Weekly GitHub Report for Kubernetes

Thank you for subscribing to our weekly newsletter! Each week, we deliver a comprehensive summary of your GitHub project's latest activity right to your inbox, including an overview of your project's issues, pull requests, contributors, and commit activity.

Table of Contents

• I. News
  • 1.1. Recent Version Releases
  • 1.2. Other Noteworthy Updates
• II. Issues
  • 2.1. Top 5 Active Issues
  • 2.2. Top 5 Stale Issues
  • 2.3. Open Issues
  • 2.4. Closed Issues
  • 2.5. Issue Discussion Insights

• III. Pull Requests
  • 3.1. Open Pull Requests
  • 3.2. Closed Pull Requests
  • 3.3. Pull Request Discussion Insights

• IV. Contributors
  • 4.1. Contributors

I. News

1.1 Recent Version Releases:

The current version of this repository is v1.32.3

1.2 Version Information:

The Kubernetes version released on March 11, 2025, introduces key updates detailed in the official CHANGELOG, with additional binary downloads available. For comprehensive information on new features and changes, users are encouraged to refer to the Kubernetes announce forum and the linked CHANGELOG.

II. Issues

2.1 Top 5 Active Issues:

We consider active issues to be issues that that have been commented on most frequently within the last week. Bot comments are omitted.

1. [SIG/ARCHITECTURE] [TRIAGE/ACCEPTED] [Umbrella] Supporting ML-DSA for PQC requirements: This issue outlines the necessary changes to support configuring ML-DSA cryptography for post-quantum cryptography (PQC) compliance within Kubernetes, including updates to Go version, JWT verification libraries, service account token generation, and certificate handling in kubelet and kubeadm. It details the scope of work such as bumping dependencies, adding ML-DSA support in APIs and token authenticators, and modifying certificate generation and validation processes to accommodate ML-DSA keys.

   • The comments include acknowledgments of the issue by relevant SIGs, assignment of responsibility, and discussions about challenges with dependency updates, particularly with go-jose and go-oidc libraries; there is also clarification that support will come with Go 1.27 and likely be included in future release branches but not backported to older Kubernetes versions.
   • Number of comments this week: 9

2. [SIG/NODE] [KIND/FEATURE] [SIG/WINDOWS] [NEEDS-TRIAGE] [WG/DEVICE-MANAGEMENT] Dynamic Resource Allocation (DeviceClass/Device) is not supported on Windows nodes: This issue addresses the lack of support for Dynamic Resource Allocation (DRA) with structured parameters (DeviceClass/Device) on Windows nodes in Kubernetes, highlighting that current implementations only support device plugins and stub out DRA accessors. It proposes a Windows-specific design to enable device assignment and management compatible with Windows container isolation mechanisms, and calls for the creation of a dedicated Windows DRA enhancement KEP to track and implement this functionality.

   • The comments primarily consist of triage commands assigning relevant SIGs and labels, a request to wait for triage before self-assigning, and inquiries about vendor interest and existing KEPs to prioritize and validate the work before development begins.
   • Number of comments this week: 9

3. [KIND/BUG] [SIG/SCHEDULING] [SIG/NODE] [NEEDS-TRIAGE] [KIND/FEATURE] [WG/DEVICE-MANAGEMENT] Empty DeviceTaintRule selector evicts every pod in the cluster, across namespaces and priorities, until the rule is removed: This issue describes a problem where creating a DeviceTaintRule with an empty deviceSelector: {} causes every pod using any Dynamic Resource Allocation (DRA) device in the cluster to be evicted, regardless of namespace or pod priority, and this effect persists indefinitely until the rule is removed. The reporter expects that an empty selector should either be rejected or produce a clear warning before application, and suggests that high-priority workloads should have protection from such evictions, highlighting the risk of cluster-wide disruption from a simple templating mistake.

