Weekly GitHub Report for Kubernetes

Thank you for subscribing to our weekly newsletter! Each week, we deliver a comprehensive summary of your GitHub project's latest activity right to your inbox, including an overview of your project's issues, pull requests, contributors, and commit activity.

Table of Contents

• I. News
  • 1.1. Recent Version Releases
  • 1.2. Other Noteworthy Updates
• II. Issues
  • 2.1. Top 5 Active Issues
  • 2.2. Top 5 Stale Issues
  • 2.3. Open Issues
  • 2.4. Closed Issues
  • 2.5. Issue Discussion Insights

• III. Pull Requests
  • 3.1. Open Pull Requests
  • 3.2. Closed Pull Requests
  • 3.3. Pull Request Discussion Insights

• IV. Contributors
  • 4.1. Contributors

I. News

1.1 Recent Version Releases:

The current version of this repository is v1.32.3

1.2 Version Information:

The Kubernetes version released on March 11, 2025, introduces key updates detailed in the official CHANGELOG, with additional binary downloads available. For comprehensive information on new features and changes, users are encouraged to refer to the Kubernetes announce forum and the linked CHANGELOG.

II. Issues

2.1 Top 5 Active Issues:

We consider active issues to be issues that that have been commented on most frequently within the last week. Bot comments are omitted.

1. [KIND/BUG] [SIG/NETWORK] [TRIAGE/ACCEPTED] nf_conntrack_max in sysctls.go for kube-proxy - regression from 1.35 to 1.36 - lxc: This issue describes a regression in kube-proxy from Kubernetes version 1.35 to 1.36 where kube-proxy fails to start inside LXC containers due to permission errors when trying to set the nf_conntrack_max sysctl parameter, which is read-only inside the container. The reporter requests that kube-proxy should ignore the inability to write this value and only log a warning instead of crashing, as previous versions did not fail under these conditions.

   • The comments confirm the problem affects kube-proxy in containerized control-plane environments, discuss the underlying cause related to changes in how nf_conntrack_max is set based on core count, suggest a temporary workaround using --conntrack-max-per-core=0, and clarify that the issue stems from kube-proxy trying to overwrite a sysctl value that is not writable inside LXC, with some discussion on related sysctl parameters and their appropriate values.
   • Number of comments this week: 11

2. [SIG/NODE] [PRIORITY/IMPORTANT-LONGTERM] [KIND/FAILING-TEST] [TRIAGE/ACCEPTED] [WG/DEVICE-MANAGEMENT] [Failing-test]: ci-kind-dra-1-34 times out before DRA suite can finish: This issue describes a persistent failure in the ci-kind-dra-1-34 Kubernetes test job where the Dynamic Resource Allocation (DRA) suite times out before completion, primarily due to the job pod being OOM killed at a 6Gi memory limit rather than CPU quota issues. Investigations revealed that the high memory usage stems from the ResourceSlice Controller creating a large number of ResourceSlices and the kube-scheduler's verbose logging of these slices, leading to memory pressure that the current job memory allocation cannot sustain, prompting a proposed increase in memory limits to 12Gi to stabilize the tests.

   • The comment discussion tracked evolving diagnostics, initially suspecting CPU quota and GOMAXPROCS misconfigurations but later confirming memory pressure as the root cause; various experiments and code changes were tested, including runner fixes and memory limit increases, with consensus settling on raising job memory rather than altering production code, while clarifying misconceptions and refining the understanding of cgroup and Go runtime interactions in the CI environment.
   • Number of comments this week: 7

3. [SIG/NETWORK] [SIG/NODE] [KIND/FEATURE] [TRIAGE/ACCEPTED] why net.core.somaxconn is unsafe in k8s?: This issue questions why the kernel parameter net.core.somaxconn is marked as unsafe in Kubernetes despite being a namespaced sysctl that might be safe to use. It discusses the potential risk of kernel memory exhaustion when setting this parameter arbitrarily large and explores whether this risk is mitigated under cgroup v2, which accounts for TCP memory usage, suggesting that the parameter could be considered safe only in cgroup v2 environments.

   • The comments review past proposals and kernel documentation, highlight concerns about memory exhaustion risks under cgroup v1, and propose gating the safe usage of net.core.somaxconn on cgroup v2 support. They also discuss implementation plans for kubelet and pod-security-admission to handle this gating, with consensus on the approach and references to related Kubernetes enhancement proposals.
   • Number of comments this week: 5

4. [SIG/NETWORK] [KIND/FLAKE] [NEEDS-TRIAGE] [TRIAGE/UNRESOLVED] [Flaking Test] [sig-network] LoadBalancers ExternalTrafficPolicy: Local [Feature:LoadBalancer] should work for type=LoadBalancer [Slow]: This issue reports a flaky failure in the Kubernetes end-to-end test for LoadBalancers with ExternalTrafficPolicy set to Local, specifically for type=LoadBalancer, which has been timing out and causing test instability. The failure is observed in the ci-kubernetes-e2e-gce-cos-slow-master job and has been ongoing since July 22, 2026, with discussions indicating it may be due to infrastructure problems rather than code defects.

