$ the-wire · showcase
Pod security admission webhook removed, release signing moves to sigstore-go
By RepoJournal · Filed · About Kubernetes · Composed from the cited sources · methodology
Two changes at the core of the stack: Kubernetes deletes the pod security admission webhook while krel's signing path swaps out the cosign v2 CLI without changing signature formats.
Merge pull request #138469 from borg-land/delete-psa-webhook kubernetes/kubernetes
The pod security admission webhook is gone from the tree. This is a breaking change: anything relying on that webhook's admission path needs to move to the Pod Security Admission label-based enforcement that ships in-tree, and it will not be re-added.
Bump sigs.k8s.io/release-sdk to v0.13.0 kubernetes/release
release-sdk v0.13.0 replaces the cosign v2 CLI packages with sigstore-go and go-containerregistry, and the commit message states the formats are unchanged: image signatures stay sha256-<digest>.sig tags and file signatures stay detached .sig and .cert files, verifiable with cosign. krel only uses local key files, still supported, and the bump drops the cloud KMS and credential helper dependencies.
Deployment rollouts fail to report timeouts after old ReplicaSet scale-down errors kubernetes/kubernetes
Deployment rollouts that hit an error scaling down the old ReplicaSet fail to report the rollout timeout, so the failure surfaces late or not at all. Worth tracking if your tooling watches Deployment conditions to detect stuck rollouts.
kubelet: topologymanager: Add Score field to TopologyHint for NUMA utilization signaling kubernetes/kubernetes
The kubelet topology manager gains a Score field on TopologyHint for NUMA utilization signaling. A hint-level signal is a prerequisite for narrower NUMA placement decisions, so scheduler and device-plugin consumers should expect the interface to evolve.
sig-scalability: remove fieldsv1string 100-node scale performance periodic job kubernetes/test-infra
test-infra retired the fieldsv1string 100-node scale performance periodic job alongside the agentic sandbox burst job and an update to the conformance artifact config. Only CI capacity and periodic coverage are affected, plus an email address change for elmiko in k8s.io to widen gsuite access.