   • The comments clarify that the current behavior is by design, as an empty selector is intended to match all devices, and changing this now would be difficult due to API stability concerns. Suggestions include using validating admission policies to prevent empty selectors, adopting a trial-run workflow with effect: None to preview impacts, and potentially adding non-blocking warnings during rule creation; a contributor has already begun work on implementing such a warning mechanism, with ongoing discussion about its impact on API behavior and client tooling.
   • Number of comments this week: 6

4. [KIND/BUG] [SIG/NODE] [PRIORITY/IMPORTANT-LONGTERM] [TRIAGE/ACCEPTED] [WG/DEVICE-MANAGEMENT] DRA: AllocationMode All errors for incomplete or invalid pools are not per-node failures: This issue addresses a problem where an AllocationMode: All request returns a plain error for incomplete or invalid resource pools without wrapping the sentinel error internal.ErrFailedAllocationOnNode, causing the scheduler to treat these errors as framework errors rather than node-specific failures. The reporter suggests that wrapping the sentinel error would allow the scheduler to continue evaluating other nodes and mark the pod as unschedulable only if all nodes fail, improving consistency with other failing cases and better handling of resource pool updates during device allocation.

   • The comments include assignment and unassignment of the issue, a discussion about taking over the work due to lack of triage, and finally triage acceptance with a priority set, noting the fix is desired for consistency but with low immediate impact.
   • Number of comments this week: 6

5. [SIG/SCHEDULING] [KIND/FLAKE] [NEEDS-TRIAGE] [Flaking tests] k8s.io/kubernetes/test/integration/scheduler/preemption/podgroup tests timing out: This issue reports that the integration tests in the k8s.io/kubernetes/test/integration/scheduler/preemption/podgroup package are intermittently timing out, likely due to the tests exceeding the 10-minute execution limit. The flakiness appears to have started after a recent pull request and may be mitigated by optimizing the test setup to reuse the same API server across subtests instead of starting a new one for each.

   • The comments include an assignment and reassignment of the issue, with a contributor proposing a potential fix by sharing the API server among subtests to reduce execution time and prevent timeouts, followed by brief acknowledgments.
   • Number of comments this week: 5

2.2 Top 5 Stale Issues:

We consider stale issues to be issues that has had no activity within the last 30 days. The team should work together to get these issues resolved and closed as soon as possible.

As of our latest update, there are no stale issues for the project this week.

2.3 Open Issues

This section lists, groups, and then summarizes issues that were created within the last week in the repository.

Issues Opened This Week: 30

Summarized Issues:

• Kubelet and Volume Health Reporting Issues: The kubelet incorrectly reports volume health when CSI drivers return unknown health conditions, dropping unrecognized statuses without logging and erasing previously recorded adverse conditions. Additionally, kubelet retries health streams for Device Resource Allocation plugins that do not advertise health support, causing excessive error logs and unnecessary retries.
  • issues/141725, issues/141855

• Windows Node Resource and Device Management Problems: Windows nodes experience frequent "not implemented" cgroup error logs due to unguarded cgroup inspection calls, and lack support for Dynamic Resource Allocation with structured parameters, requiring a Windows-specific design. The Node.status.volumesAttached[].devicePath field has undefined semantics on Windows, necessitating redefinition to use CSI VolumeHandle for consistency.
  • issues/141760, issues/141841, issues/141842

• Scheduler and Resource Allocation Bugs: The NodeResourcesFit and NodeResourcesBalancedAllocation scheduler plugins regressively score all nodes as zero resource requests when an HTTP scheduler extender disables node caching, causing inefficient pod scheduling. An AllocationMode: All request returns generic errors for invalid resource pools without proper per-node failure classification, prematurely canceling node checks.
  • issues/141781, issues/141829

• Flaky and Timing-Related Test Failures: Multiple tests including node end-to-end containerd tests, pod lifecycle with restartable init containers, pod group preemption, and scheduler API dispatcher tests fail intermittently due to timing dependencies, race conditions, or fragile synchronization assumptions. Suggestions include relaxing timeouts and replacing hardcoded sleeps with explicit synchronization.
  • issues/141786, issues/141787, issues/141794, issues/141836

