Week ending June 28, 2026

Developer News

In Open source maintainership in the age of AI, Kevin Hannon breaks down how Kubernetes is adapting to AI-assisted contributions through contributor policies, human accountability, and AI-powered review tools.

The kubernetes/cloud-provider-sample and kubernetes-sigs/cloud-provider-equinix-metal are now archived.

Maintainer Summit North America 2026 CFP closes on July 19. Submit a session proposal before the deadline.

Release Schedule

Next Deadline: Docs placeholders, July 2

If you are responsible for an enhancement that requires documentation, make sure your placeholder documentation PR is opened by July 2. If your enhancement doesn't require documentation, make sure to mark it No Docs Needed on the Enhancements Tracking Board.

Cherry-picks for the July patch releases are due July 10, with releases targeted for July 14.

Featured PRs

139956: Graduate SELinuxMount to GA

In this pull request jsafrane advanced SELinuxMount to General Availability, completing the feature’s journey to stable Kubernetes storage behavior as part of KEP-1710. SELinuxMount allows Kubernetes to mount volumes with the appropriate SELinux context instead of relying only on recursive relabeling of files on the volume, which can be slow and expensive for large volumes or high-density nodes. Reaching GA means the feature is now considered production-ready for SELinux-enforcing environments, where it can improve both pod startup performance and operational predictability.

139632: KEP-4222: Support CBOR encoding for non-resource endpoints

In this pull request benluddy added support for CBOR encoding on Kubernetes non-resource endpoints as part of KEP-4222. While Kubernetes already supports multiple content types for API resources, this work extends encoding support to endpoints outside the standard resource CRUD paths, improving consistency in how the API server can serialize responses. Because it touches API machinery and request/response handling in the control plane, this PR is notable beyond a single feature area and may influence downstream clients, proxies, and ecosystem tooling that interact with those endpoints.

KEP of the Week

KEP-5532: Restart All Containers on Container Exits

This KEP extends the container restart rules introduced in KEP-5307 by allowing a container's exit to trigger an in-place restart of the entire pod. Instead of recreating the pod, Kubernetes restarts all containers—including init and sidecar containers—while preserving the pod's sandbox, UID, network namespace, IP address, and attached devices. This approach is more efficient for workloads such as AI/ML training, where recreating and rescheduling pods is expensive. It also ensures init containers are re-executed, providing a clean and correctly initialized environment after a restart. Additionally, it supports workflows where init containers prepare or fetch new work items before the main application runs again.

This KEP is currently graduated to Alpha in Kubernetes v1.35.

Other Merges

• Fixes a dbus connection leak in the kubelet node shutdown manager that could exhaust threads on long-running nodes.
• kubelet: reuses the previous context in startPodSync to fix a memory leak regression introduced when each pod sync allocated a new context.
• Fixes the CronJob controller's rate-limiter backoff counter not being cleared on the (nil, nil) sync path, leaving stale backoff state across sync iterations.
• kubelet only emits FailedToRetrieveImagePullSecret events when an image pull actually fails, eliminating spurious warnings for pods that pull cleanly with missing optional pull secrets.
• The scheduler includes resourceVersion in Pod status patches, preventing lost updates when concurrent components race to patch the same Pod.
• Validation rejects a zero step in ResourceSlice validRange, preventing DRA drivers from advertising malformed numeric ranges.
• Clarifies the kubelet error message when a probe references a named port that cannot be resolved in the container spec.
• The Binding API now validates the target node name, rejecting requests with empty or malformed node names at admission.
• kubelet/DRA: derives claim names from the claim info cache rather than from runtime arguments, improving consistency for DRA driver lookups.
• kubelet depends on github.com/google/cadvisor/lib, a slimmer cadvisor subpackage that reduces the kubelet's overall dependency footprint.
• client-go defers metrics registration to the runtime entry point via constructor functions, eliminating implicit init-time global state for downstream consumers.
• Adds Windows CPU affinity tests to the e2e_node_windows suite, continuing the Windows node-level test coverage build-out.
• Declarative validation: an ObjectMeta test suite has been wired across the core, apps, networking, storage, and scheduling API groups, extending DV coverage uniformly across the API surface (companion PR).
• HPA's CrossVersionObjectReference.Kind and .Name fields have been migrated to declarative validation.
• The Authorization API group has been onboarded to declarative validation.

Subprojects_and_Dependency_Updates

• cluster-api v1.14.0-alpha.0: 7 breaking changes, 13 new features, 12 bug fixes

Shoutouts

• No shoutouts this week. Want to thank someone for special efforts to improve Kubernetes? Tag them in the #shoutouts channel.