2022 — the census¶
69 posts, 2022-01-07 to 2022-12-30. Kubernetes 1.24, 1.25 and 1.26 are in scope, with 1.23's release interview arriving in April. Only 2016's 90 and 2018's 70 are bigger among the years censused so far — see the method.
Yield: 13 walk, upper-band, level with 2024 and behind only 2016's 15. 43 read, 1 dated, 12 skip.
The reject rate reaches its floor. 17%, against 48%, 42%, 38%, 40%, 37%, 41%, 21% and 19% for
the years already censused — the lowest in the archive. meta takes 14 rows and 20%, also the
lowest share recorded. 55 of the 69 posts are about how the software behaves, and the year is not
short: it is the volume of technical posts that grew, not the volume of community writing. The
clustering 2021 introduced holds but loosens — the three busiest months carry 55% against 2021's
62% — because 2022 spreads its release work over four months instead of three. May, August,
September and December carry 49 of the 69 posts between them, and December alone carries 16.
The dockershim arc closes, and it takes five posts across three years to do it. The pinned tree holds exactly five posts with dockershim in the title: the 2020 deprecation FAQ, 2021's Dockershim removal is coming. Are you ready?, and three in this year — a statement of what Docker and Mirantis will keep supporting, an updated FAQ, and a history. A sixth post, 08, is the upgrade checklist under a different title. The removal itself lands in 1.24, and the pin's deprecation guide has no v1.24 section at all: the removal this project spent three years preparing people for left no row in the place where removals are recorded, because dockershim was a component and the guide only tracks APIs. The seven API removals that are recorded arrive one release later, in 1.25.
A genre that exists only in 2022. Two posts in the whole 767-post corpus are titled "Historical Context" — Dockershim: The Historical Context and PodSecurityPolicy: The Historical Context — and both are here, each published within weeks of the removal it describes. The project spent this year writing the history of its own deletions while performing them. 2021 gave PodSecurityPolicy a deprecation post about its future; 2022 gives it an obituary.
Three ladders restart rather than continue, and the tree keeps exactly one receipt.
Kubernetes 1.25: PodHasNetwork Condition for Pods
announces a gate called PodHasNetworkCondition setting a condition called PodHasNetwork. At
the pin both names are gone: the gate is PodReadyToStartContainersCondition, its stage table
begins at alpha 1.28, and it reached stable at 1.37 — the pin's own release. Its file is the
only one of 488 feature-gate files that carries a former_titles: field, and what it records
is this post's identifier.
alpha support for running Pods with user namespaces
announces UserNamespacesStatelessPodsSupport; the pin has UserNamespacesSupport, alpha from
1.28, stable at 1.36, and no record anywhere of the old name.
Alpha API For Dynamic Resource Allocation
is written against resource.k8s.io/v1alpha1 with vendor-defined parameters; DRA was redesigned
around structured parameters, its gate's ladder begins again at alpha 1.30, and it went stable at
1.34 on resource.k8s.io/v1. Three alphas from one year that were replaced rather than promoted.
The census has been reading ladders as monotonic since 2019; this year says they are not.
The stationary rungs, and one that is stationary at patch level.
Maximum Unavailable Replicas for StatefulSet
announces an alpha in 1.24 that is alpha from 1.24 through 1.34 — eleven releases — and beta
only from 1.35, still not stable at 1.37. Its beta entry is split into two ranges at a patch
boundary, 1.35.0–1.35.3 and 1.35.4 onward; exactly two gates of 488 carry a patch-level stage
version at all, and this is one of them. ContainerCheckpoint, announced at 56, has been beta
since 1.30 and is beta still: eight releases on the middle rung. Against them, GRPCContainerProbe
went beta to stable to retired inside four releases of the post announcing it.
Four subjects left no trace, and one erased its predecessor. kueue has zero occurrences at
the pin, objectstorage.k8s.io has zero, kluctl has zero — a SIG project, a proposed API group
and a tool, all alive elsewhere and none of them in the documentation. The fourth is the reverse:
k8s.gcr.io, the registry every manifest in this archive older than November 2022 points at, also
has zero occurrences, while registry.k8s.io has 99 across 47 files. The rename did not just
land; it removed the old name from the tree entirely, which is why 53 is a walk.
dated returns after two empty years.
