2023 — the census¶
78 posts, 2023-01-02 to 2023-12-20. Kubernetes 1.27, 1.28 and 1.29 are in scope, with 1.26's January posts and its release interview arriving alongside. Only 2016's 90 is bigger among the years censused so far — see the method.
Yield: 13 walk, upper-band, level with 2022 and 2024 and behind only
2016's 15. 51 read, 2 dated, 12 skip.
A new floor, and a flat year. The reject rate is 15%, against 48%, 42%, 38%, 40%, 37%, 41%,
21%, 17% and 19% for the years already censused. meta takes 13 rows and 17%, also the lowest
share recorded. 65 of the 78 posts are about how the software behaves. The release clustering
2021 introduced keeps loosening: the three busiest months carry 41% here, against 2021's 62% and
2022's 55%, and no month carries more than twelve posts. This is the most evenly spread year in
the archive, and also the largest one the census has reached since 2016.
A second feature-gate registry. Nine years of census have treated the 488-file feature-gates
directory as the instrument that says what a gate did. This year breaks it.
kubeadm: Use etcd Learner to Join a Control Plane Node Safely
announces EtcdLearnerMode, and that gate has no file among the 488, no row in the removed-gates
page, and no entry in either of the two feature-gate tables. It lives in a markdown table inside
kubeadm-init.md, which records it as alpha 1.27, beta 1.29, GA 1.32 and removed 1.33. That
table is the whole of kubeadm's gate namespace: one live gate, RootlessControlPlane, alpha
since 1.22 and deprecated in 1.31, plus eight removed ones. Nine gates in a command reference
page, against 488 in a directory — and a full ladder that the census's main instrument cannot
see at all.
"Beta" in a title is not a promise the gate was on. 34 of the 487 gate files with stage
tables repeat a stage, and the repeat almost always marks a change of defaultValue rather than
a change of stage. Two of this year's posts announce the first, off-by-default half of such a
split: NodeSwap is beta and defaultValue: false for 1.28 and 1.29, then beta and
defaultValue: true from 1.30, and SELinuxMountReadWriteOncePod is beta and off for 1.27
alone, then beta and on from 1.28. Read only the stage column and both look like ordinary
promotions. The census has no way to say "beta, but you still have to ask for it".
And there is a fourth rung. VolumeAttributesClass, this year's alpha in
Kubernetes 1.29: VolumeAttributesClass for Volume Modification,
reaches stable at 1.34 and then takes a second stable stage at 1.36 carrying locked: true.
49 gates at the pin carry that field. Locked is not alpha, beta or stable; it is the point after
which the switch cannot be set the other way, and the taxonomy's three stages cannot name it.
One of the instrument's own files contradicts itself. ContextualLogging — the gate behind
Contextual logging in Kubernetes 1.29
— has an alpha stage from 1.24 with no toVersion followed by a beta stage from 1.30. Under the
reading rule the census has used since 2016, a last stage with no toVersion means "still current
at the pin", so the file asserts both that the gate is alpha-from-1.24-onward and that it is
beta-from-1.30-onward. Four of the 487 files have a non-terminal stage that never closes; this is
one of them, and it is the only one a censused post depends on. Fourteen releases in flight and
still not stable.
The tree cites the blog back. Every year so far, the blog has been the only surviving record
of something the documentation forgot. This year runs the other way once.
Free Katacoda Kubernetes Tutorials Are Shutting Down
left six *-interactive-gone.html files under docs/tutorials/kubernetes-basics/ — one per
interactive tutorial — and each of the six links this post as the reason the button is gone.
Permanent tombstones in the docs tree whose authority is a blog post.
Two repository migrations complete, and neither is reversible. apt.kubernetes.io and
yum.kubernetes.io have zero occurrences in the docs tree at the pin; pkgs.k8s.io has 31
across five files. k8s.gcr.io, which 2022 spent an exercise on, is likewise at zero. Three
posts here carry the package half of that arc, and two of them —
pkgs.k8s.io and
Kubernetes Legacy Package Repositories Will Be Frozen
— carry the same dated self-annotation, an ℹ️ Update (March 26, 2024) added months after
publication.
etcd stops being an empty topic. Nine censused years had produced three etcd rows and no
exercise at all — the longest hole in the vocabulary. 2023 adds two rows and the first etcd
exercise, and the two arrive together: SIG etcd is founded in November, and the kubeadm learner
post in September is what the exercise walks. obs gets its first exercises since 2020, taking
two. net takes six rows and no exercise, because 2021's Gateway API walk already covers the
group-version every one of this year's Gateway posts depends on.