   • The comments reveal a back-and-forth on the flakiness status of the test, with initial triage marking it as unresolved due to infrastructure issues, followed by a temporary closure when the test was not flaky, and subsequent reopening as flakiness persisted; collaborators also requested reopening the issue to continue tracking the problem.
   • Number of comments this week: 5

5. [KIND/BUG] [SIG/APPS] [NEEDS-TRIAGE] Deployment controller enters infinite ReplicaSet churn when a gated PodTemplateSpec field is disabled while in use , affects any feature using the standard "preserve if in use" drop pattern: This issue describes a bug where disabling a feature-gated PodTemplateSpec field on the kube-apiserver while a Deployment still uses that field causes the Deployment controller to enter an infinite loop of creating new ReplicaSets, never reaching a stable state. The root cause is that the ReplicaSet creation process strips the disabled field without recognizing it is still in use by the Deployment, leading to a persistent mismatch between the Deployment's desired template and the ReplicaSet's template.

   • The comments discuss the appropriate SIG ownership, with SIG apps taking responsibility, and propose a fix involving dropping disabled fields before comparison in the Deployment controller to prevent infinite ReplicaSet churn; collaboration offers and clarifications on the structural cause of the bug are also shared.
   • Number of comments this week: 5

2.2 Top 5 Stale Issues:

We consider stale issues to be issues that has had no activity within the last 30 days. The team should work together to get these issues resolved and closed as soon as possible.

As of our latest update, there are no stale issues for the project this week.

2.3 Open Issues

This section lists, groups, and then summarizes issues that were created within the last week in the repository.

Issues Opened This Week: 29

Summarized Issues:

• Kubelet Pod Lifecycle and Cgroup Handling: Kubelet logs error-level messages when reading cgroup configurations for terminating pods whose cgroups have already been removed, causing unnecessary error logs due to a timing race condition during pod teardown. Additionally, kubelet fails to start if the user namespace ID pool changes between restarts while pods with user namespaces exist, due to persisted pod mappings falling outside the new pool range, leading to initialization failure without clear recovery guidance.
• issues/141927, issues/141941

• Kube-proxy Startup and Sysctl Permissions: A regression in kube-proxy from version 1.35 to 1.36 causes kube-proxy running inside LXC containers to fail startup due to a permission denied error when setting the nf_conntrack_max sysctl parameter. This results in container crashes instead of ignoring the unwritable setting or logging a warning.
• issues/141943

• CustomResourcePublishOpenAPI Test Flakiness: Multiple flaking failures occur in the CustomResourcePublishOpenAPI test due to timeouts and transient errors when the OpenAPI spec is updated, renamed, or removed for different CRDs, versions, and kinds. These intermittent failures cause validation timeouts and API server connectivity issues during Kubernetes end-to-end tests on specific GCE environments.
• issues/141949, issues/141950, issues/141951, issues/141952

• Scheduler PodAffinity Requeue Bug: Pods blocked by a required podAffinity term with a namespaceSelector are not requeued for scheduling when a matching pod is added or when namespace labels change, causing these pods to remain Pending until a periodic sweep triggers scheduling.
• issues/141953

• Deployment Controller Infinite Loop on Disabled Fields: Disabling a feature-gated PodTemplateSpec field on the kube-apiserver while a Deployment uses that field causes the Deployment controller to enter an infinite loop creating and replacing ReplicaSets. This happens due to a mismatch in how disabled fields are dropped during ReplicaSet creation, preventing Deployment convergence.
• issues/141961

• Kubelet Subordinate ID Range Fallback Bug: The kubelet fails to use the configured subordinate ID range for a local kubelet account when the getent command is missing from the system PATH, incorrectly assuming the account is missing and falling back to a default ID range instead of reading actual configuration files.
• issues/141970

• Windows Feature Gates and Test Cleanup: Cleanup is needed to remove the deprecated WindowsHostNetwork feature's constants, test exemptions, and dead code, as well as to remove obsolete WinDSR and WinOverlay feature gates and related code since these features have reached general availability and are overdue for removal.
• issues/141987, issues/141988

