RepoJournal
Kubernetes @kubernetes
139 wires and counting

$ follow Kubernetes

Keep up with Kubernetes in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-08-16
stories 22
GitHub RSS Archive Reviews Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

KOPS PLUGS DIGITALOCEAN SSH KEY LEAK, REGISTRY CUTS 404 NOISE

By RepoJournal · Filed · About Kubernetes · Composed from the cited sources · methodology

upodroid Peter Rifel mrueg moshevayner kubernetes-prow[bot]
5 people shipped this
upodroid @upodroid 4 cited Peter Rifel @rifelpet 2 cited mrueg @mrueg 1 cited moshevayner @moshevayner 1 cited kubernetes-prow[bot] @kubernetes-prow[bot]

DigitalOcean clusters were leaving orphaned SSH keys behind on teardown. kops shipped the fix [ref:6], test-infra is ready to land it [ref:4], and registry.k8s.io rolled out early 404 rejection to slash CloudFront noise [ref:12].

The kops fix [1] adds SSH key cleanup to the DigitalOcean resource deleter, matching what AWS and OpenStack already do. kops names each key after the cluster and fingerprint, uploads it via `dotasks/sshkey.go createKeypair`, but never tore it down. Test-infra's pending change [2] drops the preset-do-ssh label from 8 DigitalOcean e2e jobs and switches to throwaway keypairs per cluster, but it's blocked until kops lands the deletion logic. Over in registry.k8s.io, v0.7.0 shipped [4] with a dedicated Cloud Build service account and AWS CDN support, followed by an aggressive 404 rejection layer [3] that returns failures early instead of letting CloudFront existence checks drain budget. Kube-state-metrics fixed a race condition in config reload serialization [5] where three separate viper watchers were unsynchronized on the same context, and kops patched Akamai instance tag filters to use `+contains` predicates instead of rejected equality checks [6]. The k8s.io infrastructure bumped archeio to 0.7.0 [7] with BQ analytics datasets and ASN capture from GCP [8].

Action items

References

  1. [1] digitalocean: delete SSH keys when deleting a cluster ↗ kubernetes/kops
  2. [2] kops: drop preset-do-ssh from DigitalOcean jobs ↗ kubernetes/test-infra
  3. [3] return 404s very early ↗ kubernetes/registry.k8s.io
  4. [4] v0.7.0 ↗ kubernetes/registry.k8s.io
  5. [5] fix: serialize config reloads so one does not strand the other ↗ kubernetes/kube-state-metrics
  6. [6] fix(akamai): Fix Akamai (Linode) Instance tag filter function ↗ kubernetes/kops
  7. [7] bump archeio to v0.7.0 ↗ kubernetes/k8s.io
  8. [8] create bq dataset and pass asn values to archeio ↗ kubernetes/k8s.io

$ ls kubernetes/reviews/ # the step-back reads

the week in review v1.38 KEPs stack up: WebSockets GA, WAS and CRI streaming to beta the month in review Kubernetes patches SSH DoS CVE as 1.38 KEPs line up
Topics: Go Infrastructure Full archive → Weekly reviews →

Quick answers

What shipped in Kubernetes on August 16, 2026?
DigitalOcean clusters were leaving orphaned SSH keys behind on teardown. kops shipped the fix [ref:6], test-infra is ready to land it [ref:4], and registry.k8s.io rolled out early 404 rejection to slash CloudFront noise [ref:12]. In total, 13 commits, 8 pull requests, and 1 releases landed.
Who contributed to Kubernetes on August 16, 2026?
5 developers shipped this update, including mrueg, kubernetes-prow[bot], Peter Rifel, moshevayner, and upodroid.
What were the notable Kubernetes updates?
digitalocean: delete SSH keys when deleting a cluster, kops: drop preset-do-ssh from DigitalOcean jobs, and return 404s very early.
♥

$ log @kubernetes --recent

Watch cache streaming, kubectl kuberc fixes 59 shipped Quantity becomes a value type, HPA overflow fixed 86 shipped GCP provider learns to skip firewall rules, metis gets non-reusable CIDRs 18 shipped DRA capacity requests, in-place node resize, and weighted load balancing head to KEP review 119 shipped

$ log --all # elsewhere on the wire

@openclaw OpenClaw 2026.8.35 ships critical security fixes, Bun patches NODE_OPTIONS and worker ports Agentic Coding Codex drops the tool-namespace capability gate, Goose ships 1.53.0

$ ls showcases/

Rails Django Laravel Node.js Go Vercel Vue.js HashiCorp Arch Linux Linux Anthropic OpenAI

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.