Weekly GitHub Report for Kubernetes: February 01, 2026 - February 08, 2026 (15:59:14)
Weekly GitHub Report for Kubernetes
Thank you for subscribing to our weekly newsletter! Each week, we deliver a comprehensive summary of your GitHub project's latest activity right to your inbox, including an overview of your project's issues, pull requests, contributors, and commit activity.
Table of Contents
I. News
1.1 Recent Version Releases:
The current version of this repository is v1.32.3
1.2 Version Information:
The Kubernetes 1.32 release, announced on March 11, 2025, introduces key updates and improvements detailed in the official CHANGELOG, with additional binary downloads available. This version continues to enhance Kubernetes' functionality and stability, reflecting ongoing development trends in the platform.
II. Issues
2.1 Top 5 Active Issues:
We consider active issues to be issues that that have been commented on most frequently within the last week. Bot comments are omitted.
-
[KIND/FLAKE] [SIG/TESTING] [SIG/CLOUD-PROVIDER] [TRIAGE/ACCEPTED] Flaking infrastructure: e2e-gce cluster setup: This issue addresses intermittent failures in the end-to-end GCE cluster setup tests, specifically related to delays and timeouts during the Kubernetes master node installation process. The problem appears to stem from slow package downloads from the Ubuntu archive during containerd installation, causing the setup to exceed the expected timeout and leading to flakiness in the test runs.
- The comments discuss observations of varying installation times linked to network speed and package dependencies, propose extending timeouts, and consider reducing unnecessary package installations to improve reliability. Several pull requests and test grid references are shared to track progress, with some indication that the flakiness may be resolved but performance improvements are still needed.
- Number of comments this week: 15
-
[KIND/BUG] [SIG/NODE] [NEEDS-TRIAGE] Kubelet HTTP Probe Follows Scheme-Changing Redirects: This issue describes a problem where the kubelet's HTTP readiness and liveness probes incorrectly follow HTTP 301 redirects that change the scheme from HTTP to HTTPS, even when the pod specification explicitly sets the probe scheme to HTTP. This behavior causes probes to fail with TLS handshake errors against HTTP-only servers that redirect to HTTPS, preventing pods from becoming ready and leading to inconsistent and confusing probe results.
- The comments discuss the implications of changing redirect behavior, with some expressing concern that blocking scheme-changing redirects might break existing users who rely on kubelet following redirects; others suggest adding a parameter to control redirect following explicitly, and there is consensus that the current behavior is unintuitive and could benefit from clearer, more consistent handling of redirects in probes.
- Number of comments this week: 9
-
[SIG/API-MACHINERY] [HELP WANTED] [TRIAGE/ACCEPTED] Migrate 'Good First Migration' Immutable Fields to Declarative Validation: This issue tracks the migration of certain immutable fields in Kubernetes API types from handwritten Go validation code to Declarative Validation tags as part of KEP-5073, focusing on "good first migration" cases that are simpler and consistent across API versions. The goal is to facilitate community contributions by providing a clear, structured approach to adding these validation tags with minimal friction, improving API readability and moving towards a more declarative validation system.
- The comments include assignment requests and offers to collaborate, updates on progress with specific fields migrated across various API groups, and acknowledgments of contributions along with enabling test tags to support the migration efforts.
- Number of comments this week: 9
-
[SIG/NODE] [KIND/FLAKE] [TRIAGE/ACCEPTED] [WG/DEVICE-MANAGEMENT] Test flake: [sig-node] [DRA] kubelet [Feature:DynamicResourceAllocation] on single node supports extended resources together with ResourceClaim [Serial]: This issue reports a test flake in the Kubernetes project where a pod fails to start because the kubelet cannot allocate extended resources due to no healthy devices being present, resulting in an unexpected admission error. The failure appears to be related to a race condition with the deployment of a device plugin, causing the test for dynamic resource allocation on a single node to intermittently fail.
- The comments discuss the root cause of the error, identifying it as a lack of healthy devices during resource allocation likely caused by a race condition with device plugin deployment. Suggestions include adding a delay before pod creation or monitoring node resource availability, with one contributor volunteering to implement a monitoring solution and being assigned the issue.