• Memory Manager Pod Checkpoint Restoration Bug: The Memory Manager incorrectly accepts an incomplete pod-level checkpoint as fully restored after a kubelet restart, leading to missing container memory assignments and machine reservations that should prevent successful admission.
• issues/141993

• DRA Kubelet Plugin Socket Path Length Bug: The DRA kubelet plugin helper can generate rolling-update service socket paths exceeding the maximum allowed length for AF_UNIX pathname endpoints, causing socket endpoint failures when using long driver names and rolling updates.
• issues/142002

• gRPC Dependency Management Issue: grpc-go version 1.83.0 and later introduces an unwanted direct dependency on the cloud.google.com/go/auth module, which pulls in three undesired modules, complicating dependency management for all future grpc upgrades.
• issues/142005

• Fibre Channel Volume Teardown Incomplete Cleanup: The in-tree Fibre Channel raw block volume teardown process skips current-device SCSI or multipath cleanup if the recorded device path is stale or missing, prematurely returning success without attempting stable-identity discovery, potentially causing incomplete device teardown.
• issues/142008

• Deprecated Topology Labels Deprecation Tracking: Investigation and documentation are underway for the usage of three deprecated Kubernetes topology-related labels across the codebase and website to support a renewed deprecation cycle, including identifying references, planning user warnings, and guiding eventual removal.
• issues/142011

• Custom Resource Lifecycle Management Proposal: A design proposal seeks to manage the lifecycle of high-cardinality, short-lived Kubernetes Custom Resources by persisting their dormant state externally to reduce control-plane overhead, requesting guidance on lifecycle-aware persistence and reactivation patterns.
• issues/142016

• CRI Container and Pod List Performance Enhancements: Two opt-in enhancements are proposed for CRI container and pod list calls: field projection to request only necessary fields and delta listing to receive only changed containers since the last relist, aiming to reduce kubelet's PLEG memory and CPU overhead on high-churn nodes.
• issues/142022

• Container CrashLoopBackOff Inconsistent Backoff: Containers that fail to start before ever running do not receive exponential CrashLoopBackOff backoff treatment or status events, resulting in inconsistent retry behavior compared to containers that fail after starting.
• issues/142032

• Dynamic Resource Allocation Extended Resource Test Flakiness: The Dynamic Resource Allocation Extended Resource feature test flakes due to timing dependencies causing the test pod to miss the "Running" phase and report "Succeeded," leading to intermittent failures in cleaning up extended resource claims.
• issues/142040

• kubectl Patch Validation Bug: Setting the --type flag to an empty string in kubectl patch bypasses validation and incorrectly attempts to connect to the API server instead of returning a validation error.
• issues/142058

• Kube-apiserver Watch Cache Memory Amplification: The kube-apiserver's watch cache stores every cached resource object fully decoded in memory, causing unbounded and excessive memory consumption, especially for large custom resources, because metadata-only requests still incur full memory cost. Proposed fixes include storing serialized objects or implementing byte-budget limits per resource.
• issues/142062

• Kube-proxy iptables nfacct Match Assumption Bug: Kube-proxy's iptables mode incorrectly assumes the availability of the iptables nfacct match extension based on netlink presence, causing iptables-restore failures on kernels lacking xt_nfacct and resulting in loss of Service rules and pod network connectivity.
• issues/142068

• Resource Quota Controller Memory Leak: Event handlers registered on shared informers for monitored resources are not removed when those resources are deleted, causing accumulation of goroutines and increased memory usage in kube-controller-manager.
• issues/142072

• Go net/http Upstream Test Failures: The ci-kubernetes-unit-golang-tip test has been failing due to two upstream bugs in the Go net/http package introduced by a specific Go tip commit, causing intermittent Kubernetes test failures unrelated to Kubernetes code.
• issues/142079

• Volume Metrics Test Flakiness Due to CSI Driver Name Collision: A flaking test failure in volume metrics provisioning specs is caused by a name collision between two CSI test drivers with similar prefixes, leading to incorrect metric selection and indefinite test timeouts.
• issues/142080

• Volume Metrics PVC Test Intermittent Failures: The Volume metrics PVC test intermittently fails to create metrics for total time taken in volume operations within the P/V Controller, with errors related to missing expected metric labels during test execution.
• issues/142090

• ImageGCNoEviction Test Flakiness on DiskPressure Condition: The ImageGCNoEviction test intermittently fails to observe the DiskPressure node condition, causing timeouts and preventing expected pod eviction due to unreliable disk pressure triggering on Fedora CoreOS and CRI-O runtime environments.
• issues/142091

2.4 Closed Issues

This section lists, groups, and then summarizes issues that were closed within the last week in the repository. This section also links the associated pull requests if applicable.