• Security Vulnerabilities and CVE Fixes: Several security issues affect Kubernetes including CVE-2026-84304 causing heap memory exhaustion in gRPC-Go, CVE-2026-56855 involving denial of service via React Router, and CVE-2026-78662 causing deadlock in Go x/crypto/ssh. These vulnerabilities cause CI failures and require dependency updates and patches.
  • issues/141798, issues/141884, issues/141885

• Audit Logging and Visibility Gaps: There is a lack of audit-log visibility for adminAccess self-escalation actions such as namespace labeling and ResourceClaim creation, leaving no distinguishable audit trail for cluster operators to review these critical security events.
  • issues/141799

• Integration and End-to-End Test Timeouts: Integration tests in the scheduler preemption podgroup package and the ImageGarbageCollect test consistently time out, likely due to excessive API server startups and premature garbage collection or job ordering issues, impacting test reliability.
  • issues/141803, issues/141806

• Pod Status and StatefulSet Update Bugs: After in-place pod resize, the PodStatus.Resources field inconsistently drops CPU or memory keys, truncating resource status despite correct cgroup allocations. The StatefulSet controller can enter an endless loop retrying failed in-place pod updates without deleting pods with mismatched volumeClaimTemplates, causing rollout stalls.
  • issues/141814, issues/141876

• Metrics and Monitoring Inaccuracies: The apiserver_init_events_total metric over-reports initial events after watcher termination, counting events never sent to clients during stress testing, leading to inaccurate monitoring data.
  • issues/141818

• Code Quality and Leak Detection Enhancements: A proposal exists to add an end-to-end invariant test using Go 1.27's goroutine leak detection to identify permanently leaked goroutines in Kubernetes components, aiming to improve code quality and reliability.
  • issues/141819

• iSCSI Volume Plugin and Device Detachment Failures: The in-tree iSCSI volume plugin's DetachBlockISCSIDisk function fails permanently if the device path link is missing after session loss, causing volumes to remain stuck in use and preventing proper teardown or reattachment until kubelet restart or manual cleanup.
  • issues/141839

• CLI Command Parsing and Validation Bugs: The kubectl create service command improperly accepts malformed --tcp port mappings with extra fields, resulting in partial interpretation and incorrect port naming without error. Additionally, qualified names containing multiple slashes are silently accepted instead of rejected, violating validation rules.
  • issues/141848, issues/141869

• Deployment Controller Integer Overflow: The DeploymentController suffers an integer overflow when computing the next revision number for a ReplicaSet annotated with the maximum int64 value, corrupting revision history and clearing the Deployment's revision annotation.
  • issues/141853

• ResourceQuota Admission Controller Conflict Handling Bug: The ResourceQuota admission controller incorrectly admits requests exceeding quota limits if a status update conflict occurs on an unrelated quota during the same admission batch, allowing denied requests due to improper conflict retry handling.
  • issues/141904

• Webhook Conversion Test Flakiness: The TestWebhookConverterWithWatchCache test intermittently fails to produce the expected custom webhook conversion error message, sometimes returning internal storage errors or no error, causing inconsistent test results.
  • issues/141909

• ResourceSlice and DRA Driver Availability Issues: When a DRA driver becomes unavailable on a healthy node, the associated ResourceSlice remains valid and unchanged, causing the scheduler to bind pods to resources that cannot be prepared. This results in pods being scheduled but never starting, with no automatic recovery until manual intervention or driver return.
  • issues/141912

• ML-DSA Cryptographic Algorithm Support Implementation: A comprehensive effort is underway to implement ML-DSA cryptographic algorithm support in Kubernetes, including dependency updates, JWT verification, service account token generation, certificate handling, and API validation changes to comply with PQC requirements and Go 1.27 features.
  • issues/141838

2.4 Closed Issues

This section lists, groups, and then summarizes issues that were closed within the last week in the repository. This section also links the associated pull requests if applicable.

