Who contributed to Kubernetes on October 23, 2026?

9 developers shipped this update, including Mario Jason Braganza, kubernetes-prow[bot], Nabarun Pal, Ciprian Hacman, ameukam, Federico Hernandez, upodroid, and locker95, and 1 more.

What were the notable Kubernetes updates?

chore(deps): bump github.com/google/go-tpm-tools to v0.4.11, Don't print env-supplied secrets in flag usage, and tests/e2e: run the agent-sandbox scenario on AWS and Azure.

Oct 23, 2026

$ the-wire · showcase

go-tpm-tools gets a CVE fix as git-sync stops leaking secrets

By RepoJournal · Filed 06:56 UTC on October 23, 2026 · About Kubernetes · Composed from the cited sources · methodology

9 people shipped this

Ciprian Hacman @hakman 2 cited

Nabarun Pal @palnabarun 1 cited

ameukam @ameukam 1 cited

locker95 @locker95 1 cited

Mario Jason Braganza @jasonbraganza

kubernetes-prow[bot] @kubernetes-prow[bot]

Federico Hernandez @recollir

upodroid @upodroid

thockin @thockin

kOps pulled in an attestation dependency upgrade that closes GHSA-9r4w-jg96-92mv, while git-sync fixed a path that printed env-supplied tokens into sidecar logs.

chore(deps): bump github.com/google/go-tpm-tools to v0.4.11 kubernetes/kops

by ameukam

The bump of github.com/google/go-tpm-tools from v0.4.9 to v0.4.11 pulls github.com/google/go-attestation from v0.5.1 to v0.6.4 in the module graph, resolving CVE-2026-12681 / GHSA-9r4w-jg96-92mv. Anything resolving go-tpm-tools below v0.4.11 inherits the same vulnerable attestation dependency.

Don't print env-supplied secrets in flag usage kubernetes/git-sync

by locker95

--repo, --credential, and --askpass-url take defaults from the environment, and pflag echoes those defaults in --help and on parse failure, so a token in GITSYNC_REPO or GITSYNC_CREDENTIAL was landing in the sidecar log. The fix changes only the text pflag displays, and only when the env var is set; the parsed value is unchanged and an empty --credential still prints [].

tests/e2e: run the agent-sandbox scenario on AWS and Azure kubernetes/kops

by hakman

A new CLOUD_PROVIDER=gce|aws|azure switch (default gce) carries per-cloud zone, machine sizes and root volume types, so the agent-sandbox benchmark presubmits and periodics in test-infra now run on all three clouds. Only those cloud-specific knobs and the GCE-only flags vary; the rest of the tuning is shared, with STRESS_NODE_COUNT defaulting to 3 workers.

Update Go images to use 1.27.3/1.26.10 kubernetes/release

by palnabarun

kube-cross, go-runner, and releng-ci variants, Makefile defaults and dependency references move to Go 1.27.3/1.26.10. Matching bumps follow for distroless-iptables and the gcb-docker-gcloud builder, and git-sync moved its whole build to 1.27.3.

Add hakman and sbueringer as SIG Cluster Lifecycle tech leads kubernetes/k8s.io

by Ciprian Hacman

Also in the long tail: hakman and sbueringer are now listed as SIG Cluster Lifecycle tech leads, WG Workload Conformance got its public and leads mailing lists with Nabarun Pal and Maciej Szulik as organizers, a DNS entry went in for the model-serving-signals docs, prow-build gained an SF Compute API key secret, and kops upgraded etcd-manager to v3.0.20261022.

Action items

→ Bump github.com/google/go-tpm-tools to v0.4.11 to resolve CVE-2026-12681 / GHSA-9r4w-jg96-92mv kubernetes/kops [plan]