Issues Closed This Week: 43

Summarized Issues:

• Kubeconfig Merging and Defaults: This issue proposes that kubectl should automatically merge multiple .kubeconfig files from standard locations to provide seamless access to all clusters, users, and contexts without manual merging. It also suggests keeping fields like CurrentContext and Preferences only in ~/.kube/config to avoid conflicts.
• issues/9298

• Resource Quantity Parsing and Validation: Multiple issues highlight bugs and discrepancies in the parsing and validation of Kubernetes resource quantities, including rejection of valid decimal exponent formats, incorrect parsing of very large integers near math.MaxInt64, and a bug causing NaN results for zero quantities with large scale. These problems lead to errors, validation failures, and incorrect resource handling.
• issues/109839, issues/135487, issues/139894

• Volume Detachment and Mounting Delays: There are issues where volumes fail to detach promptly after pod deletion due to being incorrectly marked as still mounted, causing delays up to five minutes, and flaky kubelet volumemanager tests caused by timing-dependent race conditions that reject unmount retries. These problems result in intermittent failures and delays in volume lifecycle management.
• issues/117042, issues/140823

• OpenAPI Description and Documentation Consistency: Ensuring OpenAPI description fields conform to CommonMark Markdown standards improves consistency and reduces heuristic parsing in documentation and tooling. This standardization enhances rendering accuracy and developer experience.
• issues/125020

• ResourceFieldRef Divisor Default Discrepancy: The documented default divisor value of 1 in ResourceFieldRef is incorrectly set to 0 in manifests, causing synchronization issues with tools like ArgoCD. This mismatch leads to unexpected behavior in resource referencing.
• issues/128865

• CEL Function Usage and Compiler Updates: The includes CEL function no longer requires limiting to attributes[x] targets due to improvements in the standard library, and a custom registration block for IncludesOption was removed as the function is now natively supported starting with CEL version 1.37. These changes simplify CEL usage and compiler maintenance.
• issues/137901, issues/140074

• Scheduler Flaky Tests and Scheduling Logic Issues: Several flaky test failures in scheduler preemption and plugin tests reveal timing and priority scheduling inconsistencies, including ignoring nominated node names in TAS scheduling and generic error handling for resource allocation failures. These issues cause intermittent test failures and suboptimal pod placement decisions.
• issues/138268, issues/139348, issues/140598, issues/141829

• CPU and Device Resource Allocation Affinity Problems: The CPUManager shrinks CPU allocations to fewer NUMA nodes than requested when combined with GPU allocations, causing topology misalignment, and device request Count fields lack overflow safety, risking corrupted quota accounting. These issues affect resource allocation accuracy and stability.
• issues/139430, issues/140424

• Client-Go Data Race and Test Failures: A data race in client-go/rest's TestRequestMaxRetries was fixed by adding mutex synchronization to prevent concurrent access issues during HTTP retries, improving test reliability and client stability.
• issues/140345

• Cluster Scale and Node Provisioning Failures: Persistent failures in large-scale cluster tests occur due to a single node VM failing to join the cluster, causing timeouts, and flaky kubetest2.Up tests intermittently fail due to errors in e2e-up.sh execution, impacting cluster provisioning reliability.
• issues/140642, issues/140752

• Ingress Command Validation Bug: The kubectl create ingress command accepts malformed trailing data in the --rule flag, silently dropping TLS configuration and resulting in Ingress resources missing the intended TLS spec. This client-side validation bug leads to misconfigured ingress resources.
• issues/140922

• EventSeries Metadata Parsing Errors: The EventSeries type lacks the +structType=atomic marker, causing managedFields metadata to include a "." field name that breaks parsing in Elasticsearch/OpenSearch pipelines, leading to indexing errors for Event objects.
• issues/140957

• Memory Manager Pod-Scope Restore Failures: After kubelet restarts, the Memory Manager incorrectly compares container memory blocks with the entire pod memory request, failing to restore NUMA hints and potentially causing admission failures for multi-container pods under certain topology policies.
• issues/141069

• Container Status and Probe Ordering Bug: After a container restarts due to a liveness probe failure, the status incorrectly shows started=true and liveness probes begin before startup probes complete, violating expected Kubernetes probe sequencing behavior.
• issues/141155

• Integer Overflow in Device Allocation Checks: The structured allocator's device-count summation can overflow int64, causing acceptance of oversized device requests; proposed fixes include rejecting requests exceeding claim limits before summation to prevent this error.
• issues/141323

• Scheduler Dependency Cleanup: Multiple issues propose removing dependencies on core validation, image utilities, and controller packages in the scheduler by replacing constants and functions with local definitions or strings, simplifying code and reducing external dependencies.
• issues/141410, issues/141495, issues/141497

