$ cat kubernetes/week/2026-10-19.log
the week in review · Oct 19 – Oct 25, 2026
IPVS deprecation gains migration guide to iptables, nftables
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
Same week kubectl removed its OpenAPI v2 fallback and client-go rebuilt the unstructured extractor on v3, breaking any tooling still on the old path.
KEP-5495: blog post about IPVS deprecation kubernetes/website
The companion blog post to KEP-5495 covers both the deprecation and the path off it, to iptables or nftables. If your clusters still run kube-proxy in IPVS mode, start measuring the switch now rather than at removal time.
kubectl: remove OpenAPI v2 fallback from apply and diff patcher kubernetes/kubernetes
kubectl's apply and diff patcher no longer fall back to OpenAPI v2, and client-go in the same week switched its unstructured extractor to build from v3 instead of the deprecated v2. Confirm every client and CRD serving path in your toolchain publishes v3 schemas before you bump.
upgrade .go-version to 1.27.3 kubernetes/kubernetes
The tree moved to Go 1.27.3, which is a security release for crypto/x509; binaries pick it up through GOTOOLCHAIN, with kube-cross and go-runner images following when published. Any build pinned to the older toolchain does not get that fix.
Align non-recursive responses between cacher and etcd kubernetes/kubernetes
The cacher returned all objects under a prefix on non-recursive initial watches where etcd returns only the requested initial-events-end bookmark. The PR notes the mismatch is not exposed to users, but anyone reading watch semantics off the cacher's behavior rather than etcd's now has aligned code.
feat: Add ALPN policy annotation for NLB TLS listeners kubernetes/cloud-provider-aws
A new service.beta.kubernetes.io/aws-load-balancer-alpn-policy annotation sets the ALPN policy on NLB TLS listeners, with HTTP1Only, HTTP2Only, HTTP2Optional, HTTP2Preferred and None as values. Previously you reached the AWS console or the autoscaler to change it.
Bump golang.org/x/net to v0.60.0 kubernetes/cloud-provider-aws
cloud-provider-aws moves golang.org/x/net to v0.60.0, closing GO-2026-6603, GO-2026-6610, GO-2026-6611, GO-2026-6612 and GO-2026-6617 reported by govulncheck. It is a dependency bump, but a security-driven one.
Merge pull request #142051 from antcybersec/remove-kep4193-serviceaccount-token-gates kubernetes/kubernetes
The KEP-4193 serviceaccount token feature gates are gone after GA. Clusters with those gate names pinned in manifests or kubelet/apiserver flags need them removed before they fail validation.
Use 30/30/30 days triage intervals for Kueue PRs kubernetes/test-infra
Alongside: Kueue PRs moved to a 30/30/30 day triage schedule given 329 open pull requests, 98 of them inactive past 30 days; kops disabled aws-cli request checksums for mock S3 uploads after 2.38 turned on the CRT transfer client by default; and the site removed German Katacoda tutorial pages that had been dead since the 2023 shutdown.
$ ls kubernetes/week/ # the briefings behind this review
Keep up with Kubernetes in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.