Topics. meta 13, storage 11, security 11, nodes 10, tooling 9, api 8, net 6,
sched 3, etcd 2, history 2, obs 2, ecosystem 1. Walks: nodes 4, api 2, obs 2,
storage 2, etcd 1, security 1, tooling 1.
Census¶
Verdicts and topics are defined in ../README.md. Every post has a
row, and a row's title always links the post — never the exercise file, so the row never
changes once written. The Exercises table below is the progress record.
| post | date | k8s | verdict | topic | why |
|---|---|---|---|---|---|
| Kubernetes v1.26: Alpha support for cross-namespace storage data sources | 01-02 | 1.26 | read |
storage |
CrossNamespaceVolumeDataSource arrives alpha in v1.26 and is still alpha at the pin, twelve releases later, with no toVersion on its only stage and no beta in sight. The mechanism it borrows is the interesting part: a PVC in one namespace names a source in another, and the owning namespace consents with a ReferenceGrant — a Gateway API type reused by core storage. Seven of its occurrences at the pin sit in volume-populators-and-data-sources.md. |
| Kubernetes v1.26: Retroactive Default StorageClass | 01-05 | 1.26 | walk |
storage |
RetroactiveDefaultStorageClass runs alpha v1.25, beta v1.26, stable v1.28 — and its stable stage carries toVersion: "1.28", so the gate the post tells you to enable is not recognised at the pin. Three releases from introduction to removal, and the behaviour it guarded is now unconditional: a PVC created while no default StorageClass exists gets one assigned the moment a default appears. Bind a class-less PVC against a cluster with no default, then mark one default, and watch a PVC that the post's own era would have left pending forever. |
| Kubernetes 1.26: Eviction policy for unhealthy pods guarded by PodDisruptionBudgets | 01-06 | 1.26 | read |
api |
PDBUnhealthyPodEvictionPolicy reaches stable in v1.31 and its stable stage ends at v1.32, so spec.unhealthyPodEvictionPolicy: AlwaysAllow is now plain PodDisruptionBudget API with no gate behind it. The post's alpha instructions are the only part that has expired. |
| Protect Your Mission-Critical Pods From Eviction With PriorityClass | 01-12 | — | read |
sched |
A general explainer on PriorityClass, preemption and eviction rather than a walkthrough, and the object it explains has not moved: priorityClassName, globalDefault and preemptionPolicy all read the same at the pin. |
| Consider All Microservices Vulnerable — And Monitor Their Behavior | 01-20 | — | read |
security |
An argued case for runtime behaviour monitoring — the decision is "assume every microservice is compromised", and the alternative it rejects is perimeter-only scanning. Nothing it recommends lives in the Kubernetes tree, so it stays a read under the ecosystem rule. |
| Spotlight on SIG Instrumentation | 02-03 | — | skip |
meta |
SIG spotlight. |
| k8s.gcr.io Image Registry Will Be Frozen From the 3rd of April 2023 | 02-06 | — | read |
tooling |
The freeze notice for k8s.gcr.io, six weeks ahead of the date. At the pin k8s.gcr.io has zero occurrences anywhere in the docs tree. 2022's exercise 11 already walks the registry cutover. |
| Free Katacoda Kubernetes Tutorials Are Shutting Down | 02-14 | — | read |
history |
The rarest shape in the archive: a post the documentation tree cites back. Katacoda's shutdown left six *-interactive-gone.html tombstones under docs/tutorials/kubernetes-basics/, one per interactive tutorial, and each one links this post as the explanation for why the button is gone. Everywhere else the census has looked, the blog is the only surviving record and the tree has forgotten; here the tree keeps a permanent marker pointing at the blog. |
| Introducing KWOK: Kubernetes WithOut Kubelet | 03-01 | — | read |
tooling |
KWOK simulates thousands of nodes with no kubelet and no container runtime, which is a genuine decision with a rejected alternative (kubemark) behind it. It is a kubernetes-sigs project rather than in-tree, and at the pin the string kwok appears once in the whole docs tree. |
| Forensic container analysis | 03-10 | — | dated |
security |