• Workload and PodGroup Naming Standardization: Moving unique deterministic name generation logic into a shared workloadBuilder library aims to standardize naming across controllers, reducing bugs and easing integration.
• issues/141555

• LimitRange Default Field Documentation Clarification: Clarifying the godoc comment for the LimitRange default field explicitly distinguishes it from defaultRequest, improving documentation accuracy without changing API behavior.
• issues/141565

• Node E2E Flaky Test on HTTP Liveness Probe: A flaky node e2e test shows unexpected container restarts when using a non-local redirect HTTP liveness probe, contrary to expected zero restarts, indicating a timing or probe handling issue.
• issues/141614

• PersistentVolume Capacity Comparison Overflow: The PersistentVolume controller uses an int64-overflowing method to compare storage capacities, causing incorrect PVC acceptance or rejection when capacities exceed int64 limits; fixing this requires proper comparison methods.
• issues/141617

• iSCSI Volume Detach Failure: The in-tree iSCSI volume plugin's DetachBlockISCSIDisk function fails to complete teardown when device path links are missing after session loss, leaving volumes stuck in use and requiring manual intervention or kubelet restart.
• issues/141839

• Security Vulnerabilities and CVE Fixes: Several CVEs are reported, including denial-of-service vulnerabilities in React Router (CVE-2026-56855), Go x/crypto/ssh (CVE-2026-78662), and gRPC-Go xDS servers (CVE-2026-84445), requiring updates to dependencies to fix deadlocks, crashes, and denial-of-service issues.
• issues/141884, issues/141885, issues/141974

• DRA ResourceSlice Stale Usage: A DRA ResourceSlice remains valid and used by the scheduler after its driver becomes unavailable, causing pods to be scheduled onto unusable resources without warnings or recovery, leading to stuck pods and scheduling failures.
• issues/141912

• Kubelet User Namespace ID Range Inconsistency: The getKubeletMappings() function picks different user namespace ID ranges depending on whether the kubelet binary is built with cgo, causing inconsistent subordinate ID range selection especially when the kubelet user is from a directory service.
• issues/141940

• Race Detection for Kubelet Static Builds: Adding kubelet to the KUBE_CGO_OVERRIDES environment variable in source-built race detection jobs ensures static kubelet binaries carry race instrumentation, maintaining consistency with other control plane components.
• issues/141942

• Client Library Build Error Due to Package Version Mismatch: A build error caused by type mismatches between different versions of the structured-merge-diff package in Kubernetes client libraries v0.37.0 prevents compilation until fixed.
• issues/141957

• Pod Liveness Probe HTTP2 Validation Missing: The API server does not enforce validation for HTTP2 protocol settings combined with HTTPS or non-empty host in pod liveness probes, silently dropping the protocol field instead of rejecting invalid pods.
• issues/141973

• Upstream net/http Bug Causing Kubelet Test Failures: A persistent test failure in the ci-kubernetes-e2e-kind-golang-tip job is caused by an upstream Go net/http bug that cancels request contexts on idle keep-alive connections, leading to cascading kubelet HTTP server failures under load; this is tracked upstream and not a Kubernetes bug.
• issues/141992

• Namespace-Scoped RoleBinding Grants Cluster-Scoped Permissions: A namespace-scoped RoleBinding can unintuitively grant write permissions on the cluster-scoped namespace resource itself, potentially leading to privilege escalation and security risks in multi-tenant clusters.
• issues/142024

2.5 Issue Discussion Insights

This section will analyze the tone and sentiment of discussions within this project's open and closed issues that occurred within the past week. It aims to identify potentially heated exchanges and to maintain a constructive project environment.

Based on our analysis, there are no instances of toxic discussions in the project's open or closed issues from the past week.

III. Pull Requests

3.1 Open Pull Requests

This section provides a summary of pull requests that were opened in the repository over the past week. The top three pull requests with the highest number of commits are highlighted as 'key' pull requests. Other pull requests are grouped based on similar characteristics for easier analysis. Up to 25 pull requests are displayed in this section, while any remaining pull requests beyond this limit are omitted for brevity.

Pull Requests Opened This Week: 102

Key Open Pull Requests

1. WIP: update go-jose and go-oidc packages to latest versions: This pull request updates the go-jose and go-oidc packages to their latest major versions (v4 and v3 respectively), addressing previous issues encountered during dependency bumps and making necessary code changes across the Kubernetes codebase to ensure compatibility with these updated libraries.