Forensic container checkpointing in Kubernetes
is a complete procedure — POST to the kubelet, take the CRIU archive, rebuild it as an image — and
it needs CRIU in the runtime and root on the node, which is past the ceiling these labs are built
to. Both tests hold, the vendor rule does not reach it first, and it books cleanly. dated now
stands at 12 rows in 541.
Four things in the topic tallies are worth the taxonomy's attention. nodes takes 12 rows and
3 walks, records for both — a year of kubelet work, from cgroup v2 to user namespaces.
storage takes 10 rows, also a record, and only 1 walk: the storage posts of 2022 are CSI
driver-side work, and a census whose lab has one node and one provisioner cannot reach most of it.
sched takes 3 rows and 2 walks after being empty in 2021, matching 2016 for the most
scheduling exercises in a year. And etcd is empty again: across 541 censused rows the topic
has three rows and has never once produced an exercise, which is the longest-running hole in the
vocabulary. ecosystem keeps its own record intact — 64 rows across nine years, zero walks,
exactly as the genre rule requires.
Census¶
Verdicts and topics are defined in ../README.md. Every post has a
row, and a row's title always links the post — never the exercise file, so the row never
changes once written. The Exercises table below is the progress record.
| post | date | k8s | verdict | topic | why |
|---|---|---|---|---|---|
| Kubernetes is Moving on From Dockershim: Commitments and Next Steps | 01-07 | 1.24 | read |
nodes |
Docker and Mirantis restate what they will keep supporting once the kubelet stops shipping dockershim, and point at cri-dockerd as the adapter. No procedure and no manifest, but it is the post that names who owns the code after the removal — at the pin cri-dockerd appears in the migration pages as a third-party adapter and nothing in the kubelet answers for Docker. Read as the ownership half of the dockershim arc. |
| Meet Our Contributors - APAC (India region) | 01-10 | — | skip |
meta |
Contributor interviews from the India region. The community genre, and the rubric's maintainer-interview rule reaches it as process rather than engineering: the questions are about how people joined, not about code they own. |
| Securing Admission Controllers | 01-19 | — | read |
security |
A survey of what an admission controller can do to a cluster that trusts it, written after several third-party webhooks shipped with over-broad RBAC. At the pin the built-in ValidatingAdmissionPolicy exists precisely to avoid running a webhook binary for simple checks — 63 announces it nine months later. Read for the threat model; the mechanism it warns about is now the fallback, not the default. |
| Spotlight on SIG Multicluster | 02-07 | — | skip |
meta |
SIG spotlight. Class-wide skip in this census since 2020's SIG-Windows post: the subject is how a group organises itself. |
| SIG Node CI Subproject Celebrates Two Years of Test Improvements | 02-16 | — | skip |
meta |
A subproject's report on two years of test-signal work. Real engineering behind it, but the post is a retrospective on process — no interface, no manifest, nothing that can be run. |
| Updated: Dockershim Removal FAQ | 02-17 | 1.24 | read |
nodes |
The FAQ, updated for the release that actually removed dockershim. Its value now is the check it teaches: kubectl get nodes -o wide and read the container-runtime column. At the pin every supported runtime is a CRI implementation and the question the FAQ answers cannot arise. Read as the operator-facing companion to 12's history. |
| Meet Our Contributors - APAC (Aus-NZ region) | 03-16 | — | skip |
meta |
Contributor interviews from the Aus-NZ region. Same genre as 02. |
| Is Your Cluster Ready for v1.24? | 03-31 | 1.24 | read |
nodes |
A checklist for the 1.24 upgrade — find nodes still on dockershim, find tooling that shells out to docker, find the beta APIs about to go. Useful as a period document of what a migration felt like; every item on the list is now four years settled, and the removal itself is booked at 09. |
| Kubernetes Removals and Deprecations In 1.24 | 04-07 | 1.24 | read |
api |