A walkthrough, and both dated tests hold. It analyses the archive that 2022's forensic checkpointing post produces, using checkpointctl and CRIU's crit, so it inherits that post's node requirement: a CRI implementation built with checkpoint support running on a kernel that permits it, which is not what the lab's nodes provide. The second half of a two-post arc whose first half the census already marked dated in 2022. |
| k8s.gcr.io Redirect to registry.k8s.io - What You Need to Know | 03-10 | — | read |
tooling |
The redirect notice for k8s.gcr.io to registry.k8s.io, published the same day as the forensic analysis post. Covered by 2022's exercise 11. |
| Kubernetes Removals and Major Changes In v1.27 | 03-17 | 1.27 | read |
api |
The v1.27 removal notice. Its headline item is the removal of the --master-service-namespace, --enable-taint-manager and in-tree storage flags, and the deprecation guide at the pin carries a v1.27 section for the API side of it. |
| Kubernetes Validating Admission Policies: A Practical Example | 03-30 | 1.26 | walk |
security |
The post's manifests are admissionregistration.k8s.io/v1alpha1, which has two occurrences in the whole docs tree at the pin against 124 for admissionregistration.k8s.io/v1. ValidatingAdmissionPolicy runs alpha v1.26, beta v1.28, stable v1.30, and its stable stage ends at v1.31 — the gate is gone and CEL-based admission is unconditional. Rewrite the post's policy at the served version, apply it, and watch a Deployment get refused without a webhook server anywhere in the cluster. |
| Keeping Kubernetes Secure with Updated Go Versions | 04-06 | — | read |
security |
The release engineering practice of rebuilding patch releases against updated Go toolchains. A process post; nothing in it is a cluster-visible surface. |
| Kubernetes v1.27: Chill Vibes | 04-11 | 1.27 | skip |
meta |
Release announcement. |
| Kubernetes 1.27: More fine-grained pod topology spread policies reached beta | 04-17 | 1.27 | read |
sched |
MatchLabelKeysInPodTopologySpread reaches beta in v1.27 and has no toVersion on that stage: still beta at the pin, eleven releases on. The field itself, matchLabelKeys under topologySpreadConstraints, reads exactly as the post prints it. |
| Kubernetes 1.27: Efficient SELinux volume relabeling (Beta) | 04-18 | 1.27 | read |
storage |
SELinuxMountReadWriteOncePod is one of the 34 gates whose ladder repeats a stage: beta and off by default for v1.27 alone, then beta and on by default from v1.28. This post announces the off-by-default half. Exercise 08 walks that shape on a gate where the split is larger. |
| Kubernetes 1.27: Single Pod Access Mode for PersistentVolumes Graduates to Beta | 04-20 | 1.27 | read |
storage |
ReadWriteOncePod beta. Its stable stage ends at v1.30, so the gate is gone and the access mode is plain PersistentVolume API. 2021 already spends an exercise on this access mode; post [75] closes the same arc at GA later in this year. |
| Kubernetes 1.27: Query Node Logs Using The Kubelet API | 04-21 | 1.27 | walk |
obs |
NodeLogQuery runs alpha v1.27, beta v1.30, stable v1.36 — so what the post presents as an alpha you must opt into is, at the pin, on by default and reachable with nothing but kubectl. kubectl get --raw "/api/v1/nodes/<node>/proxy/logs/?query=kubelet" reads a node's service logs through the API server, and &pattern=error filters them server-side. The first obs exercise since 2020. |
| Kubernetes 1.27: Server Side Field Validation and OpenAPI V3 move to GA | 04-24 | 1.27 | walk |
api |
Two gates retire together here. ServerSideFieldValidation (alpha v1.23, stable v1.27) ends at v1.31 and OpenAPIV3 (alpha v1.23, stable v1.27) ends at v1.28; neither is recognised at the pin. What survives is the behaviour: kubectl apply defaults to --validate=strict, so a misspelled field is refused by the API server rather than by the client, and --validate=false is documented as an alias for ignore rather than as switching validation off. Apply a manifest with a typo'd key and locate which side of the wire rejected it. |
| Updates to the Auto-refreshing Official CVE Feed | 04-25 | — | read |
security |