• URL: pull/142012

• Associated Commits: d3340, 6f63e, 9b77c, b4a2f, 0c659, e8e3a, e0110, 0abf4, 6a035, 811c0, 8837f, 44ff1, 10ceb, 71b98

2. Conditional Authz [4/n]: Add conditional authz support to kube-apiserver: This pull request adds support for conditional authorization to the kube-apiserver by introducing a new WithConditionsAwareAuthorization HTTP filter and an AuthorizationConditionsEnforcer admission plugin, enabling the server to evaluate authorization requests based on specified conditions as part of the Kubernetes authorization framework.

• URL: pull/141959

• Associated Commits: 08acf, de589, c10e9, 97fd2, 0c76d, 157c3, 2c1a0, 474bb, aecae, b75dd, 39aa7, 3e9a1, db222

3. fix: don't return an error for empty resource in memory cached discovery client: This pull request fixes a bug in the memory cached discovery client where functions like ServerResourcesForGroupVersion incorrectly return an error when encountering an empty APIResources response, ensuring that empty discovery responses are properly tolerated without causing group discovery failures.

• URL: pull/141963

• Associated Commits: 070c3, a9904, 75d92, f4b73, 07b45, 6e468, 77d16, e03fe

Other Open Pull Requests

• InsecurePodWarnings feature gate: This pull request introduces an alpha feature gate InsecurePodWarnings that enables the kubelet to detect and warn about containers implicitly running as root without explicitly setting runAsUser or runAsGroup. It adds new pod conditions, emits throttled warning events, and reports related gauge metrics to improve security visibility for such insecure container UID/GID configurations.
  • pull/142074

• DynamicResourceAllocation removal: This pull request removes the DynamicResourceAllocation feature gate from the Kubernetes codebase, making dynamic resource allocation unconditionally enabled. This change follows the feature being locked to default on in version 1.35 and eligible for removal after three releases in version 1.38.
  • pull/141946

• PodGroup runtime hierarchy validation: This proof of concept pull request validates the runtime hierarchies of pod groups within the kube-scheduler by adding status updates, validation error exposure, and related constants. It assesses the work required to implement this feature in the scheduler.
  • pull/142004

• kubectl alias enhancements: This pull request adds the display of kuberc aliases to the kubectl help output using a dedicated CommandGroup, includes warnings for alias duplication and invalid preferences, and improves alias descriptions. These changes enhance the user experience when working with kubectl aliases.
  • pull/142010

• Kubelet cAdvisor volume stats fix: This pull request fixes a bug in the kubelet's cAdvisor stats provider by ensuring volume statistics for Running pods are retained during container restart backoff periods. It preserves Summary API volume stats and PVC metrics for pods whose volumes remain mounted even when container samples are filtered out.
  • pull/141977

• kube-proxy nf_conntrack_max regression fix: This pull request modifies kube-proxy to avoid lowering the nf_conntrack_max sysctl value if it is already set higher than needed. It fixes a regression introduced in version 1.36 that caused kube-proxy to fail on systems with manually configured higher values.
  • pull/142035

• +k8s:setByServer validation tag: This pull request introduces the +k8s:setByServer validation tag to the validation-gen code generator, enabling fields annotated with this tag to be treated as effectively required because they are set by a custom server-side defaulter. It includes comprehensive test coverage and supports both direct field markers and targeted subfield markers without altering shared struct definitions.
  • pull/142087

• Core API group comment linting: This pull request addresses linting issues by ensuring comments in the core API group start with the serialized version of the field name. This improves code consistency and readability.
  • pull/142030

• Apiserver watch cache object matching improvements: This pull request improves the object matching logic in the apiserver watch cache by simplifying and consolidating feature gate checks within SelectionPredicate.Matches(). It removes redundant gate checks, optimizes match ordering for performance, and ensures consistent handling of wrapped objects and test predicates, enhancing code clarity and efficiency without user-facing changes.
  • pull/142031

• Delegated PodGroup creation eligibility fix: This pull request fixes a bug by modifying eligibility checks for delegated PodGroup creation to prevent the creation window from closing prematurely. It ensures delegated PodGroups can be created on later syncs when the parent Workload becomes discoverable, not only during the Job's first reconcile.
  • pull/142034

• ML-DSA encryption algorithm support: This pull request adds support for the ML-DSA encryption algorithm by allowing "ML-DSA-44", "ML-DSA-65", and "ML-DSA-87" as valid values for the ClusterConfiguration.EncryptionAlgorithm in kubeadm. It also corrects the keyEncipherment bit setting to apply only to RSA keys.
  • pull/142037

• Startup probe gating bug fix (cherry picks): These automated cherry picks fix a bug ensuring liveness and readiness probes do not run before the startup probe succeeds after a container restart. This improves probe gating behavior and container health check accuracy in Kubernetes.
  • pull/142041, pull/142042, pull/142043