- Number of comments this week: 6
-
[KIND/BUG] [SIG/NETWORK] [AREA/KUBE-PROXY] [TRIAGE/ACCEPTED] kube-proxy fails to sync in nftables mode when newer nftables sets exist: This issue describes a problem where kube-proxy crashes repeatedly in nftables mode on hosts running newer versions of nftables (1.1.3+), due to segmentation faults caused by the presence of newer nftables sets with user data in the same network namespace. The reporter suggests that the root cause is kube-proxy listing all nftables chains across all tables instead of only its own, leading to crashes when encountering unexpected data, and proposes a fix to limit the listing to kube-proxy's own table to avoid these crashes.
- The comments clarify that the crash is actually in the nft binary rather than kube-proxy itself, discuss the underlying cause related to listing all chains across tables, and agree on a solution to implement a new method that lists only kube-proxy’s own nftables objects to prevent the segmentation fault, with confirmation that this approach avoids crashes in newer nftables versions.
- Number of comments this week: 6
2.2 Top 5 Stale Issues:
We consider stale issues to be issues that has had no activity within the last 30 days. The team should work together to get these issues resolved and closed as soon as possible.
As of our latest update, there are no stale issues for the project this week.
2.3 Open Issues
This section lists, groups, and then summarizes issues that were created within the last week in the repository.
Issues Opened This Week: 28
Summarized Issues:
- Flaky and Intermittent Test Failures: Multiple issues report flaky or intermittent test failures across various Kubernetes components, including e2e tests for service type changes, dynamic resource allocation, PersistentVolumes with NFS, inline ephemeral volumes, Pod InPlace Resize Container, API extensions webhook, and scalability tests. These failures often cause timeouts, unexpected errors, or test output issues, impacting test reliability and developer confidence.
- [issues/136687, issues/136696, issues/136708, issues/136712, issues/136713, issues/136739, issues/136783, issues/136794]
- Kubelet and Pod Resource Management Bugs: Several issues highlight bugs and feature requests related to kubelet behavior and pod resource management, including incorrect HTTP probe handling with redirects, lack of workload-aware scheduling, support for in-place vertical scaling of resource requests and limits, and premature completion of StatefulSet rolling updates. These problems affect pod readiness, scheduling accuracy, resource scaling, and update correctness.
- [issues/136697, issues/136698, issues/136722, issues/136831]
- Kube-proxy and Networking Stability Issues: There are reports of kube-proxy crashing or misbehaving due to endpoint readiness filtering failures and segmentation faults in nftables mode on newer nftables versions. These issues cause excessive log spam and network failures, requiring workarounds like restricting nftables operations or patching.
- [issues/136742, issues/136786]
- API and Client-go Improvements and Bugs: Issues include the fake clientset not modeling spec/status separation correctly during server-side apply, deprecating podresources API v1alpha1 in favor of v1, replacing deprecated backoff APIs in client-go, and migrating immutable field validation to declarative tags. These address correctness, simplification, and modernization of API and client libraries.
- [issues/136672, issues/136735, issues/136738, issues/136785, issues/136823]
- Scheduler Behavior and Feature Enhancements: Problems and proposals related to the Kubernetes scheduler include uneven pod distribution causing OutOfpods errors after scaling, and a feature to analyze the influence of scoring plugins on node selection to improve explainability and tuning without changing scheduler behavior.
- [issues/136757, issues/136782, issues/136788]
- Security and Configuration Management: Issues cover the lack of node name validation in the Binding API causing pods to get stuck due to invalid uppercase characters, and a proposal for kubelet-server configuration to support ClientCA reloading for TLS CA rotation without restarts. These affect security validation and operational flexibility.
- [issues/136723, issues/136724]
- PersistentVolume and Storage Driver Limitations: A problem is reported where mount options like
noexecandroare not passed to pods when using the AWS EFS CSI driver with containerd, leading to unexpected volume behavior at the pod level. - [issues/136805]
- API Dependency Management Proposal: A proposal suggests enabling enforced dependencies between APIs and feature gates to prevent inconsistent states that complicate development and testing workflows.
- [issues/136757]
- User Experience Improvement for kubectl Logs Command: A proposal to allow "kubectl get logs" as an alias for "kubectl logs" aims to improve user experience by matching flags, behavior, and output without changing existing command behavior.