Maintenance news for the auto-refreshing CVE feed. The feed is a project service, not a cluster surface. |
| Kubernetes 1.27: StatefulSet Start Ordinal Simplifies Migration | 04-28 | 1.27 | walk |
api |
StatefulSetStartOrdinal runs alpha v1.26, beta v1.27, stable v1.31, and the gate is still listed rather than removed. .spec.ordinals.start is documented at the pin exactly as the post introduces it: replicas run from start through start + replicas - 1. Split one StatefulSet across two clusters by giving the second a non-zero start ordinal, and check that the two halves never claim the same PVC name. |
| Kubernetes 1.27: HorizontalPodAutoscaler ContainerResource type metric moves to beta | 05-02 | 1.27 | read |
api |
HPAContainerMetrics reaches beta here after seven releases in alpha; stable v1.30, and the stable stage ends at v1.31. The ContainerResource metric type is now unconditional HorizontalPodAutoscaler API. |
| Kubernetes 1.27: StatefulSet PVC Auto-Deletion (beta) | 05-04 | 1.27 | read |
storage |
StatefulSet PVC auto-deletion at beta, continuing the 2021 alpha post the census already spends an exercise on. |
| Kubernetes 1.27: Quality-of-Service for Memory Resources (alpha) | 05-05 | 1.27 | read |
nodes |
The most stubborn gate this year touches. MemoryQoS entered alpha in v1.22 and its alpha stage runs to v1.36 — fifteen consecutive releases — reaching beta only in v1.37, the pin's own release. 2021's exercise on memory QoS was written against the same alpha; this post re-announces it two years later without a stage change, which is why the row is a read. |
| Kubernetes 1.27: Introducing An API For Volume Group Snapshots | 05-08 | 1.27 | read |
storage |
The VolumeGroupSnapshot API is an alpha CRD in external-snapshotter rather than a Kubernetes API group, and VolumeGroupSnapshot has zero occurrences in the docs tree at the pin. A 2023 alpha that left no mark on the tree at all. |
| Kubernetes 1.27: Safer, More Performant Pruning in kubectl apply | 05-09 | 1.27 | walk |
tooling |
Three years and ten releases later this is still alpha, and it has no feature gate — the switch is an environment variable. declarative-config.md at the pin still opens the section with "kubectl apply --prune --applyset is in alpha, and backwards incompatible changes might be introduced", and still gives the invocation as KUBECTL_APPLYSET=true kubectl apply -f <directory> --prune --applyset=<name>. KUBECTL_APPLYSET occurs twice in the entire docs tree. Prune a directory twice, once with the old label-selector --prune and once with an ApplySet, and record what each one deletes that the other leaves. |
| Kubernetes 1.27: Avoid Collisions Assigning Ports to NodePort Services | 05-11 | 1.27 | read |
net |
ServiceNodePortStaticSubrange reaches stable in v1.29 and its stable stage ends at v1.30, so the reserved low band is now unconditional. The same split-a-range shape as 2022's Service IP exercise, one layer up. |
| Kubernetes 1.27: In-place Resource Resize for Kubernetes Pods (alpha) | 05-12 | 1.27 | walk |
nodes |
InPlacePodVerticalScaling spends six releases in alpha (v1.27 to v1.32), reaches beta in v1.33 and stable in v1.35. At the pin the mechanism the post can only describe is a real subresource: kubectl patch pod <name> --subresource resize --patch ... changes a running container's CPU and memory without recreating the Pod, and resize-container-resources.md notes the client must be at least v1.32 to use the flag. Resize a Pod in place, then confirm from kubectl get pod -o yaml that restartCount never moved. |
| Kubernetes 1.27: updates on speeding up Pod startup | 05-15 | 1.27 | read |
nodes |
A survey of several startup-latency changes at once rather than a walkthrough. Its most durable item is EventedPLEG, which entered alpha in v1.26 and at the pin has one stage, no toVersion and no beta — twelve releases of alpha — with the extra catch that the kubelet silently falls back to the legacy generic PLEG if the runtime does not announce CRI event support. |
| Kubernetes 1.27: KMS V2 Moves to Beta | 05-16 | 1.27 | read |
security |