• VolumeAttachment validation graduation: This pull request graduates the declarative validation tags for the VolumeAttachment resource from beta to stable. It enhances API validation stability and removes redundant checks in strategy tests.
  • pull/142056

• kubectl get command refactor: This pull request refactors the kubectl get command by removing direct passing of arguments and factory dependencies to the Run() function. Instead, it stores necessary values in GetOptions during the Complete() phase to streamline command execution and align with newer command patterns.
  • pull/142057

• Watch cache memory budget enforcement: This pull request introduces a new --watch-cache-max-bytes-per-resource flag to the kube-apiserver to enforce a memory byte budget per resource in the watch cache. It implements dynamic byte-budget tracking and a circuit-breaker mechanism to bypass the watch cache and delegate requests directly to etcd when the budget is exceeded or set to zero, preventing out-of-memory issues caused by large or heavily-populated cached objects, and adds related Prometheus metrics and tests.
  • pull/142066

• Scheduler node resource scoring bug fix: This pull request fixes a bug in the Kubernetes scheduler where after an HTTP extender filter with nodeCacheCapable=false, nodes were incorrectly wrapped in empty NodeInfo objects causing resource scoring plugins to see zero requested CPU and memory. It reuses the original NodeInfo from the input list to ensure accurate node resource scoring.
  • pull/141919

• kubectl auth reconcile panic fix (cherry picks): These automated cherry picks fix a panic in kubectl auth reconcile when an error occurs during reconciliation of RoleBinding or ClusterRoleBinding resources. This addresses crashes in downstream controllers like Argo CD without requiring an upgrade to a new minor version.
  • pull/141920, pull/141921

• Preemption plugin eviction preference update: This pull request modifies the default Kubernetes preemption plugin to prefer evicting same-priority pods whose replacements can be rescheduled on other nodes over hard-pinned pods like DaemonSet pods or those with restrictive nodeSelectors. This prevents scenarios where evicting a pinned pod leads to permanently unschedulable replacements and improves cluster recovery in preemption decisions.
  • pull/141926

• Topology-aware scheduling metrics parameterization: This pull request parameterizes topology-aware scheduling candidate placement metrics with the entity type label to support both CompositePodGroup and standard PodGroup workloads. It enhances scheduling simulation by generating and evaluating metrics recursively for nested PodGroups.
  • pull/141929

• Composite pod group validation bug fix: This pull request fixes a bug in composite pod group validation during the scheduling cycle by ensuring child CompositePodGroups and PodGroups have the same priority and preemptionPolicy as their root group. It also renames the function GetUnscheduledPods to GetAllUnscheduledPods for clarity.
  • pull/141930

• client-go test nil pointer fix: This pull request fixes a bug in the client-go test TestConfigToExecClusterRoundtrip by correcting a nil pointer dereference issue where the test incorrectly dereferenced actualErr in both cases instead of referring to expectedErr when appropriate.
  • pull/141931

• PodGroup preemption code refactor: This pull request refactors the PodGroup preemption code to enable injection of custom logic for victim ordering, grouping, and preemption actuation. It allows external components like Kueue to customize preemption behavior and simulate it without actual actuation while preserving existing scheduler logic.
  • pull/141932

3.2 Closed Pull Requests

This section provides a summary of pull requests that were closed in the repository over the past week. The top three pull requests with the highest number of commits are highlighted as 'key' pull requests. Other pull requests are grouped based on similar characteristics for easier analysis. Up to 25 pull requests are displayed in this section, while any remaining pull requests beyond this limit are omitted for brevity.

Pull Requests Closed This Week: 159

Key Closed Pull Requests

1. Conditional Authz [4/4]: Add in-tree evaluation: This pull request implements in-tree evaluation for conditional authorization in Kubernetes by adding a CEL (Common Expression Language) evaluator and integrating it end-to-end within the webhook authorizer to support conditions-aware access control.

• URL: pull/139335

• Associated Commits: 9a636, cbc53, 1581f, 5e96e, be9ac, 2d436, cca6a, bb779, ffd37, b4893, 01a99, d5d60, 8bc2a, c42cf, 5bdb4, 1b40e, 79ffb, d7016, 5b443, 4a6f5

2. WIP: ktesting documentation + cleanup + enhancements: This pull request enhances the ktesting package by adding comprehensive documentation and examples, cleaning up code such as removing redundant tCtx.Cancel calls, improving backtrace capturing for errors, refining logger consistency, and enhancing progress reporting to better track running tests.