- [issues/136836]
2.4 Closed Issues
This section lists, groups, and then summarizes issues that were closed within the last week in the repository. This section also links the associated pull requests if applicable.
Issues Closed This Week: 19
Summarized Issues:
- ResourceClaim Pod Reference Handling: Adding non-pod references to the
status.reservedForfield in aResourceClaimprevents the resourceclaim controller from removing pod references when the pod terminates, causing pod references to persist incorrectly. This issue leads to stale pod references remaining in the system, potentially causing resource management inconsistencies. - issues/136406
- Kube-Controller-Manager Crashes: A panic caused by a nil pointer dereference occurs in the kube-controller-manager when using a ValidatingAdmissionPolicy, likely triggered by the x-kubernetes-preserve-unknown-fields extension. The root cause is a missing nil check in the type checking code, leading to controller instability.
- issues/136472
- Failing Kubernetes Tests: Multiple tests are failing including the "ImageVolume subPath should succeed when using a valid subPathChanges" due to command execution errors in pod containers, and the KubeProxy component failing to set the TCP CLOSE_WAIT timeout correctly, causing repeated failures from missing valid conntrack entries. These test failures indicate underlying issues in pod volume handling and network connection tracking.
- issues/136547, issues/136559
- Deployment Configuration Drift: Manually added environment variables in a Kubernetes Deployment are not removed when reapplying manifests with kubectl apply, causing permanent configuration drift despite successful applies and no conflicts. This behavior leads to discrepancies between the declared manifest and the live Deployment state.
- issues/136586
- Pod Termination on Node Reboot: After a node reboot, the NewUnmounter function always returns an error when deleting a pod because the volume directory has already been removed, causing pods to remain stuck in a terminating state. This issue prevents proper cleanup of pod resources during node restarts.
- issues/136591
- Pressure Stall Information (PSI) Metrics Cardinality: There is a request to reduce the cardinality of PSI metrics by excluding pause and pod cgroups, which would significantly decrease Prometheus pod memory usage caused by collecting metrics from non-application containers. This change aims to optimize resource usage in monitoring setups.
- issues/136642
- High Latency in API Responsiveness Tests: The ClusterLoaderV2 access-tokens suite reports high latency in DELETE requests to the events resource during Prometheus API responsiveness measurements, exceeding expected thresholds. This latency indicates potential performance bottlenecks in API handling.
- issues/136649
- Ingress-NGINX Security Vulnerabilities: Multiple critical security vulnerabilities exist in ingress-nginx involving Ingress annotations and fields such as
auth-method,rules.http.paths.path,auth-url, andauth-proxy-set-headers. These vulnerabilities allow malicious nginx configuration injection, arbitrary code execution, unauthorized disclosure of Secrets, and bypassing of authentication protections, posing severe risks to cluster security. - issues/136677, issues/136678, issues/136679, issues/136789
- Ingress-NGINX Denial of Service: The ingress-nginx validating admission controller is vulnerable to denial of service attacks via large requests causing excessive memory consumption, potentially killing the ingress-nginx controller pod or exhausting node memory. Mitigation requires upgrading to versions 1.13.7, 1.14.3, or later.
- issues/136680
- Registry Store DeleteCollectionWorkers Behavior: The inability to disable collection workers in the registry store by setting DeleteCollectionWorkers to zero causes DeleteCollection to run without any trigger, as it currently defaults to one. This behavior limits control over collection worker concurrency.
- issues/136682
- Kube-Proxy Topology-Aware Hints Logging: Kube-proxy does not exclude endpoints in a not ready state by topology-aware hints, causing excessive log spamming when pods are in crash loop or image pull error states after upgrading to Kubernetes 1.33.9. This results in noisy logs and potential difficulty in troubleshooting.
- issues/136740
- Pod QoS Classification Discrepancy: A Kubernetes pod with zero CPU requests and limits but set memory requests and limits is unexpectedly classified as burstable QoS instead of guaranteed QoS according to official documentation. This discrepancy may affect resource scheduling and QoS guarantees.
- issues/136749
- Kubectl Wait Command Enhancement: There is a request to add context support to the WaitOptions.Run() function in the kubectl wait command to allow cancellation based on the application's context. This enhancement would improve command control and responsiveness.
