LWKD: Week Ending September 14, 2025
Week Ending September 14, 2025
Developer News
The Steering Committee Election is underway. Please make sure to vote before October 25th, and request an exception if you need one before October 20th.
The Kubernetes Steering Committee reaffirmed that SIG Release and the Release Team have full authority to enforce policies, deadlines, and requirements, including blocking releases if needed. Steering does not override release execution but will back policy updates and clearer communication to ensure safe, stable, and predictable releases.
A medium-severity vulnerability (CVE-2025-9708) affects the Kubernetes C# client ≤ v17.0.13, where improper certificate validation could enable man-in-the-middle attacks. Users are advised to upgrade to v17.0.14+ and review any custom CA usage in kubeconfig files. See the GitHub issue. for more details.
Release Schedule
Next Deadline: 1.35 Release Cycle Starts, September 15
Kubernetes 1.35 release cycle kicks off on Sept 15, targeting final release on Dec 17, 2025, with key milestones including Enhancements Freeze on Oct 16 and Code Freeze on Nov 6.
Patch releases v1.34.1, v1.33.5, v1.32.9, v1.31.13 were out last week, delivering the latest fix and updates.
KEP of the Week
KEP-3243: Respect PodTopologySpread after rolling upgrades
This KEP introduces a complementary field, MatchLabelKeys, in TopologySpreadConstraint to enhance pod topology spread. It allows users to specify only label keys, with kube-apiserver resolving their values from the incoming pod and merging them with the existing LabelSelector to identify the target pod group. This simplifies skew calculation, supports revision-level spreading during Deployment rollouts, and is also handled by kube-scheduler when used in cluster-level default constraints.
This KEP is tracked for beta in v1.34.
Other Merges
- Remove container name from container event messages
- Replace NewIndexerInformerWatcher with NewIndexerInformerWatcherWithLogger
- Standardize not found error message of
kubectl scale - validation-gen uses JSON names for error paths
- Prevent ClusterIP load balancer loss with InternalTrafficPolicy: Local in kube-proxy
- Avoid deadlock when gRPC connection to driver goes idle
validation-genadds uuid format for string fields- client-go/cli-runtime fixes config override when ClientKey/ClientCertificate are set
- Replace WaitForNamedCacheSync with WaitForNamedCacheSyncWithContext
- Update PodObservedGenerationTracking description in OpenAPI
- kubectl includes container fieldPath in event messages
- StorageVersionMigrator adds discovery check to avoid stuck migrations
- agnhost adds fake-registry-server for e2e image-pull tests
- Add E2e test for cleaning of terminated containers
- kube-apiserver protects against delete/finalizer race
- Update pod resize test to accept new cpu.weight conversion
- DRA accepts implicit device-class extended resource names even when extendedResourceName is set in the DeviceClass
- Skip creating storage for non-stored and non-served versions
- Allow OpenAPI model package names to be declared by APIs
- kubelet fixes negative pod startup duration values
- kube-scheduler statusz lists registered paths
- applyconfiguration-gen preserves struct and field comments in generated code
- Scheduler framework interfaces move to k8s.io/kube-scheduler
- CRD validation ratchets the max selectableFields limit
- apiserver storage only accesses keys under resourcePrefix
- apiserver storage replace SetKeysFunc with EnableResourceSizeEstimation
Subprojects and Dependency Updates
- grpc v1.75.0 introduces Spiffe verification, OTel C++ retry metrics, bug fixes, and Python and Ruby updates
- nerdctl v2.1.4 adds manifest, export, import commands, improves networking, and drops containerd 1.6 support
- vertical-pod-autoscaler v1.4.2 improves logging, fixes updater metrics, adjusts webhook CA, and falls back to eviction on failed updates