$ cat kubernetes/week/2026-10-05.log
the week in review · Oct 5 – Oct 11, 2026
Kubelet filters scoped link-local nameservers from pods
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
Scheduler_perf adds a workload-aware preemption baseline, and the release tooling moves off deprecated bom SBOM APIs.
[KUBELET]: Filter scoped link-local DNS servers kubernetes/kubernetes
When kubelet reads the node's resolver configuration it was propagating scoped IPv6 link-local nameservers into pods that run with dnsPolicy: Default, where they cannot resolve anything. The fix keeps those addresses out of the generated resolv.conf, which is the kind of misconfiguration that shows up as intermittent lookup failures rather than an obvious error.
Add GangPreemptionHeroWorkload benchmark to scheduler_perf kubernetes/kubernetes
The new GangPreemptionHeroWorkload benchmark runs a 4900-node scenario and lands as a baseline for upcoming workload-aware preemption work, measured across both performance and accuracy. On the current master the hero workload's initial pass takes about 10.22 seconds, so anyone touching PodGroupPostFilter and the preemption evaluation path has a regression reference to compare against.
Migrate off deprecated bom APIs kubernetes/release
bom v0.8.0 deprecates spdx.DocBuilder and spdx.OpenDoc, so kubernetes/release now generates SBOMs with bom.Generate and reads them with bom.Open, converting to the SPDX object model through spdx.FromProtobom where existing code still needs it. If you build on the release tooling's SBOM output, that is the API shape to target.
AEP-9936: Per-VPA Observation Window kubernetes/autoscaler
AEP-9936 proposes an optional initialDelaySeconds on PodUpdatePolicy. During that window the Updater and the Admission Controller treat the VPA as if updateMode were Off regardless of the configured mode, which gives newly started workloads time to stabilize before recommendations and evictions apply; it pairs with the pod-to-VPA matching benchmarks that track the matching path's O(n) cost.
DRA: avoid deadlocks in ResourceSlice controller Update and kubelet plugin shutdown kubernetes/kubernetes
With ReconcilePoolWithName set, Controller.Update rejected resources containing other pools and reported it through ErrorHandler while still holding c.mutex, and the kubelet plugin shutdown path had a matching deadlock. The fix removes the lock-ordering hazard, so DRA pool reconciliation and plugin teardown no longer stall against each other.
Merge pull request #142607 from cwedgwood/fix/max-header-value-count kubernetes/apiserver
The apiserver now accepts large identity header sets under Go 1.27, releasing the max-header-value-count limit that had been cutting off requests carrying broad identity header chains. If you front the apiserver with an authenticating proxy, this sets how many identity headers you can pass before requests are rejected.
[OCI] Use registered node ephemeral-storage for template kubernetes/autoscaler
Cluster Autoscaler was populating an OCI template node's ResourceEphemeralStorage from the cluster-autoscaler/node-ephemeral-storage freeform tag even when the pool already had registered nodes with a different actual value. Templates now use the registered nodes' ephemeral storage, so bin-packing decisions match what the nodes report.
Trust SPO provenance of main at SLSA build level 3 kubernetes/k8s.io
The Security Profiles Operator attests its profiles on every push to main under the isolated provenance workflow, and its signer may now claim the GitHub Actions builder for main at SLSA build level 3. Anything consuming SPO artifacts from main through a provenance or policy check needs to expect that builder identity. Alongside: an etcd 3.7 perf-test bump and watch delay measurement in the loa...
$ ls kubernetes/week/ # the briefings behind this review
Keep up with Kubernetes in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.