Kubernetes: Post-Quantum Crypto Push and Critical Dependency Fixes
Security dominates the day, with ML-DSA post-quantum support landing across certificates, tokens and test clusters, alongside urgent fixes for a gRPC heap-exhaustion CVE. Reliability hardening for resource decoding, Job recreation, and API watch correctness rounds out the activity.
Duration: PT2M52S
Episode overview
This episode is a short developer briefing from Kubernetes.
It explains recent repository work in plain language.
- Show: Kubernetes
- Published: 2026-09-25T13:04:19Z
- Audio duration: PT2M52S
Transcript excerpt
This excerpt keeps the crawler page concise. Listen to the episode or use the RSS feed for the full update.
Hello, it's September 25th, 2026, and this is your Kubernetes developer briefing.
Security dominates today, with a coordinated push toward post-quantum cryptography alongside urgent fixes for a gRPC heap-exhaustion vulnerability.
Four related changes move ML-DSA, the FIPS 204 post-quantum signature algorithm, through the stack. Merged support in Certificate Signing Requests in P R 142196 lays the foundation, while a follow-up work-in-progress in 142397 extends it to service account tokens. To make that usable, client-go now lets callers…
In parallel, maintainers are closing known CVEs. P R 142410 lifts gRPC to version 1.84 and etcd modules to 3.7.2, specifically because the older gRPC line lacked the fix for CVE-2026-84304, where a malicious HTTP-2 peer could exhaust memory — notable because the kubelet's probe client dials pod-controlled servers.…
Reliability hardening rounds it out. P R 142395 preserves decoding for old resource quantity strings that overflow 32-bit scale, preventing a single legacy object from breaking list operations from etcd. Job controller cherry-picks in 142390 through 142392 clear stale expectations so a recreated job with the same…
What's next: Watch for…
Nearby episodes from Kubernetes
- Resize Validation and Watch Cache Hardening
- Scheduler Caching, DRA Fixes, and Validation Hardening
- CLI Fixes and Library Safety
- Kubelet Correctness Push and Scheduler Cleanup
- Weekly Recap - Resource Allocation Matures and Validation Stabilizes
- Silent Misclassifications and Leaked Credentials
- Correctness Fixes Across Kubelet and Scheduling
- Quiet Data Gets a Second Look