$ cat kubernetes/week/2026-09-21.log
the week in review · Sep 21 – Sep 27, 2026
v1.38 KEPs stack up: WebSockets GA, WAS and CRI streaming to beta
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
Three graduation KEPs head into the v1.38 milestone, while post-quantum ML-DSA signing lands in client-go and kubeadm.
KEP-4006: Transition from SPDY to WebSockets - GA in 1.38 kubernetes/enhancements
KEP-4006 carries the SPDY-to-WebSockets transition to GA with the 1.38 milestone, which matters to anyone still pinning clients to the old streaming transport. Plan upgrades around the graduating transport rather than the deprecated one.
kep-6089: promote Workload Aware Scheduling Controller APIs to Beta kubernetes/enhancements
KEP-6089 moves the Workload Aware Scheduling Controller APIs from Alpha to Beta for v1.38, part of a wider pattern this period: scheduling controllers are the batch-oriented surface being hardened fastest. Beta means API shape is settling; start tracking the controller APIs if you schedule gang workloads.
KEP-5825: update CRI List Streaming for beta graduation in v1.38 kubernetes/enhancements
KEP-5825 updates the CRI List Streaming graduation criteria for beta in v1.38, following the same milestone as the WebSockets and scheduling KEPs. For runtime and CRI implementers, the streaming interface is the piece to test against the new criteria.
Merge pull request #142046 from rphillips/feat/kubelet_mldsa_support kubernetes/kubelet
The kubelet gains ML-DSA support, matching the post-quantum signing work that reached client-go and kubeadm in the same period. Certificate tooling built on the existing X.509 assumptions will need a path for the post-quantum algorithm, which is why this is landing across three components at once.
Merge pull request #142291 from serathius/watchcache-rv-broadcast kubernetes/apiserver
The watch cache stops broadcasting a resource version change when the version did not change, cutting a class of redundant wakeups for every watcher. If you run large numbers of informers, expect less churn in the paths where nothing was actually modified.
kubectl describe node: fix per-pod resource percentages kubernetes/kubernetes
The per-pod rows of the "Non-terminated Pods" table in kubectl describe node had two defects: percentages divided by the node's allocatable CPU and memory with no zero guard, and the input describes further fixes to those rows. On nodes without the expected allocatable values this produced misleading percentages rather than an obvious error.
IngressClassSpec.Controller DV Migration kubernetes/kubernetes
Validation of IngressClassSpec.Controller in networking.k8s.io/v1 and v1beta1 moves to declarative validation, with the controller field's "required" and immutable-on-update rules expressed there. Behavior the input calls equivalent; the value is on the maintainer side, where the rules become declarative instead of hand-written.
Merge pull request #138219 from yashsingh74/fix-apis-handler kubernetes/apiserver
The apiserver now returns a JSON Status 404 for unregistered paths instead of plain text. Tooling that parsed the plain-text body will see a standard Status object, which is the shape clients already know how to handle.
$ ls kubernetes/week/ # the briefings behind this review
Keep up with Kubernetes in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.