Weekly GitHub Report for Kubernetes

Thank you for subscribing to our weekly newsletter! Each week, we deliver a comprehensive summary of your GitHub project's latest activity right to your inbox, including an overview of your project's issues, pull requests, contributors, and commit activity.

Table of Contents

• I. News
  • 1.1. Recent Version Releases
  • 1.2. Other Noteworthy Updates
• II. Issues
  • 2.1. Top 5 Active Issues
  • 2.2. Top 5 Stale Issues
  • 2.3. Open Issues
  • 2.4. Closed Issues
  • 2.5. Issue Discussion Insights

• III. Pull Requests
  • 3.1. Open Pull Requests
  • 3.2. Closed Pull Requests
  • 3.3. Pull Request Discussion Insights

• IV. Contributors
  • 4.1. Contributors

I. News

1.1 Recent Version Releases:

The current version of this repository is v1.32.3

1.2 Version Information:

The Kubernetes version released on March 11, 2025, introduces key updates detailed in the official CHANGELOG, with additional binary downloads available. For comprehensive information on new features and changes, users are encouraged to refer to the Kubernetes announce forum and the linked CHANGELOG.

II. Issues

2.1 Top 5 Active Issues:

We consider active issues to be issues that that have been commented on most frequently within the last week. Bot comments are omitted.

1. [KIND/BUG] [KIND/CLEANUP] [SIG/API-MACHINERY] [TRIAGE/ACCEPTED] Burndown: Quantity int64 overflow and checked accessors: This issue tracks the ongoing work to fix overflow and correctness problems in the resource.Quantity int64 accessor functions, aiming to introduce new accessor signatures that return both a value and an overflow boolean to safely detect and cap overflows at int64 boundaries. It also includes a comprehensive test matrix to cover known edge cases and plans to refactor existing accessors to wrap the new checked accessors, ensuring consistent behavior across different backends and rounding semantics.

   • The comments focus on coordinating ownership of subtasks, agreeing on the sequencing of test coverage before major changes, discussing validation logic improvements by switching to sign-based checks, clarifying accessor API signatures and overflow semantics, and cataloging edge cases including int-negation bugs; multiple contributors offer detailed analysis, propose PRs for tests and fixes, and confirm readiness to proceed once coverage and API contracts are settled.
   • Number of comments this week: 17

2. [SIG/API-MACHINERY] [KIND/FEATURE] [SIG/ARCHITECTURE] [NEEDS-TRIAGE] [Feature request] Single API endpoint for feature gates values: This issue proposes the creation of a single Kubernetes API endpoint that would allow users to retrieve feature gate values from all Kubernetes components across all reachable nodes, aiming to simplify feature gate management and visibility. The discussion highlights the complexity of implementing such a feature, including the need for awareness of running components and the potential use of a controller to scrape feature gate data, as well as the necessity of a Kubernetes Enhancement Proposal (KEP) and SIG sponsorship to move forward.

   • Commenters generally agree on the usefulness of the feature but note significant challenges, such as the lack of an existing API to identify running components and the complexity of aggregating feature gate data. They suggest that a KEP is required and discuss related ongoing efforts like the ComponentFlagz endpoint, with some proposing a controller-based approach to collect and expose feature gate information rather than a single unified endpoint.
   • Number of comments this week: 12

3. [KIND/FLAKE] [SIG/INSTRUMENTATION] [NEEDS-TRIAGE] [Flaking Test] ci-kubernetes-integration-arm64-master:[sig-instrumentation] k8s.io/kubernetes/test/integration.events: This issue reports a flaking test failure in the Kubernetes integration test suite, specifically in the TestEventCompatibility test under the sig-instrumentation area, where the test times out waiting for two events to be recorded. The failure has been occurring intermittently since April 2026 but has increased in frequency since late June, and investigation reveals it is an architecture-independent timing issue caused by transient write delays during API server startup rather than a regression or ARM64-specific problem.