- issues/136780
- Kubectl Cancel Command Alias: Support for an alias to the 'kubectl cancel' command is requested to improve usability and command discoverability.
- issues/136835
- Unlabeled Closed Issue: A closed GitHub issue in the Kubernetes project has no title, body content, or comments, providing no actionable information.
- issues/136834
2.5 Issue Discussion Insights
This section will analyze the tone and sentiment of discussions within this project's open and closed issues that occurred within the past week. It aims to identify potentially heated exchanges and to maintain a constructive project environment.
Based on our analysis, there are no instances of toxic discussions in the project's open or closed issues from the past week.
III. Pull Requests
3.1 Open Pull Requests
This section provides a summary of pull requests that were opened in the repository over the past week. The top three pull requests with the highest number of commits are highlighted as 'key' pull requests. Other pull requests are grouped based on similar characteristics for easier analysis. Up to 25 pull requests are displayed in this section, while any remaining pull requests beyond this limit are omitted for brevity.
Pull Requests Opened This Week: 93
Key Open Pull Requests
1. WIP: Introduce support of DRA for Native Resources: This pull request introduces support for Dynamic Resource Allocation (DRA) specifically for Native Resources in Kubernetes, including feature gates, API changes, scheduler and kubelet updates to account for native resource claims in pod resource requests, validation enhancements, and integration of native resource claim statuses into pod lifecycle management.
- URL: pull/136725
2. KEP-5073: Declarative Validation Lifecycle Update: This pull request implements a stability-based lifecycle for declarative validation by introducing alpha, beta, and stable validation tags, transitions the Scheduling Workload v1alpha1 API to use explicit declarative enforcement under this new model, enhances testing to ensure no regressions during migration, and improves legacy support to maintain consistent validation behavior across Kubernetes versions.
- URL: pull/136793
3. apiserver: fix pod-level resource limits defaulting on update: This pull request fixes the defaulting behavior of pod-level resource limits during pod updates in the Kubernetes API server by adding feature-gated logic that sets pod-level CPU and memory limits from aggregated container limits only when pod-level requests are set, pod-level limits are omitted, and all containers specify limits, ensuring consistent behavior between create and update operations and preventing unset spec.resources.limits when PodLevelResources is enabled.
- URL: pull/136676
Other Open Pull Requests
- Declarative validation migration: Multiple pull requests migrate validation logic for various Kubernetes API fields and components to a declarative validation approach. These include StorageClass fields, scheduling API group fields like
PriorityClass.ValueandPriorityClass.PreemptionPolicy, and theControllerRevision.Datacomponent in the apps API group, improving consistency and maintainability of validation code.
- Feature gate promotions and enhancements: Several pull requests promote feature gates to GA and introduce new feature-gated functionality. This includes enabling the RestartAllContainers feature by default with improved logging and test coverage, promoting KubeletPodResourcesDynamicResources and KubeletPodResourcesGet to GA, and adding a feature-gated audit ID validation handler to enhance security.
- Pod and container runtime improvements: Pull requests add pod-level checkpoint and restore support to the CRI and improve kubelet logging for static pods with invalid priorities. These changes enhance pod lifecycle management and provide better user feedback on pod creation issues.
- pull/136807, [pull/136705](https://github.com/pull/136705]
- Documentation and code modernization: Improvements include clarifying resource.Quantity parsing documentation and modernizing Go code by replacing traditional for-loops with for-range loops and updating linting rules to use slices.Sort. These changes improve code clarity and maintainability without altering behavior.
- Build and dependency updates: Updates include upgrading the Go version to 1.24.13, decoupling kube-cross versioning, updating OpenTelemetry dependencies with new features and bug fixes, and fixing test directory structures. These changes improve build consistency, security, and compatibility with newer Go versions.
- StatefulSet and kubectl command enhancements: Additions include the
Availablecondition to StatefulSet for better readiness checks and a warning message inkubectl deleteto inform users when deletion is blocked by finalizers. These improve operational control and user experience.
- Security and validation fixes: Fixes include correcting error messages to use the validated namespace parameter, fixing overshadowed plugin detection on Windows, and adding TLS configuration flags to webhook serving options for better security and configuration flexibility.