Issues Closed This Week: 23

Summarized Issues:

• Scheduling Model and Pod Topology Constraints: Kubernetes is shifting from a pod-based to a workload-based scheduling model to improve scheduling capabilities and lifecycle integrity by defining goals and architectural plans. Additionally, a bug causes PodTopologySpreadConstraint with an empty but non-nil labelSelector to be treated as a no-op, leading to ignored constraints and improper pod placement.
• [issues/132192, issues/141339]

• Clientset and Serialization Issues: The clientset constructor overrides the provided config.NegotiatedSerializer unconditionally, preventing users from injecting custom serializers to preserve dropped fields, with a proposed fix to respect existing serializers.
• [issues/135544]

• Test Failures and Flakiness: Multiple test failures occur due to external factors such as SSH command failures causing e2e test timeouts, OpenPGP signature verification failures on LLVM apt repositories, and flakiness in table format streaming tests caused by timing discrepancies in CreationTimestamp rendering.
• [issues/137096, issues/137097, issues/137148]

• Security Vulnerabilities in Volume Plugins: The kubelet iSCSI volume plugin has a path traversal vulnerability due to unsanitized IQN usage in file paths, allowing unauthorized file creation outside intended directories.
• [issues/140129]

• CPU Manager and Resource Allocation Bugs: The CPUManager's distribute-cpus-across-cores policy incorrectly allocates CPUs based on numerical IDs rather than topology, and its static policy metrics drift from actual allocations due to double counting and incomplete metric updates, causing inaccurate CPU usage reporting.
• [issues/140688, issues/141262]

• Device Resource Allocation (DRA) Bugs: The structured DRA allocator can incorrectly allocate devices as dedicated despite live shared allocations due to improper device usage checks, and kubelet retries health streams unnecessarily for DRA plugins lacking health support, causing excessive errors and resource waste.
• [issues/140797, issues/141856]

• Dependency and Build Infrastructure Instability: The cyphar.com/go-pathrs dependency caused build failures due to domain unavailability, prompting migration to Cloudflare Pages, and the agnhost Dockerfile build fails on release branches when specific golang Docker tags are missing due to lack of fallback mechanisms.
• [issues/141144, issues/141396]

• Pod Lifecycle and Autoscaling Issues: Pods in terminal Succeeded state are incorrectly included in Horizontal Pod Autoscaler calculations, causing inaccurate scaling and pinned replica counts, and Kubernetes Jobs fail to delete pods after completion due to missing error handling and retry logic under high I/O load.
• [issues/141298, issues/141346]

• Image Pull and Device Tainting Bugs: The calico-node pod fails to start due to image pull and unpack errors from an unavailable image, and omitting the deviceSelector in a DeviceTaintRule incorrectly blocks device allocation cluster-wide, contrary to documented behavior.
• [issues/141514, issues/141620]

• Scheduler Data Race and Command Line Bugs: A data race condition was detected in the scheduler during pod group reconciliation requiring further investigation, and the kubectl kuberc set command accepts empty flag names, resulting in broken configurations and subsequent command failures.
• [issues/141653, issues/141703]

• Security Vulnerabilities and CVE Management: A sig-security scan detected 17 new CVEs mostly related to the Go standard library, requiring triage and resolution primarily through Go toolchain updates rather than dependency changes.
• [issues/141731]

• Conformance Test and Platform Limitations: A conformance test failed because a server pod with a Restricted security context could not bind to privileged port 443 on Linux nodes, resolved by switching to an unprivileged port, and hugepages resources are not advertised on Windows nodes due to fundamental OS memory management differences, making hugepages a Linux-only feature.
• [issues/141749, issues/141840]

• Quantity Value Conversion Bug: The Value() method of a Quantity object returns incorrect integer conversions for very small negative numbers with large negative exponents, producing 1 instead of the expected -1.
• [issues/110653]

2.5 Issue Discussion Insights

This section will analyze the tone and sentiment of discussions within this project's open and closed issues that occurred within the past week. It aims to identify potentially heated exchanges and to maintain a constructive project environment.

Based on our analysis, there are no instances of toxic discussions in the project's open or closed issues from the past week.

III. Pull Requests

3.1 Open Pull Requests

This section provides a summary of pull requests that were opened in the repository over the past week. The top three pull requests with the highest number of commits are highlighted as 'key' pull requests. Other pull requests are grouped based on similar characteristics for easier analysis. Up to 25 pull requests are displayed in this section, while any remaining pull requests beyond this limit are omitted for brevity.

