Who contributed to Kubernetes on July 18, 2026?

12 developers shipped this update, including Jefftree, kubernetes-prow[bot], KevinTMtz, stlaz, vshkrabkov, reruno, justinsb, and YahiaBadr, and 4 more.

What were the notable Kubernetes updates?

ClusterTrustBundles - GA, Merge pull request #140412 from Argh4k/post-filters-out, and Integration test to verify the priority of binding over preemption for gang and basic scheduling.

@kubernetes

Container orchestration — what platform teams ship on

github ↗

Pick a date

Topics: Go Infrastructure Full archive →

The Wire · Showcase

CLUSTER TRUST BUNDLES GO GA, SCHEDULER GETS SMARTER ON PREEMPTION

By RepoJournal · Filed 06:57 UTC on July 18, 2026 · About Kubernetes

12 people shipped this

Kubernetes Publisher @k8s-publishing-bot 2 cited

Jefftree @Jefftree 1 cited

kubernetes-prow[bot] @kubernetes-prow[bot] 1 cited

KevinTMtz @KevinTMtz 1 cited

stlaz @stlaz 1 cited

vshkrabkov @vshkrabkov 1 cited

reruno @reruno 1 cited

justinsb @justinsb 1 cited

YahiaBadr @YahiaBadr

zylxjtu @zylxjtu

xing-yang @xing-yang

furkatgofurov7 @furkatgofurov7

Kubernetes ships ClusterTrustBundles to stable while the scheduler learns to bind before it breaks things.

In brief

ClusterTrustBundles hit GA in Kubernetes. distributed CA certs across your cluster without manual rotation. this was overdue.
Kubernetes scheduler now properly orders binding before preemption. gang scheduling stops losing pods to premature eviction. the binding/preemption priority fix.
PodLevelResourceManagers metrics are now stable in Kubernetes. zero-memory containers get skipped in allocation. less noise, more signal.
MutatingAdmissionPolicy v1beta1 storage version pin got yanked from the apiserver. cleanup before it gets harder.
CRD validation now warns you when you use non-scalar values in set constraints. saves you a debugging session later.

ClusterTrustBundles moves to GA and enabled by default [1], marking the end of a long stabilization cycle for certificate distribution at scale. Meanwhile, the scheduler is tightening its logic: post-filters are getting yanked from pod group cycles [2] and new integration tests verify binding happens before preemption kicks in [3], fixing a class of scheduling race conditions that hit gang policies hard. On the resource front, PodLevelResourceManagers metrics hit stable [4] with zero-memory container handling now baked in, giving operators real visibility into per-pod allocation. The API server is also getting stricter: MutatingAdmissionPolicy v1beta1 storage pins are being removed [5] to force migration to v1, and CRDs now warn when you try to use non-scalar items in sets [6], catching a footgun before it reaches production. In test infrastructure, kueue's periodic jobs are being right-sized based on actual metrics [7], agent-sandbox is generating Prow configs from source [8], and there's a fix for apiserver hanging on SIGTERM when hostname exceeds 63 bytes [9].

Action items

→ Review ClusterTrustBundles migration if you're not yet on GA (it's enabled by default in next release) kubernetes/kubernetes [plan]
→ Update any custom schedulers that depend on post-filters in pod group cycles kubernetes/kubernetes [plan]
→ Test gang scheduling policies against the new binding-first logic kubernetes/kubernetes [monitor]
→ Check CRD definitions for non-scalar set items and address warnings kubernetes/apiextensions-apiserver [monitor]