The removal notice for the release everyone remembers for removals, and the pin's deprecation guide has no v1.24 section at all — dockershim was a component, not an API, so it left no row where API removals are recorded. The API removals this post deprecates land in 1.25 and are booked at 26. Read for the distinction; 2021's removal exercise already teaches the manifest work. |
| Increasing the security bar in Ingress-NGINX v1.2.0 | 04-28 | — | read |
ecosystem |
Ingress-NGINX v1.2.0 removes the ability for an Ingress annotation to inject arbitrary configuration into the controller's nginx template, closing CVE-2021-25742. It documents a decision and the compatibility it chose to break, which is what earns an ecosystem post a read. The controller is out of tree; at the pin the project's own docs carry the current guidance. |
| Frontiers, fsGroups and frogs: the Kubernetes 1.23 release interview | 04-29 | 1.23 | read |
meta |
Release interview. Every one in this archive reads: the account is of how a release team worked, not of how the software behaves. |
| Dockershim: The Historical Context | 05-03 | 1.24 | read |
history |
The project writing its own history of a removal, from the 2016 CRI proposal to the 1.24 deletion, while the deletion was still fresh. One of two "Historical Context" posts this year — a genre that appears in 2022 and nowhere before it. Read for the account; there is nothing to run. |
| Kubernetes 1.24: Stargazer | 05-03 | 1.24 | skip |
meta |
Release announcement. |
| Kubernetes 1.24: Volume Expansion Now A Stable Feature | 05-05 | 1.24 | walk |
storage |
Volume expansion reaches GA, and with it three feature gates retire together: at the pin ExpandPersistentVolumes (alpha 1.8, beta 1.11 through 1.23, stable 1.24), ExpandCSIVolumes and ExpandInUsePersistentVolumes all record toVersion: 1.26 and none is enableable any more. Thirteen releases on the beta rung for the oldest of them. Editing a bound PVC's spec.resources.requests.storage and watching the capacity follow is a single-node operation. |
| Kubernetes 1.24: Storage Capacity Tracking Now Generally Available | 05-06 | 1.24 | read |
storage |
CSIStorageCapacity reaches GA, so the scheduler stops placing Pods on nodes whose driver has no room. At the pin the object is storage.k8s.io/v1 and unconditional. Observing it needs a CSI driver that publishes capacity, and the scheduling half is invisible on one node — the ladder fact is real but the demonstration is not. |
| Kubernetes 1.24: gRPC container probes in beta | 05-13 | 1.24 | walk |
api |
gRPC probes to beta: livenessProbe.grpc instead of an exec that shells out to grpc_health_probe. The post carries an inline _Update:_ added later saying the feature went stable in v1.27, and at the pin GRPCContainerProbe records stable from 1.27 with toVersion: 1.28 — announced, graduated and retired as a gate inside four releases of this post. The before/after is two Pods and one binary that no longer needs to be in the image. |
| Kubernetes 1.24: Volume Populators Graduate to Beta | 05-16 | 1.24 | read |
storage |
Volume populators to beta: spec.dataSourceRef lets a PVC be filled from an arbitrary CRD. At the pin the field is storage.k8s.io core API and the gate is gone. Every demonstration needs a populator controller and a CSI driver, and the interesting part is the controller, which is out of tree. |
| Kubernetes 1.24: Prevent unauthorised volume mode conversion | 05-18 | 1.24 | read |
storage |
A security fix given its own post: without it, a user could restore a snapshot into a PVC with a different volumeMode and read a filesystem as a raw block device. The remedy is an annotation the snapshot controller sets, not a knob. Read for the attack; the setup is a snapshot-capable driver and a hostile manifest. |
| Kubernetes 1.24: Introducing Non-Graceful Node Shutdown Alpha | 05-20 | 1.24 | walk |
nodes |
The node.kubernetes.io/out-of-service taint: an operator's assertion that a node is gone and will not come back, which lets the controller detach its volumes and let a StatefulSet's replica move. At the pin NodeOutOfServiceVolumeDetach reads alpha 1.24, beta 1.26, stable 1.28, toVersion: 1.31 — gone as a gate, permanent as behaviour. Cordon a node, kill the kubelet, watch the Pod hang; add the taint, watch it move. |
| Kubernetes 1.24: Avoid Collisions Assigning IP Addresses to Services | 05-23 | 1.24 | walk |
net |