Pull Requests Opened This Week: 123

Key Open Pull Requests

1. WIP: dynamic resize of memory-backed volumes (beta update): This pull request introduces a beta update that enables dynamic resizing of memory-backed emptyDir volumes by supporting the addition and removal of the sizeLimit field, emits warning events when the volume size exceeds pod-level limits, adds a new metric to track these resize operations, and graduates the InPlacePodVerticalScalingMemoryBackedVolumes feature gate to beta.

• URL: pull/141807

• Associated Commits: ca0fc, 20916, 0ffdc, 16540, 85198, 2accc, 88531, 08945

2. Yubair' : This pull request improves maintenance and diagnostics in kubeadm, kubelet, and scheduler by making webhook authentication and authorization configuration errors actionable, marking deprecated feature-gate messages as warnings during kubeadm upgrades, adding test coverage for missing kubeconfig failures in kubeadm upgrade apply, simplifying error construction, and linking TODO and FIXME comments to tracking issues, all without introducing API changes.

• URL: pull/141746

• Associated Commits: 79b94, 66341, 86440, 449e7, 08261, e162d, 5da07

3. kubelet: topologymanager: Add Score field to TopologyHint for NUMA utilization signaling: This pull request adds an optional Score field to the TopologyHint structure in the kubelet's Topology Manager to carry a utilization-based signal from CPU, memory, and device hint providers reflecting current NUMA node resource allocation, aggregates these scores during hint merging without changing existing hint selection logic, and lays the groundwork for future topology policies that will use this Score to influence NUMA node selection for workload packing or spreading.

• URL: pull/141796

• Associated Commits: f0630, 7970c, 94786, d94f3, e303b, 0ab6a, 110d1

Other Open Pull Requests

• Validation migration and improvements: Multiple pull requests migrate validation logic from handwritten Go code to declarative CEL validation or custom validators, improving maintainability and error handling. These include migration of ObjectMeta fields and resourceVersion update validation, as well as fixes to the validation-gen tool to handle cross-package calls and prevent nil pointer panics in requiredness lint rules.
  • pull/141755, pull/141753, pull/141874, pull/141761

• Scheduler enhancements and bug fixes: Several pull requests improve the Kubernetes scheduler by refactoring PodGroup scheduling logic, promoting feature gates to beta, fixing race conditions and event recording, removing unreachable code, and addressing flaky test failures with better synchronization. These changes enhance scheduler correctness, maintainability, and test reliability without adding new functionality.
  • pull/141852, pull/141732, pull/141822, pull/141870, pull/141879

• Windows node and kubelet improvements: Multiple pull requests enhance Windows node support by fixing node identity to use a stable OS install GUID, adding PID capacity reporting and live PID stats, improving kubelet configuration validation to reject unsupported inode eviction signals, and enhancing network summary metrics with dropped-packet counters. These changes improve observability, correctness, and configuration error reporting on Windows.
  • pull/141820, pull/141847, pull/141845, pull/141846

• Kubeadm, kubelet, and scheduler diagnostics and maintenance: One pull request improves maintenance and diagnostics by enhancing webhook error messages, marking deprecated warnings clearly, adding test coverage for kubeconfig failures, simplifying error construction, and linking TODOs to tracking issues, all without API changes.
  • pull/141747

• Feature gate removals and cleanup: Pull requests remove deprecated or obsolete feature gates such as MultiCIDRServiceAllocator, DisableAllocatorDualWrite, and podresources-API related gates, along with associated tests and version emulation code, as part of cleanup efforts for Kubernetes 1.38.
  • pull/141762, [pull/141759](https://github.com/pull/141759]

• Testing framework and test code improvements: Enhancements include adding HTTP request counting per test in end-to-end tests with JUnit reporting, removing debug log noise from tests, fixing flaky scheduler test failures by replacing sleep with signaling, and reverting an e2e test timeout change due to IPVS limitations.
  • pull/141859, pull/141875, pull/141837, pull/141719

