Kubernetes patches SSH DoS CVE as 1.38 KEPs line up

By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology

♥

Watch cache stops broadcasting unchanged resource versions, and quantity overflow fixes land to stop resource values wrapping silently.

1260 commits 770 PRs merged 6 releases 30 briefings covered

all kubernetes reviews →

← previous month kubernetes wire →

Drop JobManagedBy after the feature GA-ed in 1.35 kubernetes/kubernetes

by soltysh

The JobManagedBy feature gate is gone after graduating to stable in 1.35, part of a broader September sweep of retired gates that also removed PodSchedulingReadiness and the Service CIDR and DRA gates. If your manifests or tooling still set those gates, this is the month they stopped doing anything.

Merge pull request #140459 from semx/fix-quantity-string-decimalsi-overflow kubernetes/apimachinery

by Kubernetes Publisher

Quantity.String() no longer drops the suffix for DecimalSI values above 10^18; the overflow fix makes resource quantities saturate instead of silently wrapping. Resource values that previously surfaced as wrong in log or status output now read correctly, so any code parsing Quantity strings should be rechecked against the new output.

Merge pull request #139727 from darshansreenivas/batch_2_message kubernetes/apiextensions-apiserver

by Kubernetes Publisher

Declarative validation for the Condition.Message field landed across apimachinery consumers, and the approach graduated to stable in the discovery API. Custom API servers built on apimachinery inherit the validation behavior, which is the reason the change was propagated to kube-aggregator and the sample servers rather than merged once.

e2e auth: use unprivileged container port in projected podcertificate test kubernetes/kubernetes

by tinatingyu

The projected podcertificate e2e test now binds an unprivileged container port, because the mTLS server runs non-root with all capabilities dropped and Linux environments enforce net.ipv4.ip_unprivileged_port_start by default at 1024. Relevant if you run projected service account tokens behind a restricted security context in your own cluster.

Kubernetes SIG Storage Co-Chair Transition kubernetes/community

by xing-yang

Saad Ali stepped down as SIG Storage co-chair and nominated Hemant Kumar, a transition that lands as CSI chart releases for Cinder, Manila, and the OpenStack cloud controller manager roll out through the same period. Storage consumers get steady releases; the chair change decides who arbitrates the next round.

Update the configuration API reference for v1.37 kubernetes/website

by Caesarsage

Both the configuration and Markdown API reference pages were regenerated for v1.37 from the reference-docs generators, adding two new pages and regenerating the kubectl reference. Generated files only, no hand edits, so pin your docs to the v1.37 tag rather than a moving branch.

Merge pull request #139727 from darshansreenivas/batch_2_message kubernetes/code-generator

by Kubernetes Publisher

Alongside: kube-state-metrics gained VolumeAttributesClass and PVC idle-time metrics, kOps picked up Amazon Linux 2027 and an Akamai firewall plus patched containerd, the VPA chart 0.12.0 started syncing CRDs on upgrade, and master stopped carrying containerd 1.7.

$ ls kubernetes/month/ # the briefings behind this review

Tue Sep 1 v1.37 docs regenerate; JobManagedBy gate dropped Wed Sep 2 SIG Storage co-chair transition, PodSchedulingReadiness gate removed Thu Sep 3 Declarative validation for Condition.Message lands across apimachinery consumers Fri Sep 4 Declarative validation graduates to stable in discovery API Sat Sep 5 kOps drops legacy keyset aliases, mirroring deeper Kubernetes dependency shifts Sun Sep 6 VPA chart 0.12.0 syncs CRDs on upgrade; kOps gains Amazon Linux 2027 coverage Mon Sep 7 Docs drive the day: Spanish SIG Docs page lands, plus maintenance merges Tue Sep 8 kube-state-metrics exposes VolumeAttributesClass, kops adds Akamai firewall Wed Sep 9 Kubernetes patches SSH DoS CVE, fixes kube-cross bullseye build break Thu Sep 10 Kubernetes resource quantities saturate instead of silently wrapping Fri Sep 11 Quantity overflow fixes land as security profiles merger gets a team Sat Sep 12 Service CIDR feature gates retired, grpc bumped to 1.82.2 Sun Sep 13 kops SSH test skip pattern fixed, allowPrivilegeEscalation docs clarified Mon Sep 14 DRA kind jobs get 12Gi, kubelet drops an optimistic volume default Tue Sep 15 KubeCon NA banner lands, go-jose and go-oidc bumped across published staging repos Wed Sep 16 Master drops containerd 1.7, StorageClass validation goes stable Thu Sep 17 DRA feature gate removed, code-generator learns multi-doc extensions files Fri Sep 18 Vultr autoscaling fixes, LimitRanger stops re-rejecting PVC updates Sat Sep 19 kubectl explain gains shell completion, kubelet threads real contexts Sun Sep 20 Minikube drops pre-1.28 test fixtures, golang.org/x bumps land across the tree Mon Sep 21 Minikube probes drivers in parallel, promo-tools signs promotion records Tue Sep 22 1.38 KEPs line up: WebSockets GA, CRI streaming and Workload Aware Scheduling to beta Wed Sep 23 Watch cache stops broadcasting unchanged resource versions Thu Sep 24 DRA plugin socket paths shortened, k8s CI gains write-throughput and minimum-Go jobs Fri Sep 25 Post-quantum certs reach client-go, managedFields gets a server-side opt-out Sat Sep 26 kops adopts patched containerd, grpc unpinned across Kubernetes repos Sun Sep 27 kubeadm adds ML-DSA signing support Mon Sep 28 Proxy fix targets NodePort localhost detection, hugepages KEP takes shape Tue Sep 29 kube-state-metrics exposes PVC idle time, apiserver write throughput gets a KEP Wed Sep 30 DRA capacity requests, in-place node resize, and weighted load balancing head to KEP review

all kubernetes reviews →

← previous month kubernetes wire →