ServiceIPStaticSubrange splits the Service CIDR so that dynamically allocated ClusterIPs come from the upper band and hand-picked ones from the lower, ending the collisions that made static Service IPs unusable. Alpha 1.24, beta 1.25, stable 1.26 and toVersion: 1.27 at the pin. Allocating a few Services in a small CIDR and reading where the addresses land is a single-cluster exercise. |
| Contextual Logging in Kubernetes 1.24 | 05-25 | 1.24 | read |
obs |
Contextual logging — klog calls carrying a logger through the call stack so a message can name the object it is about. The change is inside the components; nothing about it is visible from a manifest. Read for how the project reasons about its own logs. |
| Kubernetes 1.24: Maximum Unavailable Replicas for StatefulSet | 05-27 | 1.24 | walk |
api |
maxUnavailable for StatefulSet rolling updates, announced here as alpha in 1.24. At the pin the gate reads alpha from 1.24 all the way to 1.34 and beta only from 1.35 — eleven releases on the first rung, still not stable at 1.37, and the beta entry is split at a patch boundary (1.35.0–1.35.3, then 1.35.4 on). The longest alpha this census has met after MemoryQoS. The exercise is the gate table and a rolling update that still updates one Pod at a time. |
| Annual Report Summary 2021 | 06-01 | — | skip |
meta |
The project's annual report summary. Governance and finances. |
| Kubernetes Gateway API Graduates to Beta | 07-13 | — | read |
net |
Gateway API reaches beta at v0.5.0 under gateway.networking.k8s.io. The rename from networking.x-k8s.io is the discontinuity and 2021's exercise already carries it; what is left here is a version bump on a CRD bundle that has since gone to v1. |
| Spotlight on SIG Docs | 08-02 | — | skip |
meta |
SIG spotlight. |
| Kubernetes Removals and Major Changes In 1.25 | 08-04 | 1.25 | read |
api |
Seven API removals in one release — batch/v1beta1 CronJob, discovery/v1beta1, events/v1beta1, autoscaling/v2beta1, policy/v1beta1 including PodSecurityPolicy, and node/v1beta1 RuntimeClass — matching the pin's deprecation guide exactly. The second-largest removal event in the archive after v1.22, and the manifest work it needs is the work 2021's removal exercise already teaches. |
| Enhancing Kubernetes one KEP at a Time | 08-11 | — | skip |
meta |
How a KEP moves through the process. Contributor-facing. |
| Meet Our Contributors - APAC (China region) | 08-15 | — | skip |
meta |
Contributor interviews from the China region. Same genre as 02 and 07. |
| Stargazing, solutions and staycations: the Kubernetes 1.24 release interview | 08-18 | 1.24 | read |
meta |
Release interview. |
| Spotlight on SIG Storage | 08-22 | — | skip |
meta |
SIG spotlight. |
| Kubernetes v1.25: Combiner | 08-23 | 1.25 | skip |
meta |
Release announcement. |
| PodSecurityPolicy: The Historical Context | 08-23 | 1.25 | read |
history |
PodSecurityPolicy's own obituary, published the week it was removed: why the admission controller could not be made safe, and what Pod Security Admission does differently. The second "Historical Context" post of the year. The replacement is exercised from 2021; this reads for the reasoning behind the retirement. |
| Kubernetes v1.25: Pod Security Admission Controller in Stable | 08-25 | 1.25 | read |
security |
Pod Security Admission reaches stable as PodSecurityPolicy is deleted. The three namespace labels and the three levels are exactly what 2021's Pod Security exercise walks; this post is the same mechanism one rung further up. |
| Kubernetes 1.25: CSI Inline Volumes have graduated to GA | 08-29 | 1.25 | read |
storage |
CSI ephemeral inline volumes to GA — a volume declared inside the Pod spec and owned by its lifetime. At the pin the gate is gone and the field is ordinary. Demonstrating it needs a driver that supports the ephemeral mode, and the observable difference from an emptyDir is small. |
| Kubernetes 1.25: cgroup v2 graduates to GA | 08-31 | 1.25 | walk |
nodes |
cgroup v2 reaches GA, and the pin has moved much further than GA: cgroup v1 is deprecated and the kubelet will no longer start on a cgroup v1 node by default. The post's careful "you may still be on v1" framing has become the failure mode. Reading /sys/fs/cgroup/cgroup.controllers inside a container, and the memory-limit file whose path and units both changed between the versions, is a one-node exercise with a visible before and after. |