• kubectl command bug fixes: A pull request fixes a bug in kubectl delete and kubectl wait --for=delete where lack of list/watch permissions caused indefinite hangs and repeated watch failures by detecting forbidden errors early and cancelling waits properly.
  • pull/141767

• Composite PodGroup status and diagnostics: One pull request implements recursive status propagation and hierarchical diagnostic reporting for Composite Pod Groups, enabling failure reasons and context to be propagated across the hierarchy while preserving detailed local error messages.
  • pull/141860

• Apiserver cacher optimization proof of concept: A proof of concept pull request refactors the apiserver cacher to stream watch cache list results and initial events from snapshots more efficiently, removing the need for the OrderedListPrefix and improving performance and concurrency.
  • pull/141824

3.2 Closed Pull Requests

This section provides a summary of pull requests that were closed in the repository over the past week. The top three pull requests with the highest number of commits are highlighted as 'key' pull requests. Other pull requests are grouped based on similar characteristics for easier analysis. Up to 25 pull requests are displayed in this section, while any remaining pull requests beyond this limit are omitted for brevity.

Pull Requests Closed This Week: 118

Key Closed Pull Requests

1. Add e2e test: NetworkPolicy default-deny blocks LoadBalancer Local externalTrafficPolicy ingress: This pull request adds an end-to-end test that verifies a default-deny ingress NetworkPolicy correctly blocks external ingress traffic to pods behind a LoadBalancer service configured with externalTrafficPolicy=Local, ensuring that internal pod-to-pod connectivity remains unaffected while external traffic is denied despite the LoadBalancer preserving client source IP.

• URL: pull/141727

• Associated Commits: 26993, bfc6b, 05c27, 0e66e, a88a6, 08a25, 4aa7e, 75893, 208b9, 586dc, 3cb68, 20dbd, 0ff20, ec389, a88d1, 3c2e1, 2b1c6, 3b928, ef61f, 09024, 37f0f, be0fd, 18158, ac9e8, 062eb, 9bd62, e7247, be953, 8a62b, 75d24, d6d1e, a44e1, 278ab, f0cfc, 8e9e0, ad665, 07286, 813b7, 5d11d, 01f2e, 0af7c, 3f942, 03191, db989, 7e006, dd8ac, 61a2e, 7275a, 83798, a6d9e, 38826, a4d55, 1fb65, c52f5, 737b8, cc420, d409b, 5448b, d0c6d, f2890, 3c725, 5aaa3, da354, d741a, 3b1df, 18b19, 7fe6d, 2ae09, 58c99, ec207, d97dd, 07d33, b3dfd, 7aecd, f5269, 43415, b8e7c, 1e551, 5ea10, bda00, 24260, 38241, 6f86f, d26e5, 53906, da27b, a7dcd, 21fed, 23819, 5da98, 73110, 04d92, 36720, a9e66, 60b48, 95655, 63082, af0ae, a5148, 3e8a8, c94c3, 27934, b737c, 9ad66, 9f0af, 4e44f, 5a7d3, fad5f, b44d0, eb81d, 6d651, 10711, 6a8ba, b679c, 9943e, 18560, 52ec5, 17bee, 36471, 1bfca, d9a67, ac72a, 3c714, c7e25, c3540, b5693, 86f24, b0ebe, ab934, 425b9, 0a238, 8f4a9, 44c8a, 4c471, 96699, 8764b, 10bf0, da428, d81d2, 36d49, 45a1c, fcf54, 5142b, 7c859, d3039, 817c5, 6e05a, 000f5, b9847, e3220, 974e4, a29b5, 4009a, 3c8d9, 94e5c, 49d4e, 67a7e, c977e, 3ea03, d4f59, ebb62, 25b5a, 76756, 83490, c26b5, d5b8e, ab272, 5f16a, 09ae1, 8e37c, f0207, 5f3b1, 35aef, e37e7, fd012, ccd26, 74d92, a2eaf, 317c2, 0163b, c5f6b, e8d91, 2ab9b, 8cf9f, af4ec, e2555, f9d7e, 9990e, e48a9, 7e11d, 97b18, df15b, ede4a, f8947, d0ce2, 78577, 9e227, a11e4, ecb1d, 93fec, 27880, 8e495, c7b3c, 63ccf, 7a04f, f7ce0, 47f21, 5c45e, 0e2b5, 6251e, f29b2, 90fe1, 5fb08, fb5c2, 08f05, b7880, be1a3, 8d8ae, b8be8, a5adc, 02301, 9195f, c32f6, ccd48, 71747, 6dc13, 7904d, 7d106, c2df7, 41ca8, 43c49, be300, 0487c, d6115, 6808b, e238f, 71f74, 8fd1e, 51234, b0f7d, d99e2, 688b0, 730b2, 58ec2, 9322f, 3515d, ecdaf, 604ac, d5df2, 9c3b2

