RepoJournal
Kubernetes @kubernetes
113 wires and counting

$ follow Kubernetes

Keep up with Kubernetes in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-08-31
stories 118
GitHub RSS Archive Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

krel signs attestations, watch cache metric stopped counting bookmarks

By RepoJournal · Filed · About Kubernetes

puerco Chen Lin zhanggbj thc1006 Jefftree ashishpatel26 kubernetes-prow[bot]
11 people shipped this
puerco @puerco 2 cited Chen Lin @chenlin07 1 cited zhanggbj @zhanggbj 1 cited thc1006 @thc1006 1 cited Jefftree @Jefftree 1 cited ashishpatel26 @ashishpatel26 1 cited kubernetes-prow[bot] @kubernetes-prow[bot] dependabot @dependabot Mario Jason Braganza @jasonbraganza my-git9 @my-git9 ksadura @ksadura

The Kubernetes release pipeline now signs provenance attestations with a second identity, and the watch cache stops inflating its dispatch metric.

The Kubernetes release pipeline gains attestation signing: a new `krel sign attestation` subcommand signs in-toto statements onto sigstore bundles, and the staging cloud build runs it right after staging with an identity not accessible to the build process [1][2]. This strengthens the provenance chain for releases. Meanwhile, the watch cache metric `apiserver_watch_cache_events_dispatched_total` no longer counts bookmark events that `dispatchEvents` refuses to dispatch, correcting an overcount [3]. In `kubernetes/kubernetes`, a bug fix handles `math.MinInt64` negation overflow in `Quantity.Neg` and `Sub`; previously, negating `MinInt64` with raw negation silently did nothing, leaving the value at `MinInt64` [4]. cloud-provider-vsphere ships a new Helm chart `vsphere-cpi-chart-1.37.0` and enables security scanning for release-1.37 [5][6]. Finally, `/flagz` documentation now clarifies that the endpoint reflects the flag layer, not the effective running config, which can diverge from `/configz` for kubelet and kube-proxy [7].

Action items

References

  1. [1] Add krel attestation sign ↗ kubernetes/release
  2. [2] Add attestation signing step to stage job ↗ kubernetes/release
  3. [3] Stop counting undispatched bookmarks in watch cache events_dispatched_total ↗ kubernetes/kubernetes
  4. [4] Handle MinInt64 negation overflow in Quantity.Neg and Sub ↗ kubernetes/kubernetes
  5. [5] vsphere-cpi-chart-1.37.0 ↗ kubernetes/cloud-provider-vsphere
  6. [6] Enable security scan for release-1.37 ↗ kubernetes/cloud-provider-vsphere
  7. [7] flagz: note that endpoint reflects flag layer, not effective config ↗ kubernetes/kubernetes

$ ls kubernetes/reviews/ # the step-back reads

the week in review Declarative validation for Condition.Message lands, graduates stable the month in review August Ships Kubernetes 1.37 RC and kOps 1.37 Beta
Topics: Go Infrastructure Full archive →

Quick answers

What shipped in Kubernetes on August 31, 2026?
The Kubernetes release pipeline now signs provenance attestations with a second identity, and the watch cache stops inflating its dispatch metric. In total, 67 commits, 50 pull requests, and 1 releases landed.
Who contributed to Kubernetes on August 31, 2026?
11 developers shipped this update, including kubernetes-prow[bot], Chen Lin, zhanggbj, puerco, dependabot, Mario Jason Braganza, my-git9, and ksadura, and 3 more.
What were the notable Kubernetes updates?
Add krel attestation sign, Add attestation signing step to stage job, and Stop counting undispatched bookmarks in watch cache events_dispatched_total.
♥

$ log @kubernetes --recent

Docs drive the day: Spanish SIG Docs page lands, plus maintenance merges 15 shipped VPA chart 0.12.0 syncs CRDs on upgrade; kOps gains Amazon Linux 2027 coverage 49 shipped kOps drops legacy keyset aliases, mirroring deeper Kubernetes dependency shifts 37 shipped Declarative validation graduates to stable in discovery API 77 shipped

$ log --all # elsewhere on the wire

Meta React Native adds Stable API guards to renderer attributed string FastAPI & Pydantic Pydantic fixes Mypy plugin crash, tightens datetime constraints

$ ls showcases/

Rails Django Laravel Node.js Go Vercel Vue.js HashiCorp Arch Linux Linux Anthropic OpenAI

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.