| Introducing COSI: Object Storage Management using Kubernetes APIs | 09-02 | — | read |
storage |
COSI proposes objectstorage.k8s.io — Bucket and BucketClaim objects modelled on PV and PVC — arguing that object storage does not fit the volume API. Four years on, objectstorage.k8s.io has zero occurrences at the pin. Read for the argument about where an API boundary should sit; there is no in-tree implementation to run against. |
| Kubernetes’s IPTables Chains Are Not API | 09-07 | 1.25 | walk |
net |
SIG Network declares that the iptables chains kube-proxy and the kubelet create are not an interface, and warns that KUBE-MARK-DROP and friends will start disappearing. At the pin the warning has been made good twice over: those chain names survive in three documentation files, and kube-proxy has a whole additional backend, nftables, where they do not exist at all. Dumping the rules a node actually has, in each mode, is the exercise. |
| Kubernetes 1.25: KMS V2 Improvements | 09-09 | 1.25 | read |
security |
KMS v2: per-resource DEKs and a key-ID the apiserver can check without a round trip. At the pin KMSv2 reads alpha 1.25, beta 1.27, stable 1.29, toVersion: 1.31. The mechanism is worth reading for how encryption-at-rest is actually keyed; exercising it needs a KMS plugin listening on a socket beside the apiserver. |
| Announcing the Auto-refreshing Official Kubernetes CVE Feed | 09-12 | — | read |
security |
The project starts publishing its own CVE list as a machine-readable feed. Process, and a useful pointer; nothing in a cluster changes. |
| Kubernetes 1.25: PodHasNetwork Condition for Pods | 09-14 | 1.25 | walk |
nodes |
The PodHasNetwork condition, alpha in 1.25 behind PodHasNetworkCondition. At the pin the condition is PodReadyToStartContainers, the gate is PodReadyToStartContainersCondition, its ladder restarts at alpha 1.28, and it reached stable at 1.37 — the pin's own release. The gate file is the only one of 488 that carries a former_titles: field naming what it used to be called. A post whose every identifier was renamed, with the tree keeping the receipt. |
| Kubernetes 1.25: Two Features for Apps Rollouts Graduate to Stable | 09-15 | 1.25 | read |
api |
minReadySeconds for StatefulSet and maxSurge for DaemonSet both reach stable. Two small fields, both now unconditional, both demonstrable — but the demonstration is a rollout that goes slightly differently, and the ladder is unremarkable. |
| Kubernetes 1.25: Local Storage Capacity Isolation Reaches GA | 09-19 | 1.25 | read |
storage |
Local ephemeral storage limits reach GA, so a Pod that fills its emptyDir gets evicted instead of filling the node. At the pin LocalStorageCapacityIsolation is stable from 1.25 with toVersion: 1.26. The eviction is observable, but it is a resource limit behaving like every other resource limit. |
| Kubernetes 1.25: Use Secrets for Node-Driven Expansion of CSI Volumes | 09-21 | 1.25 | read |
storage |
A secret can now be handed to the CSI driver for the node-side half of a volume expansion, closing a gap where only the controller-side call was authenticated. Narrow, driver-facing, and invisible without a driver that uses it. |
| Kubernetes 1.25: CustomResourceDefinition Validation Rules Graduate to Beta | 09-23 | 1.25 | walk |
api |
CRD validation rules to beta: x-kubernetes-validations with CEL expressions inside the schema, so a custom resource can be rejected by the apiserver with no webhook anywhere. At the pin CustomResourceValidationExpressions is stable from 1.29 and retired as a gate after 1.30 — the mechanism is now simply how CRDs work. Applying a CRD with a rule and watching a bad resource come back rejected needs nothing but the apiserver. |
| Kubernetes 1.25: Kubernetes In-Tree to CSI Volume Migration Status Update | 09-26 | 1.25 | read |
storage |
The annual CSI-migration status table, one release on from 2021's. At the pin CSIMigration is stable from 1.25 and retired after 1.26, and every in-tree plugin it tracks is gone. A status update whose status is settled. |
| Enforce CRD Immutability with CEL Transition Rules | 09-29 | 1.25 | read |
api |