2. refactor horizontal_test.go: This pull request refactors the horizontal_test.go file by reorganizing and cleaning up multiple test cases related to horizontal pod autoscaling, removing redundant tests, merging similar tests, improving test clarity, and adding checks for unexpected conditions as part of the final major cleanup for that test file.

• URL: pull/141154

• Associated Commits: e9aa3, b7bb9, 39019, bb273, c4658, c5711, 03a0f, 4ebd0, f71c6, 9a599, 5645a, b2d9e, 5d9d7, 3051b, 8ec84, a1ef4, 40121, 911ca, 131aa, e7e5b, 277fd, ef7d8

3. Enhance celtest package with admission policy support and tests: This pull request enhances the celtest package by adding comprehensive support for admission policy testing, including utilities to compile and evaluate CEL expressions for ValidatingAdmissionPolicy and MutatingAdmissionPolicy resources, along with extensive unit and integration tests to ensure accurate parsing, evaluation, and behavior parity with the Kubernetes API server runtime.

• URL: pull/138564

• Associated Commits: b8007, 61ed2, 67880, 05a92, 0c07d, c6837, 8983d, 446cc, 807bd, a5a03, d9590, 3175e, 94f90, c6963, 9d778, 179db, 5c0b5, b7cdb, 8ee21, 5bc4f, 690a3

Other Closed Pull Requests

• resource.Quantity serialization and rounding fixes: Multiple pull requests address bugs in resource.Quantity handling, including fixing suffix dropping during serialization for large DecimalSI and BinarySI values and correcting rounding behavior for negative values in Value() and MilliValue() methods. These fixes ensure accurate serialization and deserialization as well as correct rounding semantics for negative quantities.
  • pull/140459, pull/138510

• Validation-gen enhancements and custom deep-equal support: Several pull requests enhance the validation-gen tool by enabling users to configure custom deep-equal functions via tags, deprecating the default validate.SemanticDeepEqual, and formalizing external consumer support through refactoring and configurable tag prefixes. These changes increase flexibility in validation and allow third-party projects to extend validation-gen functionality.
  • pull/141808, pull/141395, pull/141866

• API linter rules enforcement for optional and required fields: Multiple pull requests enable the optionalorrequired and nonpointerstructs kube-api-linter rules for various API groups including batch, discovery, and storage by adding missing +optional and +required tags. This improves API validation accuracy and aligns OpenAPI schemas with actual validation behavior without changing existing validation logic.
  • pull/140010, pull/136848, pull/137069

• Kubelet CPUManager improvements and bug fixes: Several pull requests fix bugs and improve the kubelet CPUManager by correcting CPU allocation metrics, preventing infinite loops during CPU allocation with specific options, eliminating duplicate uncore cache IDs, and simplifying allocation logic. These changes enhance accuracy, efficiency, and stability of CPU resource management in the kubelet.
  • pull/141261, pull/140730, pull/141026

• Resource version tracking for deletions: One pull request adds the capability for clients to receive and track the resource version associated with resource deletions in Kubernetes API calls, enabling staleness guarantees by returning the resource version at which the object was deleted or observed deleted. This feature improves client-side consistency and cache correctness.
  • pull/138724

• Code-generator and clientset serializer preservation: A pull request modifies the code-generator to prevent overwriting a non-nil NegotiatedSerializer in rest.Config when constructing clientsets, ensuring that existing serializers provided in configurations are preserved. This avoids unintended serializer replacement and potential clientset misbehavior.
  • pull/140317

