new security advisory, CVE-2026-19444 (kubectl cp path traversal on Windows allows arbitrary file writes), was published on September 28; a malicious tar archive can cause kubectl cp on Windows to write files outside the intended destination.
Shu Muto (@shu-mutou) has moved to SIG UI emeritus, following the earlier SIG UI leadership transitions covered in prior editions.
WG Node Identity has added a dedicated Slack channel for its working group discussions.
SIG ContribEx has added vetting criteria for the #announcements Slack channel to clarify what messages are appropriate for posting there.
The 2026 Kubernetes Steering Committee election results were announced at the public Steering meeting on October 7: Michael McCune, Janet Kuo, and Priyanka Saggu were elected to the three open seats for two-year terms. 308 of 1547 eligible voters cast ballots, for a turnout of 19.91%.
Next Deadline: Docs: Open placeholder PRs, October 29
The Kubernetes v1.38 Enhancements Freeze began September 30. Of 102 enhancements opted in, 86 are being tracked and 16 were removed from the milestone.
October patch releases are targeted for October 13.
torredil added the alpha CSIControllerGetNodeInfo feature gate and the driverRegistrations field to CSINode as part of KEP-6011. The change enables CSI node registration to split node-side identity reporting from controller-side discovery of topology and volume attachment limits. This allows CSI drivers to obtain information that may require cloud API access from the controller rather than requiring those credentials on worker nodes. The controller-side flow also enables more accurate volume capacity tracking using VolumeAttachment information while preserving the existing node-side registration flow for drivers that do not opt in.
stlaz introduced a feature gate, as part of KEP-6283, to switch ServiceAccount token volume trust from the kube-root-ca.crt ConfigMap to the kubernetes.io/kube-apiserver-serving ClusterTrustBundle. This provides a newer mechanism for making the kube-apiserver serving CA available to workloads using automatically mounted ServiceAccount token volumes, while allowing the existing behavior to remain available behind the feature gate.
Private image pulls commonly use imagePullSecrets stored in the Kubernetes API or credentials supplied to the kubelet for an entire node. KEP-4412 lets a configured credential provider receive a short-lived ServiceAccount token bound to the Pod and scoped to an audience. The plugin can exchange it for registry credentials or return it directly as a pull credential. This lets image access follow the workload’s identity without requiring a long-lived pull Secret in the cluster.
Before an image pull, kubelet requests the token and passes it to the plugin with selected ServiceAccount annotations. Administrators opt a provider in through tokenAttributes and set cacheType to key cached credentials per token or per ServiceAccount. The API server restricts which token audiences a node may request. Because the container runtime receives credentials only when a pull starts, a pull longer than their lifetime can fail, and lazy image streaming is not supported.
aramase and mainred authored the KEP with SIG Auth and SIG Node. The feature reached Alpha in v1.33 and Beta in v1.34. The KEP is targeting GA in v1.38 and the GA update merged on September 29 documents test evidence, operational limits, and the plan to lock its two feature gates on; the enhancement issue tracks the work.
kubectl kuberc set leaving a stale credential plugin allowlist when the policy is changed to AllowAll or DenyAll, which caused kubectl to failkubectl label now prints messages about nonexistent labels to stderr instead of stdout, so they no longer break JSON or YAML outputtaint_eviction_controller_pod_deletion_duration_seconds metric, which recorded nanoseconds scaled by 1e9 instead of secondsa/b/c, is now rejectedspec.attachRequired, which was previously reported as spec.attachedRequired — a field that does not exist in the APIstatus.reservedFor for allocated claims that remain in use by other consumersnodeSelector with more than one node selector term, as it already does for the slice-level nodeSelectorkubectl kuberc view when no kuberc file exists and the user declines to generate a default onednsPolicy: Default no longer inherit scoped IPv6 link-local nameservers from the node resolver configuration unless the pod uses the host network namespaceequality.Semantic.DeepDerivative for slices by rejecting prefix-only matchesTwo security advisories were published on September 24: CVE-2026-2270 (rated Medium, 5.9) describes a confused deputy attack in the StatefulSet controller that lets a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects create a cross-namespace pod, and CVE-2026-76654 (rated Medium, 5.8) describes an NTLM coercion vulnerability on Windows nodes when a pod’s subPath is a symbolic link to an attacker-controlled UNC network share; both are fixed in the September patch releases (v1.34.12, v1.35.9, v1.36.5, v1.37.1) covered in the Release Schedule below.
