$ cat kubernetes/week/2026-10-12.log
the week in review · Oct 12 – Oct 18, 2026
node-problem-detector 1.37.0 ships with three CVE fixes
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
kubectl drops its WebSocket opt-out flags, and the apiserver gains watch cache correctness fixes plus a beta size-estimate metric.
v1.37.0 kubernetes/node-problem-detector
The release replaces OpenCensus with OpenTelemetry for metrics export while keeping Prometheus metric names unchanged, so existing dashboards and alerts survive the upgrade. It also adds a per-rule invoke_interval for custom plugin monitor rules and two zswap metrics, memory/zswap_bytes_used and memory/zswap_compression_efficiency.
Bump google.golang.org/grpc to v1.83.2 to fix CVEs kubernetes/node-problem-detector
The gRPC bump fixes CVE-2026-84304, reachable through the gRPC client used by the metric exporters, along with CVE-2026-84445 and CVE-2026-84303. If you run the exporter path, this is the reason to take 1.37.0 now.
kubectl: always use WebSockets for exec, attach and port-forward kubernetes/kubernetes
KUBECTL_REMOTE_COMMAND_WEBSOCKETS and KUBECTL_PORT_FORWARD_WEBSOCKETS are gone; kubectl now always tries WebSockets first and falls back to SPDY for exec, attach, cp and port-forward. Any wrapper or CI script that sets those variables will silently stop having an effect.
Merge pull request #142919 from serathius/watchcache-correctness-prepared-token kubernetes/apiserver
The cacher now uses the prepared key when handling the continue token. This is the correctness half of the watch cache work, relevant to controllers and informers that paginate list-and-watch against the apiserver.
Merge pull request #141164 from LiomSV/size_estimate_to_beta kubernetes/apiserver
apiserver_resource_size_estimate_bytes moves to beta, which means the metric you would alert on for large objects can now be treated as a stable series name.
generators: skip unexported fields of types with custom unmarshalling kubernetes/kube-openapi
openapi-gen and the names_match API rule now skip unexported, non-embedded fields of types with custom unmarshalling, using the same implementsCustomUnmarshalling check as mustEnforceDefault. Plain structs are unaffected, but generated OpenAPI for custom-unmarshalling types will differ.
Update github.com/godbus/dbus/v5 to v5.2.4 kubernetes/kubernetes
godbus/dbus v5.2.4 carries the fix for the windows/darwin build break in v5.2.3, so the pin is dropped. The commit notes that AI (Claude Code) was used to run the vendor update and verification.
Merge pull request #142974 from pohly/quantity-deepcopy-deprecation kubernetes/dynamic-resource-allocation
resource.Quantity.DeepCopy is now deprecated in dynamic-resource-allocation, a quiet signal to stop calling it directly in DRA-adjacent code. Alongside: golangci-lint now enforces deprecatedComment notices, deprecated field types keep theirs (GitRepoVolumeSource, PodResizeStatus, internal NodeConfigSource), and the release tooling switched to github.com/policylabs/signer after the module moved.
$ ls kubernetes/week/ # the briefings behind this review
Keep up with Kubernetes in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.