RepoJournal
Kubernetes @kubernetes
139 wires and counting

$ follow Kubernetes

Keep up with Kubernetes in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-05-31
stories 34
GitHub RSS Archive Reviews Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

KOPS HARDENS DEFAULTS, KUEUE SPLITS TEST SUITES, ADDON FAILURES NOW VISIBLE

By RepoJournal · Filed · About Kubernetes · Composed from the cited sources · methodology

hakman ekam-walia dddddai
3 people shipped this
hakman @hakman 2 cited ekam-walia @ekam-walia 1 cited dddddai @dddddai 1 cited

KOps flipped authorization to RBAC by default [ref:14], surfaced hidden addon failures through readiness probes [ref:13], and unlocked Cilium's no-masquerade mode on ENI [ref:15], while test-infra split Kueue's multikueue testing into baseline and extended coverage [ref:10].

Three critical KOps changes ship this morning: authorization now defaults to RBAC instead of AlwaysAllow when omitted from cluster specs [2], closing a silent security gap between CLI and manifest-based cluster creation. More urgently, addon apply failures are no longer invisible. The channel controller now surfaces failures through a readiness probe on a system-node-critical pod, which means a rejected manifest halts rolling updates before workers rollover [1]. Cilium users on ENI IPAM get long-awaited flexibility: KOps removes its blanket prohibition on disableMasquerade, allowing upstream no-masquerade behavior for private-topology clusters and VPC endpoint setups [3]. On the testing side, test-infra merged VPA's NUMPROC configuration into the autoscaler repo [4], [5], reducing duplication, while Kueue's test suite splits into multikueue-baseline and multikueue-extended targets to isolate coverage [6]. Kubernetes core fixed a race condition in subPath directory creation [7] and marked the archived protoc-gen-validate as unwanted to keep dependency hygiene clean [8].

Action items

References

  1. [1] channels: surface addon apply failures via a readiness probe ↗ kubernetes/kops
  2. [2] Default omitted authorization to RBAC instead of AlwaysAllow ↗ kubernetes/kops
  3. [3] cilium: allow disabling masquerade in ENI IPAM mode ↗ kubernetes/kops
  4. [4] Merge pull request #37142 from adrianmoisey/remove-vpa-numprocs ↗ kubernetes/test-infra
  5. [5] Remove VPA's NUMPROC settings ↗ kubernetes/test-infra
  6. [6] kueue : split multikueue into extended and baseline suite ↗ kubernetes/test-infra
  7. [7] Fix a race condition when creating subPath directories ↗ kubernetes/kubernetes
  8. [8] Mark github.com/envoyproxy/protoc-gen-validate as unwanted dependency ↗ kubernetes/kubernetes

$ ls kubernetes/reviews/ # the step-back reads

the week in review v1.38 KEPs stack up: WebSockets GA, WAS and CRI streaming to beta the month in review Kubernetes patches SSH DoS CVE as 1.38 KEPs line up
Topics: Go Infrastructure Full archive → Weekly reviews →

Quick answers

What shipped in Kubernetes on May 31, 2026?
KOps flipped authorization to RBAC by default [ref:14], surfaced hidden addon failures through readiness probes [ref:13], and unlocked Cilium's no-masquerade mode on ENI [ref:15], while test-infra split Kueue's multikueue testing into baseline and extended coverage [ref:10]. In total, 21 commits and 13 pull requests landed.
Who contributed to Kubernetes on May 31, 2026?
3 developers shipped this update, including hakman, ekam-walia, and dddddai.
What were the notable Kubernetes updates?
channels: surface addon apply failures via a readiness probe, Default omitted authorization to RBAC instead of AlwaysAllow, and cilium: allow disabling masquerade in ENI IPAM mode.
♥

$ log @kubernetes --recent

Watch cache streaming, kubectl kuberc fixes 59 shipped Quantity becomes a value type, HPA overflow fixed 86 shipped GCP provider learns to skip firewall rules, metis gets non-reusable CIDRs 18 shipped DRA capacity requests, in-place node resize, and weighted load balancing head to KEP review 119 shipped

$ log --all # elsewhere on the wire

@openclaw OpenClaw 2026.8.35 ships critical security fixes, Bun patches NODE_OPTIONS and worker ports Agentic Coding Codex drops the tool-namespace capability gate, Goose ships 1.53.0

$ ls showcases/

Rails Django Laravel Node.js Go Vercel Vue.js HashiCorp Arch Linux Linux Anthropic OpenAI

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.