• URL: pull/141519

• Associated Commits: e7581, 49a95, 277e4, 353b1, 488b5, 84929, 920d4, 34737, 303fb, bf746

3. validation-gen: Re-enable nested +k8s:subfield validations: This pull request re-enables nested +k8s:subfield validations in the Kubernetes validation generator by fixing nil pointer dereference panics and addressing related issues such as proper short-circuit behavior, correct cohort naming and nesting, and rejecting invalid non-error validations to ensure robust and accurate validation code generation.

• URL: pull/141945

• Associated Commits: 8bff4, cdc13, 4bd2f, 689b8, 93318, 6e64b, 0d6bd, 8e7c1, 485cf, 27f75

Other Closed Pull Requests

• Resource Quantity Parsing and Handling: Multiple pull requests address bugs and improvements in the parsing and handling of resource quantities near the maximum int64 value. These changes ensure accurate parsing using fast integer paths, prevent silent overflow wrapping by saturating values, and add new accessor methods to safely report int64 overflow, improving reliability in resource quantity management.
  [pull/138076, pull/141938, pull/141305, pull/141203, pull/141424, pull/141203]

• Apiserver Watch Cache and List Optimization: Several pull requests improve the Kubernetes apiserver watch cache by refactoring object matching logic, consolidating feature gate checks, and optimizing list streaming from immutable snapshots. These enhancements reduce duplicated logic, improve memory usage, and make metrics more accurate without changing client-visible behavior.
  [pull/141279, pull/140896]

• Scheduler Enhancements: Pull requests enhance the Kubernetes scheduler by ensuring stable sorting during pod preemption through elimination of time.Now(), and by prioritizing the NominatedNodeName in Topology-Aware Workload Scheduling placement decisions. These changes improve scheduling correctness and respect pod nomination preferences.
  [pull/139210, pull/139472]

• Pod and Container Lifecycle Fixes: Fixes include correcting startup probe gating after container restarts to prevent premature liveness/readiness probe success, and ensuring CPU quota status is set correctly when resizing pods with exclusive CPUs. These changes improve pod lifecycle handling and resource status accuracy.
  [pull/141342, pull/140249]

• API and Validation Improvements: Pull requests migrate validation logic to declarative validation, add optional and required markers to volume-related API types, and improve validation-gen tool to resolve cross-package validation calls within modules. These efforts enhance API schema accuracy and validation flexibility.
  [pull/137030, pull/140587, pull/141874]

• Feature Gate and Cleanup: Some pull requests remove locked or generally available feature gates such as MultiCIDRServiceAllocator, DisableAllocatorDualWrite, CustomResourceFieldSelectors, and CRDValidationRatcheting, along with related tests and version emulation code, as part of cleanup efforts.
  [pull/141762, pull/141207]

• Kubectl and CLI Optimizations: Improvements include memoizing certificate and key file reads to reduce redundant I/O, fixing kubectl delete to handle permission errors gracefully without hanging, and rounding byte-based resource quantities in kubectl describe for better readability.
  [pull/141515, pull/141767, pull/141424]

• Metrics and Instrumentation: A pull request adds request metrics for the aggregated OpenAPI v2 endpoint, aligning it with existing OpenAPI v3 metrics to improve observability of API server requests.
  [pull/140733]

• Kubelet and Build Improvements: Updates include building the kubelet as a static binary with CGO disabled by default for better portability and fixing user namespace ID lookup using the getent command to support NSS-managed user accounts.
  [pull/135870]

• Bug Fixes in Quantity Parsing and Cancellation: Fixes include adding bounds checks to reject decimal exponents outside int32 range in quantity parsing to prevent silent truncation, and improving automatic cancellation in the ktesting framework to avoid race conditions and premature context cancellation.
  [pull/141203, pull/142015]

• OpenAPI Schema Fixes: A pull request marks versioned EventSeries types as atomic in OpenAPI schemas to prevent problematic field entries that break Elasticsearch/OpenSearch event pipelines, fixing a known issue.
  [pull/141086]

3.3 Pull Request Discussion Insights

This section will analyze the tone and sentiment of discussions within this project's open and closed pull requests that occurred within the past week. It aims to identify potentially heated exchanges and to maintain a constructive project environment.

Based on our analysis, there are no instances of toxic discussions in the project's open or closed pull requests from the past week.

IV. Contributors

4.1 Contributors

Active Contributors:

We consider an active contributor in this project to be any contributor who has made at least 1 commit, opened at least 1 issue, created at least 1 pull request, or made more than 2 comments in the last month.

If there are more than 10 active contributors, the list is truncated to the top 10 based on contribution metrics for better clarity.

Access Last Week's Newsletter:

• Link