SIG Cluster Lifecycle has a leadership change: Vince Prignano (@vincepri) is stepping down as chair, and existing Tech Lead Fabrizio Pandini (@fabriziopandini) will assume the chair role in addition to his Tech Lead responsibilities. The change is under a one-week lazy consensus period.
The CfP for Kubecon Europe 2027 is already open, and closes October 11th. This includes Maintainer Track sessions and Lightning Talks for SIGs.
Voting closes on October 2. If you are an Kubernetes Org Member, and have not cast your ballot yet, please vote right away.
Next Deadline: Enhancements Freeze, September 29 (AoE) / September 30 at 12:00 UTC
The Kubernetes v1.38 release cycle heads into its Enhancements Freeze this week. Following KEP Readiness, 11 enhancements were removed from the v1.38 milestone, leaving 89 tracked out of the 100 that had opted in. Any KEP that still wants to join v1.38 and isn’t already tracked now needs an approved exception. Please reach out in the #sig-release channel in Slack with any questions.
Kubernetes v1.38.0-alpha.1 has been built and pushed using Go 1.27.1. See the release notes and the GitHub release.
Patch releases v1.37.1, v1.36.5, v1.35.9, and v1.34.12 are now available. These releases bump to Go 1.26.8 and include a handful of bug fixes.
pohly added an option for the DRA ResourceSlice controller to avoid publishing capacities and attributes associated with a driver domain. ResourceSlices are used by DRA drivers to publish device information that the scheduler uses during allocation and placement. This change gives drivers more control over which resource metadata is exposed through ResourceSlices while preserving the ability to publish the devices themselves. The work builds on the ResourceSlice and structured-parameter design described in KEP-4381.
ttsuubasa graduated DRA Device Binding Conditions to General Availability under KEP-5007. Device Binding Conditions allow the scheduler to wait for network- or fabric-attached devices to become ready before binding a Pod. This avoids binding a workload to a node before the required device attachment has completed and allows failed attachment attempts to be reported back to scheduling. The graduation makes this workflow stable for DRA drivers and workloads that depend on devices requiring external preparation.
Kubernetes controller managers use a Lease to ensure only one replica reconciles resources at a time. Today, if the leader cannot renew its Lease before RenewDeadline during a temporary API server or etcd outage, it exits. Restarting forces its controllers to rebuild their cached view of the cluster, extending the interruption after the API becomes available again.
The proposal adds a transport-level write gate to controller clients. When the manager stops leading, the gate rejects new writes and cancels writes in flight while reads and watches continue, keeping caches warm. The election loop keeps trying to renew the same Lease; if it succeeds before another replica takes over, the gate reopens and reconciliation resumes without a restart. A configurable recovery deadline can limit these attempts, and the former leader exits if another replica takes over. The Lease API and election protocol remain unchanged.
alvaroaleman, jpbetz, and michaelasp authored the KEP with SIG API Machinery. Proposed on September 14, it was merged on September 25. The enhancement issue tracks the work, and discussion is in the SIG API Machinery thread.
KEP 6361 is implementable and targets Alpha in Kubernetes v1.38 behind the disabled-by-default LeaderElectionRecovery feature gate.
+k8s:minimum and +k8s:maximum support time.Duration fields with quoted Go duration strings, such as +k8s:minimum="1s". Integer payloads on time.Duration fields are now rejected.SelfSignedCertKeyOptions in k8s.io/client-go/util/cert accepts a KeyGenerator, allowing self-signed certificates to be generated with a key algorithm other than RSA. The default remains a 2048-bit RSA key.NoExecute device taints (DeviceTaintRule) did not evict pods using DRA-backed extended resources (pod.Status.ExtendedResourceClaimStatus)NominatedPodsForNode method must now pass logger klog.Logger as the first argumentNode.status.volumesAttached[].devicePath now states the platform-specific semantics: on Linux it is the host block-device node, on Windows it carries the CSI VolumeIDdistribute-cpus-across-cores=true and align-by-socket=true options were enabled, even when a single socket had sufficient capacity--manifest-url-header credential values (e.g., Authorization tokens) to runtime logs at startup. Only header key names are now loggedManagedFieldsOptOut feature gate (off by default)/apis/... paths and final delegation 404s now return a JSON Status object with Content-Type: application/json instead of a plain-text “404 page not found” bodyWindowsHostNetwork feature gate (KEP-3503, withdrawn). The gate no longer guarded any code pathsSeparateTaintEvictionController feature gate from kube-controller-manager. Remove this gate from existing --feature-gates configuration before upgradingNo shoutouts this week. Want to thank someone for special efforts to improve Kubernetes? Tag them in the #shoutouts channel.
]]>Sebastian Florek (@floreks) has moved to SIG UI emeritus, following Kahiro Okina’s appointment as a SIG UI Lead covered in last week’s edition.
The Maintainer Summit NA 2026 schedule is now available, with sessions on SIG Node, SIG Apps, SIG Architecture, and Kubernetes localization; the event runs November 8 in Salt Lake City, and a KubeCon + CloudNativeCon NA ticket is required.
This is your last week to vote. The Steering Committee election voting will remain open through October 1, with exception requests due by September 29. If you are marked as not eligible despite your contributions, please request an exception.
Next Deadline: KEP Readiness Deadline, September 22-23
The Kubernetes v1.38 release cycle has reached its KEP Readiness Deadline. Enhancement owners should confirm their opt-in status now; the Enhancements Freeze follows on September 29 (AoE) / September 30 at 12:00 UTC. Please reach out in the #sig-release channel in Slack with any questions.
September patch releases were delayed by one week to September 23rd.
KunWuLuan exposed the DRA allocator’s constraint mechanism to its callers. This allows DRA-aware components to inspect and use allocator constraints when determining whether resource claims can be satisfied together. The change provides a clearer interface between the allocator, kube-scheduler, and device-management integrations, and lays groundwork for more informed placement decisions for workloads that require multiple or constrained resources.
pohly added an option for the DRA ResourceSlice controller to avoid publishing capacities and attributes associated with a driver domain. ResourceSlices are used by DRA drivers to publish device information that the scheduler uses for allocation and placement. This change gives drivers more control over which resource details are exposed through ResourceSlices while preserving the ability to publish the resources themselves, improving support for drivers with domain-specific or sensitive resource metadata.
On Linux nodes, kubelet can use the systemd watchdog to run health checks and send periodic heartbeats through SdNotify(). If those heartbeats stop, systemd can restart kubelet, but the resulting failure can be difficult to diagnose. This KEP adds default-visible structured logs for watchdog checker and SdNotify() errors, plus one summary when existing notification retries are exhausted.
The proposal preserves the existing watchdog control flow, timing, retry count, backoff, socket behavior, and cancellation. The KubeletWatchdogDiagnostics feature gate controls the new diagnostic output and is disabled by default, so operators can enable the additional evidence during investigations without changing watchdog behavior. The work follows the kubelet watchdog discussion in kubernetes/kubernetes#135449 and intentionally adds no Kubernetes API, kubelet configuration fields, metrics, events, or NodeConditions.
googs1025 is developing the provisional KEP with SIG Node. The KEP is proposed in kubernetes/enhancements#6248 and targets Alpha in v1.38.
spec.hard, status.hard or status.used value that the object already holds.nf_conntrack_max sysctl if its value is already higher than the value kube-proxy wants it to be.kubectl now prints a warning when creating or updating a DeviceTaintRule whose deviceSelector is present but empty, since that selector matches every device from every driver in the cluster.Pods, completes the lifecycle of a Pod and the PodStatus now cover resetting the PodReadyToStartContainers condition.DynamicResourceAllocation feature gate, which has been locked to default on since v1.35, has been removedNo shoutouts this week. Want to thank someone for special efforts to improve Kubernetes? Tag them in the #shoutouts channel.
]]>Dims has proposed building kubelet as a static binary (CGO_ENABLED=0) to remove the last remaining CGO dependency in Kubernetes binaries; discussion has surfaced concerns about DNS resolution changes, glibc/NSS behavior differences, and userns account lookup.
Kahiro Okina (@kahirokunn) has been appointed as a SIG UI Lead following a lazy consensus period; Kahiro has been contributing to Headlamp on multi-cluster UI, plugin ecosystem work, and mentoring.
SIG Node has added security-profiles-merger as a subproject.
SIG Instrumentation have added kubernetes-mixin as a subproject.
The AI Conformance program now supports hybrid verification starting with v1.37, letting vendors submit automated test results alongside documentation evidence; Kubernetes releases prior to v1.34 can no longer be certified.
Agent Sandbox v1.0 has been released, consolidating on v1beta1 APIs, adding a Go sandbox-router for browser-based interactive sessions, and adding a TypeScript SDK alongside existing Go and Python SDKs.
The Steering Committee election voting will remain open through October 1, with exception requests due by September 29. If you are marked as not eligible despite your contributions, please request an exception.
Next Deadline: KEP Readiness Deadline, September 22, 2026 (AoE) / September 23, 2026 at 12:00 UTC
The Kubernetes v1.38 release cycle is underway. The schedule has been finalized and you can find the full timeline here. Enhancements targeted for this cycle are expected to be opted in for the release by the KEP Readiness Deadline. Enhancements that miss it would require an exception. KEP authors should have their PRs to the kubernetes/enhancements repo opened by the KEP Readiness Deadline on September 22nd. The Enhancements Freeze is scheduled for September 29 (AoE) / September 30 at 12:00 UTC. Please reach out in the #sig-release channel in Slack if you have any questions!
AI-Armless added the memoryManagerPolicyOptions configuration and memory-drift-tolerance setting described in KEP-6232. The tolerance allows the Memory Manager to account for small differences between expected and observed memory assignments instead of treating every drift as an allocation failure. This gives operators more control over memory-management behavior on nodes using the Memory Manager while preserving strict accounting when required.
everraven extended Pod certificate request and projection APIs to support selecting ML-DSA signature algorithms. This allows workloads to request certificates using post-quantum-capable cryptographic algorithms and makes the selected algorithm available through the Pod certificate flow. The change affects certificate request APIs, kubelet projection behavior, and authentication-related integrations as Kubernetes evolves its support for post-quantum cryptography.
Priyankasaggu11929 implemented the warning described in KEP-2172. Kubernetes now provides visibility when container UID/GID settings may result in an implicitly insecure configuration instead of leaving users to discover the risk through runtime behavior or external security checks. This helps operators identify potentially unsafe workload configuration earlier and improves the security guidance available during Pod setup.
wdoekes added kube-apiserver controls for limiting the average object size stored in the watch cache and introduced a byte-budget bypass for objects that exceed the configured limit. These controls give cluster operators more visibility and control over watch-cache memory usage, especially for resource types containing large objects. The change affects API-server cache behavior and can help prevent unusually large objects from consuming a disproportionate share of watch-cache capacity.
When a node enters Graceful Node Shutdown, kubelet knows that it is terminating Pods but the control plane does not. The DaemonSet controller can therefore see a missing DaemonSet Pod, create a replacement, and have kubelet reject it because the node is shutting down, causing repeated create and reject churn. This KEP makes the shutdown state visible on the Node object through the conditions introduced by KEP-5683.
The proposal has kubelet publish GracefulNodeShutdownInProgress=True and DrainInProgress=True before terminating Pods. The DaemonSet controller suppresses new Pod creation while both conditions are true, while the Node Lifecycle Controller clears lingering conditions if kubelet is lost. This follows the approach discussed for kubernetes/kubernetes#122912, avoids introducing new API types or condition constants, and helps operators distinguish intentional node shutdown from a broken DaemonSet rollout.
danbruno101 is developing the proposal with SIG Node and SIG Apps. The KEP was reviewed in WG Node Lifecycle meetings on August 10, 17, and 24, and its current PR is seeking SIG Node review and Production Readiness Review ownership.
KEP 6249 is targeting Alpha in Kubernetes v1.38 behind the DaemonSetGracefulNodeShutdown feature gate.
/dev/disk/by-path symlink was already gone (e.g: after an iSCSI session was lost before teardown), leaving the volume stuck in node.status.volumesInUse and blocking attach on other nodes.Done before requeuing a pod in AddUnschedulablePodIfNotPresent, fixing a bug in the scheduling queue lifecycle.kubectl get --sort-by output when multiple items have equal or missing sort keys.MountedByNode default in AddVolumeNode, correcting a case where the field could be reported as mounted before mount was confirmed.preemptionPolicy.apidiscovery.k8s.io/v2beta1 removed; use apidiscovery.k8s.io/v2 instead.
SIG Architecture has completed a review of feature gates on master (v1.38 development) against the feature gates documentation. The review identified overdue feature gates, gates due for removal in v1.38, GA/deprecated gates that are not locked to their default, and several stale alpha/beta gates across SIG Node, API Machinery, Auth, Scheduling, Network, Windows, Storage, Instrumentation, Apps, and Cloud Provider.
SIG UI has nominated Kahiro Okina (@kahirokunn) as a new SIG UI Lead, following a recommendation from current SIG UI Chairs. Kahiro has been a contributor and reviewer to Headlamp, contributing to its multi-cluster UI, plugin ecosystem, mentoring, and community growth. The nomination is now in a one-week lazy consensus period.
The Steering Committee election voting will remain open through October 1, with exception requests due by September 29. If you are marked as not eligible despite your contributions, please request an exception.
Next Deadline: KEP Readiness Deadline, September 22, 2026 (AoE) / September 23, 2026 at 12:00 UTC
The Kubernetes v1.38 release cycle began on August 31, with the final release targeted for December 16, 2026. The KEP Readiness Deadline is scheduled for September 22, 2026 (AoE) / September 23, 2026 at 12:00 UTC. Enhancements are expected to complete their Production Readiness Review by this deadline; enhancements that miss it require an exception. The Enhancements Freeze is scheduled for September 29 (AoE) / September 30 at 12:00 UTC. If you’d like to include your KEP in the v1.38 release cycle, please reach out to your SIG leads to get your KEP tracked for the release. Find more information in the Call for Enhancements announcement.
luxas advanced KEP-5681: Conditional Authorization by adding conditional authorization support to the kube-apiserver. Conditional authorization lets an authorizer return requirements that depend on request-object content, which the API server can evaluate later during admission instead of making a decision solely from request metadata. This PR is the fourth part of the implementation series and builds on earlier core machinery, enabling more context-aware authorization policies for Kubernetes APIs.
NAVEENKUMARRK777 implemented the alpha allowDisruptionByPriorityGreaterThanOrEqual capability described in KEP-3280. The change adds API and scheduler support for controlling which lower-priority workloads may be disrupted, based on a priority threshold. This gives workload authors and cluster operators more precise control over disruption behavior for priority-sensitive applications.
jdizkowski implemented recursive status handling for CompositePodGroups, part of the CompositePodGroup API proposal (KEP-6012). CompositePodGroups are intended to represent hierarchical, heterogeneous workloads whose components may have different scheduling requirements. This PR propagates status through the hierarchy, allowing users and controllers to observe the aggregate state of complex workload groups instead of inspecting each child PodGroup separately.
This enhancement extends KEP-3756 to recover CSI volumes after a kubelet restart when pod-local vol_data.json metadata is missing or corrupt. Without the fallback, a global mount can remain active after its Pod directory disappears, causing the volume to leave node.status.volumesInUse and potentially allowing a ReadWriteOnce filesystem to be attached to another node. The proposal lets kubelet reconstruct the volume from metadata stored beside the global mount, then verify or unstage it through the normal volume-manager flow.
The work builds on a long-standing reconstruction problem tracked in kubernetes/kubernetes#101791 and the manual-cleanup procedure documented by KEP-3756. cniackz, with SIG Storage and SIG Node contributors including jsafrane and gnufied, is implementing the fallback in kubernetes/kubernetes#138454. The KEP is implementable, and its KEP and implementation updates are currently under review.
KEP 6058 is targeting Alpha in Kubernetes v1.38.
The change is opt-in behind a new alpha feature gate and affects kubelet CSI reconstruction and unmounting. It is intended to prevent leaked global mounts and reduce the risk of double-mounting and data corruption on storage systems such as Fibre Channel, iSCSI, and EBS.
--restart flag values on kubectl run has been improved.+k8s:immutable tag to validation-gen so declarative validation can express immutable field semantics.PostBind extension point under KEP-6021 for plugins that run after a Pod has been bound to a Node.--warnings-as-errors support to kubectl apply and kubectl apply --dry-run=server, so CI pipelines can fail on server-side warning conditions.memory.swap.max so allocated swap is now correctly reflected in Pod status.kube-controller-manager adds a new _total counter for controller reconciliation errors.PodSandboxConfig.resource_claims is now propagated to the runtime for DRA-enabled pods.+k8s:required codegen so pointer-typed required fields don’t incorrectly reject zero values.scheduler_perf so DRA benchmarks can measure Extended Resource pathways.PrioritizedList requests.SchedulingResult to Pod events so future scheduling events can reference the prior decision.events_dispatched_total was incremented for undispatched bookmarks.endpoint_slice_controller_changes to endpoint_slice_controller_changes_total to add the conventional _total suffix; the old name is retained temporarily for backward compatibility./flagz endpoint reflects flag layer, not effective config.ImageVolume to GA.The Maintainer Summit schedule for Kubecon North America is live; it includes two SIG/Subproject meetings and Ask The Kubernetes Steering Committee. The same week, the Kubecon Europe CfP opened.
Voting is now open for the 2026 Kubernetes Steering Committee election. Six candidates are running this year, including Sean McGinnis (stmcginnis), Michael McCune (elmiko), Priyanka Saggu (priyankasaggu11929), Janet Kuo (janetkuo), Kaslin Fields (kaslin), and Jack Francis (jackfrancis).
Voting will remain open through October 1, with exception requests due by September 29. If you are marked as not eligible despite your contributions, please request an exception.
KCD Around the World: San Francisco Bay Area 2026 Organizers explores how KCD San Francisco Bay Area is bringing together a vast and often siloed cloud native community. Kashish Verma and Rey Lejano sit down with organizers Lisa-Marie Namphy and Jason (Jay) Smith to talk about how the event came together, what they learned from its first edition, and how this year’s KCD is evolving with the growing intersection of Kubernetes, AI, and open source.
Next Deadline: v1.38 Release Cycle Begins, August 31
The Kubernetes v1.38 release cycle began on August 31, with the final release currently targeted for December 16, 2026.
Starting with v1.38, the release cycle has been adjusted to give contributors more time between Enhancements Freeze and Code Freeze. The change is intended to give KEPs more time to be reviewed and merged before Code Freeze. The schedule is still being finalized, so more details will follow as the cycle progresses.
BitWeaverDev added terminating-state
visibility for StatefulSets in kubectl get. This makes it easier for users
and operators to identify StatefulSets that are being deleted but have not
finished terminating, without needing to inspect individual Pods or controller details. The change improves the day-to-day observability of StatefulSet lifecycle operations and helps users investigate deletions that are taking longer than expected.
harche fixed extended-resource accounting when
DRANodeAllocatableResources is enabled. Incorrect handling in this path could cause the node’s available extended resources to be represented inaccurately, affecting scheduling decisions for Pods that use Dynamic Resource Allocation. This PR corrects the resource information exposed for DRA, improving coordination between node resource reporting and scheduling for workloads that use device or other extended-resource claims.
Kubernetes v1.37.0 was released on August 26; see the Release Schedule below for details.
SIG Windows has added @jrvaldes as co-chair, with Aravindh Puthiyaparambil moving to emeritus.
SIG Node has published a new developer guide for node declared features, documenting how contributors should declare and use node-level feature signals.
Voting for the Kubernetes Steering Committee continues. If you are a Kubernetes Org member, please vote before October 1.
Kubernetes v1.37: Garhwal has been released on 26th August! The Release Announcement and Release Notes are now available. A few contributor-focused changes worth calling out:
Starting with v1.38, the release cycle will also have more time between Enhancements Freeze and Code Freeze, giving contributors more time to get their work reviewed and merged and helping reduce the need for Code Freeze exceptions.
harche fixed extended resource accounting when the DRANodeAllocatableResources feature is enabled. The scheduler and kubelet rely on node allocatable information to determine whether a Pod’s Dynamic Resource Allocation claims can be satisfied. This PR corrects the handling of extended resources in that path, preventing inaccurate node capacity information from affecting scheduling decisions for workloads that use DRA.
grosser fixed the OpenAPI schema for ParamRef.parameterNotFoundAction in admission registration APIs. Although the API requires callers to specify how admission policy evaluation should behave when a referenced parameter object is absent, the published schema did not mark the field as required. This PR aligns the OpenAPI contract with the API’s validation requirements, improving generated clients, schema validation, and tooling that consumes Kubernetes API definitions.
This enhancement, authored by @pohly and @everpeace, extends Dynamic Resource Allocation (DRA) with a tainting mechanism for individual hardware devices, modeled on how Kubernetes already taints Nodes. DRA drivers or admins can mark a specific device, such as a degraded GPU, as tainted, and workloads declare tolerations on their DeviceRequests to decide whether they’re still willing to use it. A new DeviceTaintRule API lets admins patch taints onto matching devices without needing driver support, and a dedicated controller evicts non-tolerating pods much like the existing node taint-eviction-controller.
KEP 5055 enhancement is stable in v1.37.
containerd is deprecating the implicit restore-via-CreateContainer codepath introduced by KEP-2008 (Forensic Container Checkpointing) after multiple CVEs; containerd 2.3.4 and 2.2.7 retain it as an experimental opt-in behind enable_experimental_restore_via_create, and containerd 2.4 removes it in favor of the explicit RestorePod API from KEP-5823.
SIG ContribEx has added AI notetaker guidance to Kubernetes Zoom meeting guidelines. AI notetaker bots (such as Granola, Otter.ai, Fireflies.ai, Fathom, or Read.ai) are not permitted on Kubernetes Zoom calls. Unauthorized third-party recording poses risks around consent, privacy, and moderation.
Voting is now open for the 2026 Kubernetes Steering Committee election. Six candidates are running this year, including Sean McGinnis (stmcginnis), Michael McCune (elmiko), Priyanka Saggu (priyankasaggu11929), Janet Kuo (janetkuo), Kaslin Fields (kaslin), and Jack Francis (jackfrancis).
Voting will remain open through October 1, with exception requests due by September 29. If you are marked as not eligible despite your contributions, please request an exception.
Next Deadline: v1.37.0 release, 26th August
The v1.37 release cycle enters its final week. Kubernetes v1.37.0-rc.1 has been released, built with Go 1.26.5, following v1.37.0-rc.0 on August 6. The final v1.37.0 release, and release blog publication are all targeted for August 26.
August Kubernetes patch releases have been delayed to August 19 to allow additional time for cherry-picks affected by recent GitHub disruptions and automation failures.
Kubernetes v1.38 Release Team Shadow application is open through August 28, with the v1.38 release cycle expected to begin around August 31.
pravk03 fixed DRA resource accounting for init containers. Resource overhead from DRA claims used by init containers should contribute to a Pod’s peak resource usage while those containers are running, but should not continue reducing the node’s steady-state allocatable capacity after they finish. This PR corrects that distinction, helping prevent nodes from appearing to have less capacity than they actually do and improving scheduling decisions for workloads that use Dynamic Resource Allocation.