A tutorial for CEL transition rules — oldSelf — to make a field immutable after creation. Genuinely instructive, and the same mechanism as 44 one layer deeper; the exercise is booked there. |
| Kubernetes 1.25: alpha support for running Pods with user namespaces | 10-03 | 1.25 | walk |
security |
User namespaces, alpha in 1.25 behind UserNamespacesStatelessPodsSupport: root inside the container mapped to an unprivileged UID on the node. At the pin that gate name does not exist. The feature is UserNamespacesSupport, its ladder restarts at alpha 1.28, and it went stable in 1.36 — a second identifier from this year that the tree renamed rather than graduated. Reading a Pod's /proc/self/uid_map with the field on and off is the whole demonstration. |
| Introducing Kueue | 10-04 | — | read |
sched |
Kueue: job queueing as a controller outside the scheduler, with quota held by a ResourceFlavor. At the pin kueue has zero occurrences in the documentation tree — the project is alive and out of tree, and the core scheduler still has no queue. Read for the argument about what belongs in the scheduler; 66 is where this year's in-tree scheduling change is exercised. |
| Current State: 2019 Third Party Security Audit of Kubernetes | 10-05 | — | read |
security |
What became of the 2019 third-party audit's findings, item by item. A useful record of how a project metabolises an audit. Nothing to run. |
| Server Side Apply Is Great And You Should Be Using It | 10-20 | — | read |
api |
An argument for server-side apply over client-side, from a maintainer, three years after SSA shipped. The mechanism and its failure modes are exercised from 2020; this is advocacy on top of an interface already booked. |
| Live and let live with Kluctl and Server Side Apply | 11-04 | — | read |
ecosystem |
A GitOps tool's author on how field ownership under server-side apply lets two controllers write the same object without fighting. It documents a decision and the alternative it rejects, which is the bar an ecosystem post has to clear here. kluctl has zero occurrences at the pin. |
| Kubernetes Removals, Deprecations, and Major Changes in 1.26 | 11-18 | 1.26 | read |
api |
Two API removals — flowcontrol.apiserver.k8s.io/v1beta1 and autoscaling/v2beta2 — plus the CRI v1alpha2 removal that finally required a modern containerd. Matches the pin's guide, which gives v1.26 two subsections. The smallest of this year's three removal posts, and the same exercise as 26. |
| registry.k8s.io: faster, cheaper and Generally Available (GA) | 11-28 | — | walk |
tooling |
registry.k8s.io reaches GA and k8s.gcr.io is put on notice; the post has been edited since, its freeze date rewritten as |
| Boosting Kubernetes container runtime observability with OpenTelemetry | 12-01 | — | read |
obs |
OpenTelemetry spans threaded through the kubelet and CRI-O so a Pod start can be traced across the runtime boundary. Excellent material and entirely about a collector you have to run beside the cluster; the Kubernetes-side surface is one kubelet config stanza. |
| Finding suspicious syscalls with the seccomp notifier | 12-02 | — | read |
security |
The seccomp notifier: catch a syscall a profile does not allow, log it, and use the log to write a tighter profile. The mechanism lives in the Security Profiles Operator, out of tree, and the post is a walkthrough of that operator. |
| Forensic container checkpointing in Kubernetes | 12-05 | 1.25 | dated |
nodes |
Forensic container checkpointing: POST to the kubelet's checkpoint endpoint, get a CRIU archive, rebuild it as an image and inspect it elsewhere. A complete procedure — and it needs CRIU in the runtime, kubelet certificates, and root on the node filesystem, which is past the ceiling this repo's labs are built to. At the pin ContainerCheckpoint has been beta since 1.30 and is still beta at 1.37: eight releases on the middle rung. |
| Kubernetes v1.26: Electrifying | 12-09 | 1.26 | skip |
meta |
Release announcement. |
| Kubernetes 1.26: We're now signing our binary release artifacts! | 12-12 | 1.26 | read |
tooling |
SIG Release starts signing binaries as well as images, with cosign and a transparency log. Verifiable, and verifiable entirely outside a cluster — the exercise would be a supply-chain exercise, which is where the labs already put it. |