- Test stability and race condition fixes: Pull requests address test flakiness by increasing timeout durations in integration tests and fix a data race in the apiserver CEL openapi resolver by deep copying schemas before modification. These improve test reliability and code safety.
- pull/136684, [pull/136802](https://github.com/pull/136802]
- CoreDNS and tooling updates: An automated cherry pick updates CoreDNS to version 1.14.1 and bumps the corefile-migration tool to v1.0.30, ensuring the DNS component is up to date in the release branch.
- Scheduling and workload placement improvements: A pull request adds a topology-aware workload scheduling placement generator plugin, enhancing Kubernetes scheduling capabilities by considering topology information for workload placement.
- Pod certificates API enhancements: A pull request adds a new
spec.stubPKCS10Requestfield to the pod certificates beta API for better compatibility with certificate authorities, deprecating older fields and migrating in-tree usage accordingly.
- Continuous integration and test adjustments: A work-in-progress pull request adjusts end-to-end tests to run with lower query per second rates to reduce interference in busy clusters, aiming to improve CI presubmit job stability.
3.2 Closed Pull Requests
This section provides a summary of pull requests that were closed in the repository over the past week. The top three pull requests with the highest number of commits are highlighted as 'key' pull requests. Other pull requests are grouped based on similar characteristics for easier analysis. Up to 25 pull requests are displayed in this section, while any remaining pull requests beyond this limit are omitted for brevity.
Pull Requests Closed This Week: 77
Key Closed Pull Requests
1. [WIP] DV shadow: This pull request introduces support for shadow validations in the Kubernetes declarative validation framework, enabling developers to run new declarative validation rules alongside existing imperative validators in a non-blocking "shadow" mode to facilitate safe migration, parity checking, and testing of validation logic without impacting live operations.
- URL: pull/136284
2. Automated cherry pick of #135919: kubelet(dra): fix handling of multiple ResourceClaims when one is already prepared: This pull request is an automated cherry pick of a fix that improves the kubelet's device resource allocation (dra) by correctly handling multiple ResourceClaims even when one claim is already prepared, and includes additional unit and end-to-end tests to validate this behavior.
- URL: pull/136463
3. [Implementation] PostFilterReview Extension Point: This pull request proposes the implementation of the PostFilterReview extension point in the Kubernetes scheduling framework to enable plugins to observe and react to PostFilter results unconditionally, including features like error handling, metrics, and unit tests, but it remains experimental and was not merged.
- URL: pull/136690
Other Closed Pull Requests
- Dynamic Resource Allocation (DRA) race condition fixes and improvements: Multiple pull requests address race conditions in the DRA scheduler that caused double allocation of the same device to different ResourceClaims when scheduling many pods rapidly. These fixes ensure proper event handling, synchronization, and state gathering to prevent pods from failing to start or running in parallel on the same device, with added unit and end-to-end tests validating the behavior.
- [pull/136567, pull/136564, pull/136565, pull/136566, pull/136480]
- DRA integration and end-to-end testing enhancements: Pull requests extend DRA integration tests to verify implicit extended resources and add end-to-end tests for NVIDIA T4 GPU support, including ResourceSlice detection, single GPU allocation, TensorFlow benchmarks, and shared GPU usage across containers. These tests are designed to work on AWS and GCP environments with the NVIDIA DRA driver pre-deployed, improving validation coverage for DRA features.
- [pull/136710, pull/136693]
- DRA allocator code reorganization: One pull request promotes the previous incubating DRA allocator code to stable, moves experimental code to incubating, and updates package names accordingly without introducing user-facing changes. This reorganization clarifies the status of DRA components in the codebase.
- [pull/136619]
- Route controller and network condition fixes: A pull request fixes the route controller's condition update logic by ensuring it checks both Status and Reason fields of the NetworkUnavailable condition, allowing proper updates when external CNIs like Calico have set the condition. Comprehensive tests are included to cover these scenarios.
- [pull/136561]
- Queue depth metrics for RealFIFO queue: A pull request adds identifier-based queue depth metrics for the RealFIFO queue implementation, including uniqueness checks for metric identifiers, error handling for empty or duplicate names, and unit tests to ensure proper metric registration and tracking.