   • The comments discuss the initial report and tracking of the flake, followed by detailed diagnostic analysis showing the failure is not ARM64-specific but a general timing fragility due to slow event writes under load; suggestions include increasing test timeouts and adjusting retry intervals, with agreement to implement these changes after further verification to avoid masking the underlying issue.
   • Number of comments this week: 7

4. [SIG/SCHEDULING] [SIG/NODE] [NEEDS-TRIAGE] [KEP-3521]: Integrate well with out-of-tree resource quota solutions: This issue addresses a conflict between the Pod Scheduling Readiness feature, which enables external quota management by gating pod scheduling, and the In-place Update of Pod Resources feature, which allows pods to be resized without rescheduling. The problem is that in-place resizing can bypass external quota controls by allowing resource increases after scheduling, breaking the assumptions of out-of-tree quota solutions and undermining their ability to enforce resource limits effectively.

   • The comments discuss clarifications about the problem, acknowledge similar issues faced by other projects, and explore potential solutions including introducing a "resize gate" to extend gating semantics to pod resizes. Participants also highlight the need for a generic, extensible quota API to unify quota enforcement across in-tree and out-of-tree solutions, while recognizing that current workarounds like admission restrictions are imperfect and that further design and collaboration are needed to reconcile these features.
   • Number of comments this week: 4

5. [KIND/BUG] [SIG/STORAGE] [NEEDS-TRIAGE] volumeattachment could not be cleanup while controller-manager restart after volumeattachment created because of csidriver created delay: This issue describes a problem where volumeattachments (VA) are not properly cleaned up after the controller-manager restarts due to a delay in the creation of the csidriver, which causes the VA to be ignored if the csidriver is marked as not attach-required. The expected behavior is that the attachdetach controller should process and clean up all volumeattachments regardless of the attach-required status of the csidriver to prevent VA object leaks.

   • The comments clarify that the issue does not cause functional failures but results in residual volumeattachment objects leaking, and a fix has been proposed to address the VA consistency check failure.
   • Number of comments this week: 4

2.2 Top 5 Stale Issues:

We consider stale issues to be issues that has had no activity within the last 30 days. The team should work together to get these issues resolved and closed as soon as possible.

As of our latest update, there are no stale issues for the project this week.

2.3 Open Issues

This section lists, groups, and then summarizes issues that were created within the last week in the repository.

Issues Opened This Week: 41

Summarized Issues:

• VolumeAttachment Cleanup Issues: VolumeAttachments are not properly cleaned up after controller-manager restarts due to delays in csidriver creation, causing volumeattachments with non-attach-required csidrivers to be ignored and leaked. This leads to resource leaks and potential inconsistencies in volume attachment state management.
  • issues/141151

• API Server Validation and Security Exposure: The Kubernetes API Server's validation error message for out-of-bounds Service clusterIP requests exposes the full internal ClusterIP CIDR range to users with limited permissions, potentially revealing sensitive cluster network topology. This unintended information disclosure poses a security risk by leaking internal network details.
  • issues/141152

• Server-Side Apply and ManagedFields Extraction Failures: The managedfields.ExtractInto function fails with an error when the field manager owns only absent fields, such as a Secret with stringData, causing extraction to fail instead of returning an empty configuration. This results in permanent reconcile errors in controllers using server-side apply drift detection.
  • issues/141153

• Probe Behavior and Container Status Inconsistencies: After a container restarts due to a failing liveness probe, the container status incorrectly shows as started=true and liveness probes begin before startup probes complete, violating expected Kubernetes probe sequencing. This causes inaccurate container health reporting and potential premature restarts.
  • issues/141155

• Feature Gate Visibility and Management: A proposal exists to create a single Kubernetes API endpoint to retrieve feature gate values from all components across nodes, improving cluster-wide feature gate visibility and management. This would simplify monitoring and configuration of feature gates in distributed environments.
  • issues/141162

• Resource.Quantity int64 Overflow Handling: Ongoing work addresses int64 overflow issues in the resource.Quantity type by adding checked accessors that detect overflow and saturate values, fixing multiple edge cases and parsing inconsistencies. This improves correctness and robustness of resource quantity handling in Kubernetes.
  • issues/141166

• Integration Test Flakiness Due to Environment and Timing: Several integration tests intermittently fail due to resource contention, timing issues, and race conditions during server startup or event writes, causing timeouts and connection errors without underlying code regressions. These flakes affect test reliability across architectures and test suites.
  • issues/141178, issues/141180

• E2E Job Timeout and Teardown Failures: The ci-kubernetes-e2e-gci-gce-alpha-features job experiences intermittent failures caused by kubetest lifecycle steps hitting a tight 120-minute timeout, interrupting teardown and causing cascading errors despite successful test runs. This timeout constraint leads to false failure signals in CI pipelines.
  • issues/141186

• Watch Cache Size Oscillation Under Load: During load testing, the watch cache size rapidly shrinks before scaling back up under bursty traffic, causing terminated watch connections and inefficient cache resizing. Introducing hysteresis is suggested to prevent this oscillation and improve cache stability.
  • issues/141192

• NetworkPolicy Named Ports Security Risks: Use of named ports in Kubernetes NetworkPolicies allows users to exploit named port mappings via self-service APIs to bypass platform team controls, permitting unintended network traffic without approval or audit. This creates a security risk by undermining network policy enforcement.
  • issues/141193

• CPU Manager Static Policy and CPUSet Allocation Bugs: The static CPU Manager policy with strict CPU reservation can consume all non-reserved CPUs, leaving the default CPUSet empty and causing shared containers to lose CPU affinity. Additionally, CPU allocation across multiple sockets violates socket affinity expectations when align-by-socket is enabled, leading to kubelet restart failures and invalid CPU Manager state.
  • issues/141196, issues/141237

• Cloud Load-Balancer Connectivity Flakes During Deployment: The Deployment process intermittently disrupts connectivity to cloud load-balancers on AWS, Azure, and GCE during rollout, causing HTTP service reachability failures. This flake affects reliability of service availability during updates.
  • issues/141198

• GPU Device Plugin Sanity Test Flakiness: The GPU device plugin sanity test flakes due to nvidia-smi container startup failures caused by image pull errors on AWS and GCE providers, leading to test timeouts. This impacts GPU plugin validation in cloud environments.
  • issues/141200

• Kubelet Allocation Manager Disk Checkpointing Errors: Non-transactional error handling during disk checkpointing in the kubelet's allocation manager causes state desynchronization, leading to node resource overcommitment and persistent ghost pod allocations that block proper pod admission. This undermines resource accounting accuracy.
  • issues/141206

• Pod Ordering Non-Determinism on Creation Time: Pods with identical creation times are non-deterministically ordered by PodsByCreationTime, causing unpredictable behavior during kubelet restarts and resource allocation decisions. This affects scheduling consistency and stability.
  • issues/141210

• ResourceSlice NodeSelector Validation Bugs: The per-device nodeSelector in ResourceSlice can contain multiple terms, passing API validation incorrectly but causing scheduler hard errors and aborted scheduling cycles. Malformed nodeSelector terms cause allocator failures instead of graceful node marking, and negative consumesCounters values lead to over-commitment of shared counters.
  • issues/141212, issues/141214, issues/141216

• Watch Cache Sizes Flag Documentation Discrepancy: The --watch-cache-sizes flag affects custom resources served by apiextensions-apiserver contrary to documentation stating no effect, leading to debate on updating docs or reverting code to original intent. This inconsistency causes confusion about cache size configuration.
  • issues/141217

• Kube-apiserver Startup Race Condition in Nodeport Repair: The nodeport repair controller's PostStartHook does not retry Services LIST when the watch cache is initializing, causing kube-apiserver to repeatedly exit on clusters with large Services due to a race condition and insufficient retry logic. This affects apiserver stability during startup.
  • issues/141220

• Controller Manager Informer Startup Optimization Proposal: It is proposed that the Kubernetes Controller Manager start its informer to synchronize data before acquiring a lease, enabling faster scheduling and quicker recovery in fault scenarios. This change aims to improve responsiveness during controller startup.
  • issues/141221

• Pod Preemption Victim Selection Flaws: The scheduler uses only pod age to select preemption victims, ignoring whether evicted pods' replacements can reschedule, causing DaemonSet pods to be evicted and replaced by pods stuck in Pending state. This leads to unrecoverable scheduling failures and resource wastage.
  • issues/141227

• Patch-Version Skew Support Clarification Request: Clarification is sought on whether running Kubernetes control-plane components at different patch versions within the same minor release is supported, including risks and documentation coverage. This addresses operational concerns about version skew.
  • issues/141240

• PodRequests and PodLimits Mutate Pod Objects: The PodRequests and PodLimits functions mutate the Pod object when fractional BinarySI quantities are set, causing cumulative unintended modifications and violating read-only expectations. This bug leads to incorrect resource request calculations.
  • issues/141241

• Dynamic Resource Allocation Client Watch Stop Bug: A break statement inside a select block does not exit the enclosing loop as intended, causing the Dynamic Resource Allocation client's run method to never return after Stop() is called. This prevents proper watch stopping and channel closure.
  • issues/141243

• fields.Selector.String() Non-Idempotency: The fields.Selector.String() method is not idempotent because re-parsing and serializing selector strings reorder terms, producing different outputs and breaking fixed-point expectations. This affects selector consistency and caching.
  • issues/141245

• LimitRange Admission Plugin Hugepages Enforcement Bug: The LimitRange admission plugin does not enforce maximum hugepages resource limits at the pod level, allowing pods to exceed configured maximums despite intended constraints. This undermines resource quota enforcement.
  • issues/141247

• resource.Quantity Serialization Data Corruption: Serializing resource.Quantity values of 10^21 or more silently drops the scale suffix, causing large quantities to be serialized as much smaller values and leading to silent data corruption in API objects.
  • issues/141249

• StatefulSet Update Test Flake Due to Feature Gate Cache Lag: The TestRecreateStatefulSetUpdate test flakes because the StaleControllerConsistencyStatefulSet feature gate's consistency check blocks reconcile when informer cache lags behind controller writes, causing timeouts in resource-constrained CI environments.
  • issues/141250

• CPU Manager Static Policy Metrics Drift: CPU Manager static policy metrics for exclusive CPU allocations drift from actual allocation state due to double counting, partial failure leaks, ignored pod-level CPU sets, and persistent non-zero NUMA node values. This causes inaccurate metric reporting.
  • issues/141262

• Core Validation Error Field Path Mismatches: Several hand-written core validation error messages report incorrect field paths that do not match JSON field names, causing clients to misinterpret the location of offending fields. This reduces error message clarity and debugging effectiveness.
  • issues/141267

• Controller Sync Loop Race Condition Investigation: A potential race condition in a controller's sync loop during sudden API server latency spikes is under investigation to ensure sync loop consistency and reliability. This aims to prevent inconsistent controller state under load.
  • issues/141269

• ResourceClaim Controller Terminal Pod Reservation Bug: The ResourceClaim controller incorrectly re-reserves terminal Pods in status.reservedFor, causing oscillation and repeated status updates when terminal Pods still reference static claims shared by others. Excluding terminal Pods from reservation work is proposed to fix this.
  • issues/141274

• Client-Go Publishing Bot Deadlock in Tests: A deadlock occurs in client-go publishing bot tests due to FakeControllerSource's Shutdown method holding a write lock indefinitely, causing stuck reflectors during test cleanup when panics skip waiting. Proposed fixes include canceling and joining reflectors during panic cleanup and returning errors after shutdown.
  • issues/141277

• Feature Gate Compatibility Versions Test Failure: The compatibility-versions-feature-gate-test fails persistently because the validator ignores the MinCompatibilityVersion field, causing mismatches between expected and actual feature gate values after the 1.37 release.
  • issues/141283

• Kube-apiserver Startup Timeout on s390x Architecture: The embedded kube-apiserver startup times out due to a hardcoded 10-second readiness deadline, causing flakiness in authentication tests on s390x architecture in the integration-master test suite.
  • issues/141284

• MemoryQoS Conformance Coverage Proposal: A proposal to add comprehensive conformance coverage to MemoryQoS includes implementing helpers and node-e2e tests that verify runtime cgroup v2 control states against configured MemoryQoS settings, ensuring validation beyond configuration correctness.
  • issues/141286

• Device-Taint Eviction Controller Fails for DRA Claims: The device-taint eviction controller fails to evict pods using devices via DRA-backed extended-resource claims in pod.Status.ExtendedResourceClaimStatus, allowing pods to remain running despite NoExecute device taints. This breaks device-level eviction and maintenance workflows in Kubernetes 1.36+.
  • issues/141290

• Security Placeholder Issue Requiring Triage: A placeholder security-related issue in the Kubernetes project requires triage by the security response committee to determine appropriate handling and resolution.
  • issues/141294

2.4 Closed Issues

This section lists, groups, and then summarizes issues that were closed within the last week in the repository. This section also links the associated pull requests if applicable.

Issues Closed This Week: 17

Summarized Issues:

• Flaky and failing tests in Kubernetes node and integration environments: Several issues report intermittent test failures affecting different Kubernetes components, including crictl tests on kOps clusters, POD Resources API tests under CPU manager Static policy, HugepageAwareMemoryReporting tests, and integration tests like TestDRA and StatefulSet Recreate Update Strategy. These flaky tests cause unreliable test results due to hardcoded paths, feature gate misbehavior, timeouts, and improper test waiting conditions, impacting test stability and reliability.
• issues/133915, issues/135374, issues/140644, issues/141059, issues/141072, issues/141288, issues/141173

• Kubelet and metrics labeling issues: The kubelet's use of CRI stats causes the /metrics/cadvisor endpoint to lack Kubernetes-level namespace, pod, and container labels, breaking monitoring setups that depend on these labels. Proposed solutions include resolving labels at scrape time or extending the CRI API to provide necessary metadata for accurate monitoring.
• issues/140778

• Security vulnerabilities in Kubernetes dependencies and components: Multiple critical security issues remain unpatched in Kubernetes components, including an unpatched CVE in golang.org/x/crypto affecting AKS container images, outdated CoreDNS versions with numerous CVEs, and an outdated etcd version containing many vulnerabilities including critical ones. These issues pose significant risks to cluster security and integrity, prompting urgent requests for patch releases and updates.
• issues/141202, issues/141229, issues/141230

• Privilege escalation vulnerability in Dynamic Resource Allocation: A security flaw allows non-admin users with permission to edit their own namespace metadata to escalate privileges by labeling their namespace with resource.kubernetes.io/admin-access: true, due to missing RBAC checks on the adminAccess capability. This vulnerability enables unauthorized admin-level device access, representing a critical security risk.
• issues/141293

• Documentation needs for Kubernetes cluster components and patterns: There is a need for improved onboarding and documentation, including a detailed guide for deployments in the kube-system namespace to assist new infrastructure team members and documentation of the sidecar container pattern for shipping application logs to external services. These efforts aim to enhance understanding and best practices within the Kubernetes community.
• issues/141259, issues/141270

• Storage version promotion and rollout history inconsistencies: Issues include the auto-calculated storage version defaults delaying resource promotion from alpha to beta versions, which conflicts with conventions, and the kubectl rollout history command showing incorrect image versions in the CHANGE-CAUSE annotation when the deprecated --record flag is omitted. These problems cause confusion and inconsistency in version tracking and resource management.
• issues/138292, issues/141263

• Liveness probe flakiness due to transient network or API-server timeouts: The probing restartable init container liveness probe intermittently fails on Windows nodes due to transient API-server or network connectivity timeouts, causing false restarts without clear code regressions. This flakiness affects stability and reliability of container health monitoring.
• issues/141073

2.5 Issue Discussion Insights

This section will analyze the tone and sentiment of discussions within this project's open and closed issues that occurred within the past week. It aims to identify potentially heated exchanges and to maintain a constructive project environment.

Based on our analysis, there are no instances of toxic discussions in the project's open or closed issues from the past week.

III. Pull Requests

3.1 Open Pull Requests

This section provides a summary of pull requests that were opened in the repository over the past week. The top three pull requests with the highest number of commits are highlighted as 'key' pull requests. Other pull requests are grouped based on similar characteristics for easier analysis. Up to 25 pull requests are displayed in this section, while any remaining pull requests beyond this limit are omitted for brevity.

Pull Requests Opened This Week: 78

Key Open Pull Requests

1. refactor horizontal_test.go: This pull request refactors the horizontal_test.go file by reorganizing and cleaning up various test cases related to horizontal pod autoscaling, including merging, removing redundant tests, and improving test clarity as part of the final major update to this test file.

• URL: pull/141154

• Associated Commits: e9aa3, b7bb9, 39019, bb273, c4658, c5711, 03a0f, 4ebd0, f71c6, 9a599, 5645a, b2d9e, 5d9d7, 3051b, 8ec84, a1ef4, 40121, 911ca, 131aa

2. apiserver: park and resume slow watch streams instead of terminating them (WatchCacheStallResume): This pull request introduces an alpha feature gate WatchCacheStallResume that changes the Kubernetes apiserver's behavior to park and later resume slow or stalled watch clients whose delivery buffers fill, instead of force-closing them, thereby preventing slow clients from blocking or terminating healthy watchers and enabling recovery from missed events by replaying from the watch cache history until events genuinely age out.

• URL: pull/141228

• Associated Commits: 95798, 179a0, f6e87, bf814

3. apiserver: drop hardcoded storage version overrides: This pull request removes hardcoded storage version overrides in the apiserver by relying on emulatedStorageVersion to select appropriate versions for pinned resources, fixes fallback behavior to ensure it only uses versions containing the kind, and updates registry tests to auto-calculate storage versions instead of using nil examples.

• URL: pull/141148

• Associated Commits: a6de3, b946a, e5809

Other Open Pull Requests

• Feature gate cleanup: This topic covers the removal of locked or expired feature gates and related code, including the locked general availability feature gates CustomResourceFieldSelectors and CRDValidationRatcheting, as well as the removal of the apidiscovery.k8s.io/v2beta1 API types and associated feature gate. These removals are part of cleanup efforts to simplify the codebase and remove deprecated or obsolete features.
  • pull/141207, pull/141208

• Resource quantity validation and serialization fixes: Multiple pull requests address bugs and improvements in resource quantity handling, including fixing negative resource quantity validation by using Sign() instead of Value(), adding bounds checks to reject decimal exponents outside the int32 range, and fixing serialization of large magnitude resource.Quantity values to use exponent notation. These changes prevent invalid resource values and ensure accurate parsing and serialization.
  • pull/141169, pull/141203, pull/141251

• Pod and container probe and resource handling fixes: This includes fixing a regression where startup probes were not properly gating liveness/readiness probes after container restarts, fixing pod-level hugepages resource limits enforcement in LimitRanger, and correcting pod-level resource quantity aliasing by introducing deep copies to prevent unintended mutations. These fixes improve pod lifecycle correctness and resource limit enforcement.
  • pull/141179, pull/141248, pull/141242

• Scheduling and gang scheduling improvements: Pull requests in this topic remove the Permit extension point from the GangScheduling plugin in favor of PlacementFeasible, improve scheduling logic by correctly populating UnschedulablePlugins for pod groups, unify error handling for PodGroups, and refactor related code for maintainability. These changes simplify scheduling flow and enhance error handling consistency.
  • pull/141182, pull/141253

• Watch and cache improvements: This topic includes fixing a bug in the dynamic resource allocation watch client by replacing a break with return to ensure proper cleanup, and refactoring the watch cache object matching logic to consolidate feature gate checks and simplify code. These changes improve reliability and maintainability of watch mechanisms.
  • pull/141244, pull/141279

• Metrics and monitoring enhancements: This includes adding new labels image and pull_policy to the kubelet_image_pull_duration_seconds histogram metric to help operators analyze image pull performance and policy impact. This enhancement provides better observability into image pull behavior across clusters.
  • pull/141205

• Testing and documentation updates: Pull requests here remove expired integration tests and associated support code, update documentation for the Quantity type to correctly reflect sub-milli suffixes and precision limits, and comment out erroneous documentation related to the k8s-ip format. These changes improve test relevance and documentation accuracy.
  • pull/141167, pull/141188, pull/141149

• Validation and selector fixes: This topic covers closing a validation gap by enforcing that the per-device nodeSelector in ResourceSlice must contain exactly one term, and fixing field selector parsing to ensure idempotent string output by sorting on canonical representations. These fixes prevent scheduling errors and infinite serialization loops.
  • pull/141213, pull/141246

• Controller and cleanup fixes: This includes fixing an issue where VolumeAttachment objects could not be cleaned up during controller-manager restarts due to delayed CSIDriver resource creation, improving CPUManager metrics accuracy by recomputing state instead of per-event deltas, and simplifying workqueue timer handling by removing placeholder channels and using After(). These fixes improve controller robustness and metric correctness.
  • pull/141158, pull/141159, pull/141261

• kubectl error handling fix: This pull request fixes a bug where errors from the PrintObj function in human-readable output and pruning were ignored, causing commands like kubectl get and kubectl apply --prune to exit successfully despite IO failures. The fix properly propagates these errors to ensure commands exit with a non-zero status on output failure.
  • pull/141147

• PodSpec validation migration: This pull request migrates the activeDeadlineSeconds field in PodSpec to use declarative validation tags as part of KEP-5073, replacing handwritten Go validation rules with declarative tags to improve validation consistency and safety, running the new validation in shadow mode since version 1.38.
  • pull/141157

• Pod condition analysis utility: This pull request introduces the PodConditionAnalyzer utility to the core/v1 API package, providing a clean API for analyzing pod conditions and status with common checks and summaries, along with comprehensive tests to improve pod status analysis efficiency.
  • pull/141282

3.2 Closed Pull Requests

This section provides a summary of pull requests that were closed in the repository over the past week. The top three pull requests with the highest number of commits are highlighted as 'key' pull requests. Other pull requests are grouped based on similar characteristics for easier analysis. Up to 25 pull requests are displayed in this section, while any remaining pull requests beyond this limit are omitted for brevity.

Pull Requests Closed This Week: 54

Key Closed Pull Requests

1. POC: Per watch event lifecycle tracking: This pull request introduces a set of new observability metrics and a rate-limited diagnostic log to track and decompose the lifecycle and latency of watch event delivery in the Kubernetes apiserver, enabling operators to detect, alert on, and triage watch slowness by measuring delays at various stages from cache ingestion to client event consumption without relying on verbose logging.

• URL: pull/138726

• Associated Commits: 9c2b1, 34f0a, 8f82f, acb92, 8d231

**2. Automated cherry pick of #139162: Fix case where preemptor may be stuck in unschedulable queue

139330: Unset WasFlushedFromUnschedulable for gated pods

139331: Make sure gated pods are flushed with the same frequency as non-gated:** This pull request is an automated cherry pick to the release-1.36 branch that fixes a bug where a preemptor pod could get stuck in the unschedulable queue by unsetting the WasFlushedFromUnschedulable flag for gated pods and ensuring gated pods are flushed with the same frequency as non-gated pods.

• URL: pull/140685

• Associated Commits: c9ffb, a3f52, 12d3d, 80ea0

3. Update github.com/google/cel-go to v0.30.0: This pull request updates the dependency github.com/google/cel-go from version v0.29.2 to v0.30.0, adjusts pinned values in CEL runtime cost stability tests to reflect a reduction in runtime costs due to cel-go v0.30.0’s change in evaluation behavior for error-handling in equality comparisons, and ensures compatibility with existing custom resource definitions by verifying that estimated costs do not increase.

