LWKD: Week Ending October 25, 2026

LWKDOct 31, 2026

Last Week in Kubernetes Development

Week Ending October 25, 2026

Developer News

SIG ContribEx has updated the repo creation guidelines and the WG governance document to clarify how Working Groups relate to code ownership and repository creation, giving future WG proposals a clearer path from charter to code.

SIG Architecture has added notes on future conformance in the developer guide, outlining how upcoming conformance work (including the newly formed WG Workload Conformance) will relate to existing conformance definitions.

SIG ContribEx is coordinating KubeCon EU 2027 Project Pavilion and PR participation for SIGs, WGs, Committees, and Subprojects; interested groups should submit the registration form by November 25.

The Maintainer Summit NA 2026 unconference is accepting topic ideas; sessions are open community-led discussions and need only a topic, a note-taker, and a facilitator attending in Salt Lake City.

The SIG Scheduling leadership change proposed last week has taken effect after lazy consensus closed on October 26: Heba Elayoty is now a SIG Chair, Matt Matejczyk is a SIG Tech Lead, and Kensei Nakada has stepped down from Chair while remaining a Tech Lead.

Release Schedule

Next Deadline: Code Freeze, November 16th (AoE)

November patch releases are targeted for November 10, with cherry-pick PRs due November 6.

Featured PRs

143463: KEP-5710: Log error when PostFilter plugin does not implement PodGroupPostFilterPlugin

jdzikowski added a scheduler initialization check for plugins that implement PostFilter but not PodGroupPostFilterPlugin, as part of KEP-5710. With the GenericWorkload feature gate enabled, the scheduler now logs an error when an enabled plugin will be skipped during scheduling for a PodGroup or CompositePodGroup. Previously, this behavior could go unnoticed, potentially leaving workload-aware scheduling integrations without the expected post-filtering behavior. The check also fulfills one of the KEP's graduation criteria for General Availability.

143387: KEP-5491: Adds integration and e2e test for List Type Attributes

everpeace added integration and end-to-end tests for list-typed matchAttribute and distinctAttribute constraints in Dynamic Resource Allocation (DRA), as specified by KEP-5491. The tests exercise allocation against a real API server and scheduler, covering intersecting and disjoint attribute lists, scalar-to-list matching, and distinctness constraints. These cases help verify that device allocation behaves correctly across different attribute combinations and provide coverage required by the KEP's test plan for beta promotion in Kubernetes v1.38.

KEP of the Week

KEP-6268: Stall and Resume Slow Watch Streams

A slow watch client can fill its kube-apiserver buffer, delaying other watchers before the server force-closes its stream. KEP-6268 instead marks that watcher unsynced, catches it up from shared watch-cache history, and resumes it on the same connection. If the needed events have aged out, the server sends 410 Gone. Clients and the API need no changes.

@nami-ant and @rpb-ant authored the KEP for SIG API Machinery. They revised the design in September to share catch-up work across watchers, following etcd's model. The KEP merged October 1, while the kube-apiserver implementation remains under review behind the off-by-default WatchCacheStallResume gate. KEP-6268 is implementable and targets Alpha in v1.38; Beta and Stable milestones are TBD.

Other Merges

Fix for a kubelet bug that set pod sandbox CPU and memory limits to the partial sum of container limits when only some containers declared them
kube-scheduler's preemption disruption metric gains a victim label; PreemptionVictim gains a Type() method and PreemptionCandidate.NumPodGroupDisruptions() is replaced by NumDisruptionsByVictimType()
MutatingAdmissionWebhook config gains a staticOrder field to control manifest vs. API-registered webhook ordering; requires the ManifestBasedAdmissionControlConfig gate and must be removed before downgrading to v1.37 or earlier
A new evictionrequest-controller creates Evictions from EvictionRequests and coordinates external responders
Add cgroup_mount_mode to the CRI API to support writable cgroups
kubectl selector commands like create pdb --selector now accept !=
client-go adds DropManagedFields to omit managedFields from API responses, behind the new alpha ManagedFieldsOptOutClient gate
kubelet adds the alpha kubelet_device_plugin_devices metric, breaking device counts down by health state
Watch cache keeps the last snapshot behind the compaction window, avoiding etcd fallback for Exact LIST
Workload-aware scheduling: Pod scheduling status now names its parent PodGroup and PlacementFeasible counts are clearer, stricter CompositePodGroup validation, recursive status propagation, nodes with empty topology label values skipped as placement domains, multiple placement plugins intersected, and TopologyAwareWorkloadScheduling promoted to Beta (still disabled by default)

Subprojects and Dependency Updates

etcd has released v3.7.3, v3.6.16, and v3.5.35, including multiple security patches, as well as fixing a few v3.7 regressions.
vertical-pod-autoscaler v1.8.1 and vertical-pod-autoscaler v1.7.3 were both released. They are built with Go 1.26.10, blocking the compromised eMudhra intermediate CAs.
etcd v3.7.3: New patch release, see CHANGELOG; also v3.6.16, v3.5.35
coredns v1.15.0: Fixes CVE-2026-56865, CVE-2026-56864, CVE-2026-33818, CVE-2026-97032, CVE-2026-78659, CVE-2026-97031, and CVE-2026-111943; adds DNS-over-QUIC forwarding support, opt-in JSON query logging, and authenticated RFC 2136 dynamic DNS updates
prometheus v3.15.1: Builds with Go 1.27.3 and bumps golang.org/x/net to v0.60.0 to fix HTTP/2 vulnerabilities; also v3.13.5
vsphere-csi-driver v3.8.0: Adds support for Kubernetes 1.36, upgrades csi-proxy to v2.0.0-alpha.2, and bumps Go dependencies to address CVEs

Shoutouts

No shoutouts this week. Want to thank someone for special efforts to improve Kubernetes? Tag them in the #shoutouts channel.

LWKD is a publication of Kubernetes Project Contributor Communications. Read it on the web, and contribute or send corrections to the GitHub repository.