| Kubernetes 1.26: Windows HostProcess Containers Are Generally Available | 12-13 | 1.26 | read |
nodes |
Windows HostProcess containers reach GA — the Windows answer to a privileged container, able to configure the node it runs on. It needs Windows nodes, but it is an announcement with examples rather than a procedure, so it is a read and not a dated. At the pin the gate is stable from 1.26 and retired after 1.27. |
| Kubernetes 1.26: Alpha API For Dynamic Resource Allocation | 12-15 | 1.26 | walk |
sched |
Dynamic resource allocation, alpha in 1.26 on resource.k8s.io/v1alpha1 with ResourceClass, ResourceClaim and vendor-defined parameters. That API does not exist at the pin: DRA was redesigned around structured parameters, the gate's own ladder restarts at alpha 1.30, and it reached stable at 1.34 on resource.k8s.io/v1. The clearest case in the archive of an alpha that was replaced rather than promoted, and the two API shapes side by side are the exercise. |
| Kubernetes 1.26: Non-Graceful Node Shutdown Moves to Beta | 12-16 | 1.26 | read |
nodes |
The same out-of-service taint as 19, one rung up. The mechanism is unchanged; the exercise is booked at the alpha post that introduced the taint. |
| Kubernetes 1.26: Device Manager graduates to GA | 12-19 | 1.26 | read |
nodes |
The device plugin framework reaches GA after sixteen releases in beta — 1.10 to 1.25 — which is a ladder fact worth having. Everything it allocates is hardware this repo's labs do not have. |
| Kubernetes 1.26: Introducing Validating Admission Policies | 12-20 | 1.26 | read |
api |
ValidatingAdmissionPolicy, alpha in 1.26: CEL in the apiserver instead of a webhook binary. Stable at 1.30, and the CEL discontinuity this year is exercised at 44. The policy API's own arc — and the later MutatingAdmissionPolicy — belongs to a year that covers it at GA. |
| Kubernetes v1.26: GA Support for Kubelet Credential Providers | 12-22 | 1.26 | read |
nodes |
Kubelet credential provider plugins reach GA, which is how the three built-in cloud registry integrations left the kubelet binary. The plugin is an executable configured on the node; the interesting half is the exec contract, not anything visible from the API. |
| Kubernetes 1.26: Support for Passing Pod fsGroup to CSI Drivers At Mount Time | 12-23 | 1.26 | read |
storage |
CSI drivers can apply fsGroup at mount time instead of leaving the kubelet to walk the tree changing ownership — a large performance difference on big volumes and no API change at all. At the pin DelegateFSGroupToCSIDriver is stable from 1.26 and retired after 1.27. |
| Kubernetes 1.26: Pod Scheduling Readiness | 12-26 | 1.26 | walk |
sched |
Scheduling gates: spec.schedulingGates holds a Pod in a new SchedulingGated state until something removes the gate, so the scheduler stops burning cycles on Pods that cannot run yet. Alpha 1.26, stable 1.30 and unconditional at the pin. A Pod that sits gated, a patch that removes the gate, and a Pod that schedules — all visible in kubectl get pods on one node — and sched was an empty topic in 2021. |
| Kubernetes v1.26: CPUManager goes GA | 12-27 | 1.26 | read |
nodes |
CPUManager reaches GA after sixteen releases in beta, from 1.10 to 1.25. The static policy needs dedicated cores and a kubelet reconfiguration to show anything; the ladder fact is the durable part. |
| Kubernetes 1.26: Job Tracking, to Support Massively Parallel Batch Workloads, Is Generally Available | 12-29 | 1.26 | read |
api |
Job tracking with finalizers becomes the only implementation, letting the Job controller handle 100k Pods without losing count. At the pin the gate is stable from 1.26 and retired after 1.28. The correctness it buys is invisible below the scale that motivated it. |
| Kubernetes v1.26: Advancements in Kubernetes Traffic Engineering | 12-30 | 1.26 | read |
net |
Three traffic-engineering changes at once: internalTrafficPolicy and EndpointSlice terminating conditions to GA, proxy terminating endpoints to beta. All three are about what a load balancer does during a rolling update, and none of them is observable without a load balancer in front of the cluster. |
Exercises¶
Thirteen walk verdicts, numbered in publication order, and all thirteen are written. The rubric
they are authored against was ratified in
#57.