• Image garbage collection bug fix: One pull request fixes a bug where container images in error states were repeatedly garbage collected and re-downloaded by updating the image garbage collection logic to exclude containers not in "running" or "created" states. This prevents unnecessary network traffic and resource consumption.
  • pull/132411

• Conditional authorization pre-factor and validation: A pull request implements a pre-factor for conditional authorization by enforcing DNS 1123 subdomain rules on AuthorizerNames, applying length limits on conditions, requiring domain-qualified condition IDs and types, and maintaining backward compatibility with existing admission plugins. This strengthens authorization condition validation and compatibility.
  • pull/140715

• Metav1.Condition.Message declarative validation migration: One pull request migrates validation of the metav1.Condition.Message field to declarative validation by adding optional and maximum length tags, removing handwritten length checks, and adding test coverage as part of KEP-5073. This improves validation consistency and maintainability.
  • pull/139727

• EndpointSlice controller metrics promotion: A pull request promotes the endpoint_slice_controller_changes metric from Alpha to Beta stability by renaming it with the _total suffix, updating documentation, and completing the graduation of EndpointSlice controller metrics. This enhances metric stability and standardization.
  • pull/140447

• Device Resource Allocation scheduler bug fix: One pull request fixes a bug in the DRA scheduler by preventing devices with live persisted shared allocations from being simultaneously allocated exclusively when the allowMultipleAllocations flag changes from true to false. This avoids double allocation and ensures correct device allocation behavior.
  • pull/140798

• Structured-merge-diff dependency bump and related updates: A work-in-progress pull request bumps the structured-merge-diff dependency to incorporate upstream changes, along with Go version upgrades and linting improvements.
  • pull/141664

• Go 1.27 vet, gofmt, and lint compliance: One pull request updates the Kubernetes codebase to comply with vet, gofmt, and lint requirements introduced in Go 1.27 while maintaining Go 1.26 compatibility, including fixes for error wrapping, inline vetting, formatting, and cleanup of generated comments.
  • pull/141828

• Testing framework cancellation behavior experiment: A work-in-progress pull request introduces a new CancelBecause method to better control cancellation causes in tests and adjusts context cancellation timing, although it was not merged.
  • pull/141716

• Validation-gen external consumer support and custom prefix example: A pull request formalizes support for external consumers of validation-gen by refactoring the generator into importable packages, making the tag prefix configurable, and adding a working custom-prefix example.
  • pull/141866

• Host address formatting simplification: One pull request proposes simplifying host address formatting by replacing custom if-else logic with the standard library function net.JoinHostPort, identified via a semgrep rule.
  • pull/136891

• Topo end-to-end test CPU resource wait logic: A pull request improves the topo end-to-end test by adding logic to wait for available CPU resources before running or skip the test if insufficient CPU is available, reducing flakes related to CPU constraints.
  • pull/138245

• iSCSI plugin path traversal security fix: One pull request addresses a security bug by preventing path traversal vulnerabilities in the iSCSI plugin directory path resolution within the kubelet, adding validation and regression tests to enforce this constraint.
  • pull/140258

• Reflective CEL list concatenation bug fixes: A pull request fixes multiple bugs related to operand mutation in reflective ref.Val implementations of list concatenation, preserving map-list and set-list semantics in CEL type wrappers.
  • pull/140266

3.3 Pull Request Discussion Insights

This section will analyze the tone and sentiment of discussions within this project's open and closed pull requests that occurred within the past week. It aims to identify potentially heated exchanges and to maintain a constructive project environment.

Based on our analysis, there are no instances of toxic discussions in the project's open or closed pull requests from the past week.

IV. Contributors

4.1 Contributors

Active Contributors:

We consider an active contributor in this project to be any contributor who has made at least 1 commit, opened at least 1 issue, created at least 1 pull request, or made more than 2 comments in the last month.

If there are more than 10 active contributors, the list is truncated to the top 10 based on contribution metrics for better clarity.

Access Last Week's Newsletter:

• Link