• URL: pull/141058

• Associated Commits: bede6, ebb96, f6b34

Other Closed Pull Requests

• Go version updates and compatibility fixes: Several pull requests update Kubernetes release branches to use Go version 1.26.5, ensuring compatibility and stability across versions 1.34, 1.35, and general codebase improvements. These updates also include replacing deprecated io/ioutil package usage with modern io and os package functions to maintain compatibility with Go 1.16+ without changing any behavior.
• [pull/140919, pull/140920, pull/140551, pull/140235, pull/140236, pull/140237, pull/140238, pull/140551]

• Bug fixes in kubelet and resource management: Multiple pull requests address bugs in kubelet and resource allocation, including wiring context to syncPods to handle multiple stop signals correctly, fixing strict CPU reservation bugs in CPUManager, and resetting device lists in the Device Resource Allocator to prevent duplicate device IDs. These fixes improve pod lifecycle handling and device allocation reliability under various conditions.
• [pull/141040, pull/141234, pull/140955]

• End-to-end test improvements and cleanup: Several pull requests focus on cleaning up end-to-end tests by replacing anti-patterns like ExpectNoError and Expect(err).NotTo(HaveOccurred()) with more informative error messages that preserve context. Additionally, a fix adjusts hugepage reporting assertions to correctly distinguish feature gate states, improving test accuracy and maintainability.
• [pull/140969, pull/140970, pull/140971, pull/140973, pull/140974, pull/140694]

• Codebase cleanup and modernization: A group of pull requests perform mechanical replacements of deprecated io/ioutil package usage with updated io and os package functions across various components, including pod-security-admission, pkg/auth, pkg/controller/certificates, and pkg/volume. These changes ensure the codebase aligns with modern Go standards without altering functionality.
• [pull/140235, pull/140236, pull/140237, pull/140238, pull/140551]

• Release branch maintenance and automation: Pull requests add publishing bot rules for the new release-1.37 branch while removing obsolete rules for the end-of-life release-1.33 branch, and include automated cherry picks of bug fixes and clarifications to release branches 1.36 and 1.35. These efforts maintain release branch hygiene and stability through automation.
• [pull/141273, pull/139146, pull/140920]

• Improved pod rollout and watcher metrics: One pull request enhances kubectl rollout status by detecting and displaying pod warning states inline during deployment rollouts to prevent indefinite hangs. Another introduces an alpha metric to measure latency from etcd event reads to apiserver watcher dispatch, improving observability of watch cache performance.
• [pull/140240, pull/140168]

• Memory and cache management improvements: A pull request replaces the Kubelet's ReasonCache LRU cache with a strict garbage collection mechanism to improve container termination reason accuracy and prevent memory leaks under heavy node load. Another removes the CRI-O skip from a memory PSI test by changing the assertion method to validate test success on Fedora CoreOS despite prior issues.
• [pull/140239, pull/141150]

• Pluralization bug fix in apimachinery: A pull request fixes incorrect pluralization logic in the Kubernetes apimachinery that mishandled resource kinds ending in a vowel followed by "y" by adding a vowel check to correctly pluralize these kinds by appending "s," preventing errors in the fake dynamic client.
• [pull/140086]

• Structured allocator bug fix: A backport fixes the structured allocator's counter caches to be keyed by a combined PoolID instead of just the pool name, preventing conflicts and incorrect device allocation when multiple drivers publish pools with the same name on a node.
• [pull/140504]

3.3 Pull Request Discussion Insights

This section will analyze the tone and sentiment of discussions within this project's open and closed pull requests that occurred within the past week. It aims to identify potentially heated exchanges and to maintain a constructive project environment.

Based on our analysis, there are no instances of toxic discussions in the project's open or closed pull requests from the past week.

IV. Contributors

4.1 Contributors

Active Contributors:

We consider an active contributor in this project to be any contributor who has made at least 1 commit, opened at least 1 issue, created at least 1 pull request, or made more than 2 comments in the last month.

If there are more than 10 active contributors, the list is truncated to the top 10 based on contribution metrics for better clarity.

Access Last Week's Newsletter:

• Link