Week Ending October 18, 2026

Developer News

WG Workload Conformance has been formed; the new working group is chartered under SIG Apps and SIG Architecture to define workload-level conformance signals, with a Slack channel and SIG diagram update already in place.

WG Node Identity held its first meeting on October 14 and has published its meeting schedule and OWNERS.

SIG Scheduling has proposed leadership changes: Heba Elayoty would join as Chair and Matt Matejczyk as Tech Lead; Kensei Nakada would step down as Chair while remaining a Tech Lead. The changes take effect after lazy consensus on October 26.

SIG Cluster Lifecycle has a tech lead transition: Fabrizio Pandini steps down from the Tech Lead role, with Ciprian Hacman and Stefan Bueringer stepping in.

SIG Testing has added ktesting as a subproject.

SIG CLI has updated the kubectl conventions document, tightening guidance on flag naming, output formatting, and command structure for new kubectl contributions.

SIG ContribEx has updated the Slack guidelines around #announcements and job listings to clarify moderated submissions to #announcements and the requirements for job and resume submissions to #kubernetes-careers.

The Kubernetes contributor site now supports dark mode; kubernetes.dev follows your system theme by default, adds a light/dark toggle to the navbar.

Release Schedule

Next Deadline: Docs: Open placeholder PRs, October 29

The v1.38 timeline schedules alpha.3 for October 21. Contributors whose enhancements need documentation should open placeholder PRs against dev-1.38 by October 29.

November patch releases are targeted for November 10, with cherry-pick PRs due November 6.

Featured PRs

143188: [WAS] KEP-5547: Promote Job Scheduling feature gate to Beta

helayoty promoted the WorkloadWithJob feature gate to Beta as part of KEP-5547. This integrates Workload-aware Scheduling (WAS) APIs into the Kubernetes Job controller, allowing Jobs to express scheduling intent through spec.scheduling⁠, including gang scheduling and topology constraints. The controller translates this configuration into Workload and PodGroup objects, enabling related Pods to be scheduled according to the workload's requirements. The feature remains disabled by default in this promotion, giving clusters control over when to enable the integration.

143160: KEP-5793: Add staticOrder to control mutating webhook merge order

aramase added the staticOrder field to WebhookAdmissionConfiguration as part of KEP-5793. Previously, manifest-based mutating admission webhooks always ran before webhooks registered through the API, so migrating a webhook to a manifest could change the order in which mutations were applied. The new configuration supports three ordering modes: StaticFirst to preserve the existing behavior, StaticLast to run manifest-based webhooks afterward, and ByName to sort both sets together by configuration name. This gives cluster administrators more control over admission ordering when using manifest-based admission control, while caching the merged webhook list avoids adding per-request processing overhead.

KEP of the Week

KEP-5502: EmptyDir Volume Permission Mode

KEP-5502 adds an optional mode field to EmptyDirVolumeSource, allowing permissions such as 0750 or the sticky bit (01777) without an init container running chmod. With EmptyDirVolumeMode enabled, kubelet applies the requested mode when creating the directory; omitting it preserves 0777. Values must be between 0000 and 01777. The field has no effect on Windows, and fsGroup can modify the resulting permissions.

Nispriha Jagan and Neeraj Krishna Gopalakrishna authored the KEP for SIG Storage with SIG Node, building on a 2022 request for sticky-bit support. The KEP merged in June, and its Alpha implementation is merged for v1.37. The Beta KEP update merged October 5 and targets Beta in v1.38; the KEP's status remains implementable.

Other Merges

• Go API objects no longer provides direct access to the Raw byte slice in ObjectMeta.ManagedFields[*].FieldsV1
• kube-apiserver: support the ShardedListAndWatch feature for custom resources and dynamic clients that use Unstructured objects
• Job controller: job_pods_creation_total no longer counts a failed pod creation as both succeeded and failed
• Job status.ready no longer decreases when deleting a Ready pod fails
• Fixed differences between continue token generated by cacher and etcd3
• Fixed deployment rollouts failing to report timeouts after old ReplicaSet scale-down errors
• The KUBECTL_REMOTE_COMMAND_WEBSOCKETS and KUBECTL_PORT_FORWARD_WEBSOCKETS environment variables are removed; the features are GA
• Increased PodGroup priority validation to highest possible value that can be set
• kubeadm: use a custom fake client for dry-running and reduce the kubeadm binary size by 20%
• PodGroup preemption now clears status.nominatedNodeName for lower-priority Pods nominated to the nodes selected for the PodGroup
• kubelet: FileKeyRef now honors optional: true when the env file does not exist, and publishes a key with an empty value instead of reporting it as missing
• kuberc set: add validation for credential plugin allowlist paths
• kube-proxy configuration validation errors now identify public configuration field paths rather than internal Go type and field names
• Corrected the StatefulSet maxUnavailable API documentation: percentage values are rounded down to a minimum of 1, not rounded up
• Kubelet now honors serverCertificateKeyAlgorithm when generating its self-signed serving certificate
• kubectl create ingress now rejects a --default-backend with an empty service name or port, and an --annotation with an empty key
• kubectl describe pod now lists environment variables that are sourced from a file (valueFrom.fileKeyRef)
• Fixed volume binding (scheduler CSI storage capacity) comparing storage sizes via overflowing int64 values
• Added support to CompositePodGroup to preemption metrics
• The StatefulSet controller now requires canonical Pod names of the form <statefulset-name>-<ordinal>, without leading zeros in the ordinal, when checking membership
• Promoted apiserver_resource_size_estimate_bytes to BETA
• Added the OpenAPIV2LazyBuild feature gate (beta, enabled by default)
• Allow immediate volume detach when node is deleted

Version Updates

• golangci-lint to v2.15.0

Subprojects and Dependency Updates

• containerd v2.4.2: Fixes CVE-2026-95839, hardens container log file handling against symlink following, and fixes excessive memory usage during image pulls; also v2.3.7, v2.2.10, v2.0.14
• vsphere-csi-driver v3.7.4: Upgrades Go toolchain to 1.26.6 and bumps grpc, etcd client, and OpenTelemetry dependencies to fix CVE security vulnerabilities

Shoutouts

• Christopher Tineo (@TineoC): Kudos to Destiny Erhabor (@caesarsage), Tim Bannister (@LMKTFY), and Madhur Chandran (@Madhur Chandran) for bringing dark mode to the contributor site!