References

[1] ClusterTrustBundles - GA ↗ kubernetes/kubernetes
[2] Merge pull request #140412 from Argh4k/post-filters-out kubernetes/kubernetes
[3] Integration test to verify the priority of binding over preemption for gang and basic scheduling ↗ kubernetes/kubernetes
[4] [PodLevelResourceManagers] Metrics stability level & skip allocation for zero-memory containers ↗ kubernetes/kubernetes
[5] apiserver: remove MutatingAdmissionPolicy v1beta1 storage version pin kubernetes/kubernetes
[6] Merge pull request #140616 from jpbetz/crd-warn-non-scalar-set kubernetes/apiextensions-apiserver
[7] chore: resize kueue main periodic job cpu/memory requests, based on c… ↗ kubernetes/test-infra
[8] agent-sandbox: generate prow jobs from the repo's dev/ci scripts ↗ kubernetes/test-infra
[9] Merge pull request #140241 from camilamacedo86/fix-envtest kubernetes/component-helpers

Quick answers

What shipped in Kubernetes on July 18, 2026?: Kubernetes ships ClusterTrustBundles to stable while the scheduler learns to bind before it breaks things. In total, 60 commits and 34 pull requests landed.
Who contributed to Kubernetes on July 18, 2026?: 12 developers shipped this update, including Jefftree, kubernetes-prow[bot], KevinTMtz, stlaz, vshkrabkov, reruno, justinsb, and YahiaBadr, and 4 more.
What were the notable Kubernetes updates?: ClusterTrustBundles - GA, Merge pull request #140412 from Argh4k/post-filters-out, and Integration test to verify the priority of binding over preemption for gang and basic scheduling.

KUBERNETES TIGHTENS DRA NUMA SUPPORT AND WINDOWS TEST COVERAGE

Kubernetes shipped NUMA device attributes for DRA workload placement [ref:17] while simultaneously hardening Windows node test infrastructure [ref:9] and cleaning up scheduler integration tests [ref:16].

go 64 shipped 1-min read

@kubernetes 2 days ago

KOPS 1.36 SHIPS WITH KUBERNETES 1.36 SUPPORT AND REWORKED ADDON MANAGEMENT

kOps 1.36.0 landed overnight with full Kubernetes 1.36 support, a fundamental overhaul of addon management, and the final chapter of the in-tree cloud provider deprecation.

go 100 shipped 1-min read

@kubernetes 3 days ago

DECLARATIVE VALIDATION GOES STABLE AS CODE-GENERATOR HARDENS VALIDATION PIPELINE

Kubernetes code-generator just promoted ten validation tags to stable, tightening the screws on object validation across the entire API ecosystem while silencing previously invisible validation failures.

go 16 shipped 1-min read

@kubernetes 4 days ago

KUBELET TESTS NOW RUN 10X FASTER. APISERVER METRICS CLEANUP SHIPS

Kubernetes slashed test execution time by switching kubelet synctest away from time.Sleep, while apiserver deprecated metrics finally got the axe after months of warnings.

go 47 shipped 1-min read

— or follow the whole beat:

Elsewhere on the wire

@cachyos about 6 hours ago

PACKAGE UPDATES ROLL ACROSS AUR DERIVED AND PROTON CACHYOS

Claude Desktop jumped to 1.22209.0, Zen Browser patched to 1.21.8b, and documentation fixes landed across the stack overnight.

infra 43 shipped 1-min read

Elixir & Phoenix about 6 hours ago

ELIXIR CUTS EXPONENTIAL GROWTH IN BDD INTERSECTIONS, PHOENIX LIVE VIEW SKIPS CLONES ON STABLE LISTS

The compiler just got smarter about preventing exponential blowup in type intersection logic, while Phoenix Live View stops wastefully copying keyed comprehensions that aren't moving.

elixir 16 shipped 1-min read

@dotnet about 6 hours ago

ASPNETCORE TIGHTENS AUTHORIZATION METADATA EVERYWHERE, BLAZOR DEBUGGING EXITS

Authorization policies now work consistently across all routing paths, not just endpoint middleware, while Blazor templates drop their deprecated WebAssembly debugging hook.

dotnet 58 shipped 2-min read

@spring-projects about 6 hours ago

SPRING FRAMEWORK TIGHTENS RESOURCE SECURITY, NEO4J FIXES CONVERSION LOGIC

Spring Framework reinstated critical resource location validation checks that prevent unauthorized static resource resolution in sensitive directories.

java 4 shipped 1-min read