RafPe fixed kubelet cache invalidation for name-keyed ClusterTrustBundle objects. Without invalidating cached entries when a bundle changes, kubelet could continue using stale trust-bundle data instead of observing the latest object contents. This PR ensures that updates to named ClusterTrustBundles invalidate the corresponding cache entries, allowing kubelet consumers to use current trust information.
This enhancement extends the Workload API and PodGroup API to allow ResourceClaims and ResourceClaimTemplates to be associated with an entire PodGroup, making it easier to share DRA resources across multiple related Pods. A ResourceClaim referenced by a PodGroup is reserved for the whole group rather than each individual Pod, avoiding the current 256-entry limit in status.reservedFor. Similarly, a ResourceClaimTemplate can automatically generate one ResourceClaim for the PodGroup, eliminating the need to manually create and name shared claims. This is particularly useful for large AI/ML workloads, where closely related Pods need to be placed within the same network or topology boundary for better performance. The enhancement also makes resource sharing more practical for workload APIs such as JobSet and LeaderWorkerSet, allowing Kubernetes to manage shared DRA resources generically through the common PodGroup abstraction.
This enhancement has been proposed to become Beta for Kubernetes v1.37.
SIG Autoscaling has clarified its subproject donation requirements, formalizing what external projects need to satisfy to be adopted under the SIG.
Dims has published a post-Code-Freeze CI recovery writeup showing that contributors across SIGs fixed roughly 27 CI jobs through 60 PRs since July 22, with the sig-release-master-blocking board now green; the full gist lists about 30 open failing-test and flake issues that still need owners.
The KubeCon + CloudNativeCon NA 2026 schedule is now live.
Voting is now open for the 2026 Kubernetes Steering Committee election. Six candidates are running this year, including Sean McGinnis (stmcginnis), Michael McCune (elmiko), Priyanka Saggu (priyankasaggu11929), Janet Kuo (janetkuo), Kaslin Fields (kaslin), and Jack Francis (jackfrancis). Voting will remain open until October 1.
All current Kubernetes org members are eligible to vote this year due to GitHub contributions not being accurately tracked during the first four months of 2026. Members of the SRC or CoCC are also eligible. Eligibility can be checked at elections.k8s.io or in the full voter list in the election repository. If you believe you should be eligible, but are not, please file an exception.
Next Deadline: RC1 release, August 19
We are in the final stretch for v1.37, which looks like it’s going out on time. If you’re working on Release Notes or the blog you have plenty to do, but most contributors just need be ready to respond quickly to any test failures. This means you can start thinking about v1.38. Speaking of which, the v1.38 Shadow Application is already open, and due August 28th.
vshkrabkov fixed Pod event handling for updates where the Pod UID changes. Because a UID identifies a specific Pod instance, an update with a new UID represents a different Pod rather than a normal modification. Treating it as an ordinary update could leave consumers with stale state associated with the previous Pod. This PR represents the transition as a delete event for the old Pod followed by an add event for the new Pod, allowing API machinery and scheduling consumers to process the identity change correctly.
macsko fixed scheduler state tracking for Pods rejected during the PlacementFeasible stage. The scheduler uses UnschedulablePlugins to identify which plugins made a Pod unschedulable and which cluster events should cause it to be retried. This PR ensures that the relevant plugin information is recorded for PlacementFeasible rejections, improving requeue behavior for workload-aware scheduling and Dynamic Resource Allocation scenarios where placement can depend on device, resource, or topology changes.
This KEP proposes exposing device health information (such as GPU failures) in Pod Status so Kubernetes can indicate when a Pod is using a device that is unhealthy or has failed. Currently, device failures are difficult to diagnose because Pods often enter CrashLoopBackOff without any indication that the assigned device is the root cause, and Kubernetes may keep restarting the Pod on the same faulty device. By surfacing unhealthy devices directly in Pod Status, the proposal provides a generic mechanism for easier troubleshooting and better handling of temporary or permanent device failures, while keeping the initial scope small and extensible for future enhancements.
PodLevelResourceManagers is disabled by default.