- [pull/135782]
- Kube-proxy Windows dual-stack fixes: Multiple automated cherry picks fix issues in the Windows kube-proxy (winkernel) where IPv4 and IPv6 Service load balancers were incorrectly shared. These fixes track load balancers per IP family to properly support PreferDualStack and RequireDualStack Services on Windows nodes.
- [pull/136373, pull/136374, pull/136375]
- Kube-proxy topology hint log fix: A pull request fixes a bug in kube-proxy where misleading log messages about topology hints were generated when no ready endpoints existed for a service. It adds a check to track ready endpoints and returns early if none are found, with a new test case covering this scenario.
- [pull/136743]
- Feature gate testing improvements in client-go: A pull request adds the ability to update locked features in client-go testing by enabling updates using the
LockToDefaultfeature gate flag and moves the adapter for client-go feature gates to emulated versions to support advanced feature gate testing. - [pull/136694]
- New alpha metric for Cloud Controller Manager route sync: A pull request introduces a new alpha-stage metric,
route_controller_route_sync_total, to count the number of times routes are synchronized with the cloud provider. This metric supports A/B testing of theCloudControllerManagerWatchBasedRoutesReconciliationfeature gate in Kubernetes v1.35. - [pull/136539]
- Null pointer and nil handling bug fixes: Pull requests fix a nil-handling bug in the ValidatingAdmissionPolicy type checker to prevent nil dereferences and add null pointer validation in the Accessor method to prevent panics caused by unexpected null pointers, improving robustness with minimal defensive changes and added test coverage.
- [pull/136621, pull/136540]
- Unit tests for container manager and authorization API: Pull requests add unit tests for the ParsePercentage function in container_manager.go and enable a comment start check on the authorization API group to ensure comments begin with the serialized version of the field name, improving correctness and reliability.
- [pull/136476, pull/136315]
- Removal of deprecated features and functions: Pull requests remove the usage of deprecated functions from the ktesting package and remove the
DisableNodeKubeProxyVersionfeature gate, which was default since version 1.33 and scheduled for removal in 1.36, improving code quality and maintainability. - [pull/136341, pull/136673]
- Kubernetes node bootstrap script improvements: A pull request modifies the install-containerd-ubuntu script to skip apt and download binaries directly from GitHub when specific versions are specified, while disabling unnecessary Ubuntu services that interfere with apt operations to improve node bootstrap efficiency.
- [pull/136726]
- waitOptions.RunWaitContext method addition: A pull request introduces the method waitOptions.RunWaitContext() to allow passing a context that can force the wait function to exit early, enhancing control beyond relying solely on timeouts.
- [pull/136781]
- Update agnhost Windows image for e2e tests: A pull request updates the agnhost Windows image to include the fake registry server functionality, fixing broken Kubernetes end-to-end image pull tests on Windows nodes caused by recent changes that introduced the fake registry server only for non-Windows environments.
- [pull/135917]
3.3 Pull Request Discussion Insights
This section will analyze the tone and sentiment of discussions within this project's open and closed pull requests that occurred within the past week. It aims to identify potentially heated exchanges and to maintain a constructive project environment.
Based on our analysis, there are no instances of toxic discussions in the project's open or closed pull requests from the past week.
IV. Contributors
4.1 Contributors
Active Contributors:
We consider an active contributor in this project to be any contributor who has made at least 1 commit, opened at least 1 issue, created at least 1 pull request, or made more than 2 comments in the last month.
If there are more than 10 active contributors, the list is truncated to the top 10 based on contribution metrics for better clarity.
| Contributor | Commits | Pull Requests | Issues | Comments |
|---|---|---|---|---|
| pohly | 52 | 15 | 2 | 46 |
| dims | 78 | 10 | 0 | 7 |
| BenTheElder | 15 | 5 | 2 | 19 |
| bart0sh | 19 | 2 | 0 | 16 |
| tabbysable | 0 | 0 | 5 | 32 |
| AutuSnow | 21 | 6 | 0 | 0 |
| atombrella | 18 | 5 | 0 | 4 |
| yongruilin | 25 | 1 | 0 | 0 |
| darshansreenivas | 17 | 2 | 0 | 5 |
| itzPranshul | 14 | 4 | 1 | 5 |
Access Last Week's Newsletter: