Week Ending September 13, 2026

Developer News

Dims has proposed building kubelet as a static binary (CGO_ENABLED=0) to remove the last remaining CGO dependency in Kubernetes binaries; discussion has surfaced concerns about DNS resolution changes, glibc/NSS behavior differences, and userns account lookup.

Kahiro Okina (@kahirokunn) has been appointed as a SIG UI Lead following a lazy consensus period; Kahiro has been contributing to Headlamp on multi-cluster UI, plugin ecosystem work, and mentoring.

SIG Node has added security-profiles-merger as a subproject.

SIG Instrumentation have added kubernetes-mixin as a subproject.

The AI Conformance program now supports hybrid verification starting with v1.37, letting vendors submit automated test results alongside documentation evidence; Kubernetes releases prior to v1.34 can no longer be certified.

Agent Sandbox v1.0 has been released, consolidating on v1beta1 APIs, adding a Go sandbox-router for browser-based interactive sessions, and adding a TypeScript SDK alongside existing Go and Python SDKs.

Election Update

The Steering Committee election voting will remain open through October 1, with exception requests due by September 29. If you are marked as not eligible despite your contributions, please request an exception.

Release Schedule

Next Deadline: KEP Readiness Deadline, September 22, 2026 (AoE) / September 23, 2026 at 12:00 UTC

The Kubernetes v1.38 release cycle is underway. The schedule has been finalized and you can find the full timeline here. Enhancements targeted for this cycle are expected to be opted in for the release by the KEP Readiness Deadline. Enhancements that miss it would require an exception. KEP authors should have their PRs to the kubernetes/enhancements repo opened by the KEP Readiness Deadline on September 22nd. The Enhancements Freeze is scheduled for September 29 (AoE) / September 30 at 12:00 UTC. Please reach out in the #sig-release channel in Slack if you have any questions!

Featured PRs

142121: kubelet: add memoryManagerPolicyOptions with memory-drift-tolerance (KEP-6232)

AI-Armless added the memoryManagerPolicyOptions configuration and memory-drift-tolerance setting described in KEP-6232. The tolerance allows the Memory Manager to account for small differences between expected and observed memory assignments instead of treating every drift as an allocation failure. This gives operators more control over memory-management behavior on nodes using the Memory Manager while preserving strict accounting when required.

142108: update podcertificaterequest and podcertificateprojection to allow setting ML-DSA algorithms

everraven extended Pod certificate request and projection APIs to support selecting ML-DSA signature algorithms. This allows workloads to request certificates using post-quantum-capable cryptographic algorithms and makes the selected algorithm available through the Pod certificate flow. The change affects certificate request APIs, kubelet projection behavior, and authentication-related integrations as Kubernetes evolves its support for post-quantum cryptography.

142074: [KEP-2172] warn about implicitly insecure container UIDs/GIDs

Priyankasaggu11929 implemented the warning described in KEP-2172. Kubernetes now provides visibility when container UID/GID settings may result in an implicitly insecure configuration instead of leaving users to discover the risk through runtime behavior or external security checks. This helps operators identify potentially unsafe workload configuration earlier and improves the security guidance available during Pod setup.

142071: kube-apiserver: add watch-cache-max-average-object-size flag and byte budget bypass

wdoekes added kube-apiserver controls for limiting the average object size stored in the watch cache and introduced a byte-budget bypass for objects that exceed the configured limit. These controls give cluster operators more visibility and control over watch-cache memory usage, especially for resource types containing large objects. The change affects API-server cache behavior and can help prevent unusually large objects from consuming a disproportionate share of watch-cache capacity.

KEP of the Week

KEP-6249: Publish Graceful Node Shutdown state for DaemonSet coordination

When a node enters Graceful Node Shutdown, kubelet knows that it is terminating Pods but the control plane does not. The DaemonSet controller can therefore see a missing DaemonSet Pod, create a replacement, and have kubelet reject it because the node is shutting down, causing repeated create and reject churn. This KEP makes the shutdown state visible on the Node object through the conditions introduced by KEP-5683.

The proposal has kubelet publish GracefulNodeShutdownInProgress=True and DrainInProgress=True before terminating Pods. The DaemonSet controller suppresses new Pod creation while both conditions are true, while the Node Lifecycle Controller clears lingering conditions if kubelet is lost. This follows the approach discussed for kubernetes/kubernetes#122912, avoids introducing new API types or condition constants, and helps operators distinguish intentional node shutdown from a broken DaemonSet rollout.

danbruno101 is developing the proposal with SIG Node and SIG Apps. The KEP was reviewed in WG Node Lifecycle meetings on August 10, 17, and 24, and its current PR is seeking SIG Node review and Production Readiness Review ownership.

KEP 6249 is targeting Alpha in Kubernetes v1.38 behind the DaemonSetGracefulNodeShutdown feature gate.

Other Merges

• iSCSI: fixes a bug where detaching a block-mode iSCSI volume could fail permanently when the /dev/disk/by-path symlink was already gone (e.g: after an iSCSI session was lost before teardown), leaving the volume stuck in node.status.volumesInUse and blocking attach on other nodes.
• kubectl: prevents kuberc defaults from matching unrelated commands, fixing a bug where kuberc-configured flag defaults could be applied to commands they were not intended for.
• scheduler: calls Done before requeuing a pod in AddUnschedulablePodIfNotPresent, fixing a bug in the scheduling queue lifecycle.
• Fixes a default-preemption error when using filter extenders.
• kubectl: handles equal missing sort values, fixing a bug in kubectl get --sort-by output when multiple items have equal or missing sort keys.
• HPA: caps replica count calculations at max int32, preventing overflow in HorizontalPodAutoscaler replica computations.
• Storage: removes an optimistic MountedByNode default in AddVolumeNode, correcting a case where the field could be reported as mounted before mount was confirmed.
• CPU Manager: fixes re-allocations for pods using pod-level resources after kubelet restarts.
• scheduler: adds validation for child pod groups to require matching priority and preemptionPolicy.

Promotions

• volume_operation_total_errors metric to Beta.

Deprecated

• apidiscovery.k8s.io/v2beta1 removed; use apidiscovery.k8s.io/v2 instead.

Subprojects and Dependency Updates

• cluster-api v1.14.2: add --tls-curve-preferences flag, fix KCP deleting learners after Node registration, fix KCP rollout issue after upgrade from CAPI v1.11; also v1.13.6
• prometheus v3.13.3: fix GO-2026-5841, GO-2026-6303, fix out-of-order queries blocking compaction for hours, fix deleted series causing missing samples after restart

Shoutouts

• No shoutouts this week. Want to thank someone for special efforts to improve Kubernetes? Tag them in the #shoutouts channel.