Who contributed to Kubernetes on May 31, 2026?

3 developers shipped this update, including hakman, ekam-walia, and dddddai.

What were the notable Kubernetes updates?

channels: surface addon apply failures via a readiness probe, Default omitted authorization to RBAC instead of AlwaysAllow, and cilium: allow disabling masquerade in ENI IPAM mode.

@kubernetes

Container orchestration - what platform teams ship on

github ↗

Pick a date

Topics: Go Infrastructure Full archive →

The Wire · Showcase

KOPS HARDENS DEFAULTS, KUEUE SPLITS TEST SUITES, ADDON FAILURES NOW VISIBLE

By RepoJournal · Filed 06:01 UTC on May 31, 2026 · About Kubernetes

3 people shipped this

hakman @hakman 2 cited

ekam-walia @ekam-walia 1 cited

dddddai @dddddai 1 cited

KOps flipped authorization to RBAC by default [ref:14], surfaced hidden addon failures through readiness probes [ref:13], and unlocked Cilium's no-masquerade mode on ENI [ref:15], while test-infra split Kueue's multikueue testing into baseline and extended coverage [ref:10].

Three critical KOps changes ship this morning: authorization now defaults to RBAC instead of AlwaysAllow when omitted from cluster specs [2], closing a silent security gap between CLI and manifest-based cluster creation. More urgently, addon apply failures are no longer invisible. The channel controller now surfaces failures through a readiness probe on a system-node-critical pod, which means a rejected manifest halts rolling updates before workers rollover [1]. Cilium users on ENI IPAM get long-awaited flexibility: KOps removes its blanket prohibition on disableMasquerade, allowing upstream no-masquerade behavior for private-topology clusters and VPC endpoint setups [3]. On the testing side, test-infra merged VPA's NUMPROC configuration into the autoscaler repo [4], [5], reducing duplication, while Kueue's test suite splits into multikueue-baseline and multikueue-extended targets to isolate coverage [6]. Kubernetes core fixed a race condition in subPath directory creation [7] and marked the archived protoc-gen-validate as unwanted to keep dependency hygiene clean [8].

Action items

→ Review KOps cluster specs for explicit authorization fields; if omitted, they now default to RBAC instead of AlwaysAllow on next reconcile kubernetes/kops [plan]
→ Verify addon manifests are kubectl-valid; failed applies now block rolling updates via readiness probe kubernetes/kops [immediate]
→ If running Cilium ENI IPAM with masquerade disabled, test the validation removal in next KOps update kubernetes/kops [monitor]
→ Update test jobs for Kueue to reference new multikueue-baseline and multikueue-extended targets kubernetes/test-infra [plan]

References

[1] channels: surface addon apply failures via a readiness probe ↗ kubernetes/kops
[2] Default omitted authorization to RBAC instead of AlwaysAllow ↗ kubernetes/kops
[3] cilium: allow disabling masquerade in ENI IPAM mode kubernetes/kops
[4] Merge pull request #37142 from adrianmoisey/remove-vpa-numprocs kubernetes/test-infra
[5] Remove VPA's NUMPROC settings kubernetes/test-infra
[6] kueue : split multikueue into extended and baseline suite ↗ kubernetes/test-infra
[7] Fix a race condition when creating subPath directories ↗ kubernetes/kubernetes
[8] Mark github.com/envoyproxy/protoc-gen-validate as unwanted dependency kubernetes/kubernetes

Quick answers

What shipped in Kubernetes on May 31, 2026?: KOps flipped authorization to RBAC by default [ref:14], surfaced hidden addon failures through readiness probes [ref:13], and unlocked Cilium's no-masquerade mode on ENI [ref:15], while test-infra split Kueue's multikueue testing into baseline and extended coverage [ref:10]. In total, 21 commits and 13 pull requests landed.
Who contributed to Kubernetes on May 31, 2026?: 3 developers shipped this update, including hakman, ekam-walia, and dddddai.
What were the notable Kubernetes updates?: channels: surface addon apply failures via a readiness probe, Default omitted authorization to RBAC instead of AlwaysAllow, and cilium: allow disabling masquerade in ENI IPAM mode.

SCHEDULER GAINS PREQUEUING FILTER, KUBELET USER NAMESPACES MOVE TO BETA

Kubernetes tackles the pod requeue bottleneck that's been choking large clusters, while user namespacing ships closer to production.

go 19 shipped 1-min read

@kubernetes 1 day ago

CLUSTER-AUTOSCALER PATCHES HIT ALL RELEASE BRANCHES AS DRA AND VOLUMEMOUNT BIND OPTIONS LAND

Cluster-autoscaler shipped four patch releases across versions 1.33 through 1.36 fixing ProvisioningRequest condition application and Scaleway node detection, while Kubernetes core merged DRA node operations and volumeMount bind mount options.

go 89 shipped 1-min read

@kubernetes 2 days ago

DRA GETS SMARTER RESOURCE ACCOUNTING, CLUSTER-AUTOSCALER ROLLS OUT FOUR PATCHES

Dynamic Resource Allocation fixed device accounting across its resource pool controller while cluster-autoscaler shipped maintenance releases across four versions.

go 52 shipped 1-min read

@kubernetes 3 days ago

DRA GRADUATES TO STABLE, KUBELET METRICS BYPASS CADVISOR, NAMESPACE LIFECYCLE UNBLOCKED

Three critical production fixes ship across core scheduler, metrics, and admission layers while DRA resource tracking stabilizes after surfacing a crash bug in the informer.

go 129 shipped 1-min read

Elsewhere on the wire

AI Agents about 9 hours ago

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

ai-agents 28 shipped 1-min read

Local LLMs about 9 hours ago

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.