KMS v2 at beta. The post carries its own incompatibility warning — "The KMS v2 API and implementation changed in incompatible ways in-between the alpha release in v1.25 and the beta release in v1.27" — and at the pin the KMSv2 gate has reached stable and its stable stage ends at v1.31, while KMSv1 is the only gate in the tree whose ladder is two deprecated stages and nothing else. |
| Having fun with seccomp profiles on the edge | 05-18 | — | read |
security |
The "edge" in the title is edge cases, not edge hardware: spoc record is a standalone binary that records a seccomp profile without a cluster. The Security Profiles Operator is out of tree, so this is a read under the ecosystem rule rather than a walk. |
| Using OCI artifacts to distribute security profiles for seccomp, SELinux and AppArmor | 05-24 | — | read |
security |
Distributing seccomp, SELinux and AppArmor profiles as OCI artifacts. Out-of-tree tooling with an argued decision behind it — profiles as registry content rather than as ConfigMaps. |
| dl.k8s.io to adopt a Content Delivery Network | 06-09 | — | read |
tooling |
Infrastructure news for dl.k8s.io. The decision and its rejected alternative are both stated: a CDN in front of the bucket rather than more regional mirrors. |
| Verifying Container Image Signatures Within CRI Runtimes | 06-29 | — | read |
security |
Image signature verification inside CRI-O and containerd rather than at an admission webhook. A decision post about where verification belongs; the implementation is runtime configuration, not Kubernetes API. |
| Confidential Kubernetes: Use Confidential Virtual Machines and Enclaves to improve your cluster security | 07-06 | — | read |
security |
Confidential VMs and enclaves. It fails the first dated test rather than the second: it is a survey of an approach, not a walkthrough, so the hardware it would need never becomes the deciding factor. |
| Spotlight on SIG CLI | 07-20 | — | skip |
meta |
SIG spotlight. |
| Spotlight on SIG ContribEx | 08-14 | — | skip |
meta |
SIG spotlight. |
| Kubernetes v1.28: Planternetes | 08-15 | 1.28 | skip |
meta |
Release announcement. |
| pkgs.k8s.io: Introducing Kubernetes Community-Owned Package Repositories | 08-15 | 1.28 | read |
tooling |
The community package repositories. At the pin apt.kubernetes.io and yum.kubernetes.io have zero occurrences in the docs tree and pkgs.k8s.io has 31 across five files, so the migration is complete and irreversible. The post carries its own dated self-annotation, an ℹ️ Update (March 26, 2024). Same shape as 2022's registry exercise, one artifact type over. |
| Kubernetes 1.28: Non-Graceful Node Shutdown Moves to GA | 08-16 | 1.28 | read |
nodes |
Non-graceful node shutdown at GA. NodeOutOfServiceVolumeDetach reaches stable in v1.28 and its stable stage ends at v1.31. 2022 already spends an exercise on the alpha of the out-of-service taint. |
| Kubernetes v1.28: Retroactive Default StorageClass move to GA | 08-18 | 1.28 | read |
storage |
The GA half of the arc exercise 01 walks; the gate is removed after this release. |
| Kubernetes 1.28: Improved failure handling for Jobs | 08-21 | 1.28 | read |
api |
JobBackoffLimitPerIndex (alpha v1.28, stable v1.33) and JobPodReplacementPolicy (alpha v1.28, stable and locked v1.34) both landed and both are on at the pin, so the post's manifests apply unchanged. A rare case where nothing has expired. |
| Kubernetes 1.28: Node podresources API Graduates to GA | 08-23 | 1.28 | read |
nodes |
The podresources API at GA. podresources has 40 occurrences across 15 docs files at the pin; the surface is a kubelet-local gRPC endpoint rather than anything kubectl reaches. |
| Kubernetes 1.28: Beta support for using swap on Linux | 08-24 | 1.28 | walk |
nodes |
Beta support in the title does not mean the gate was on. NodeSwap is one of 34 gates at the pin whose ladder repeats a stage, and the repeat is the whole story: beta and defaultValue: false for v1.28 and v1.29, then beta and defaultValue: true from v1.30, then stable and locked: true in v1.34. So the post announces a beta you still had to opt into, for two releases. The gate file also still sends you to /docs/concepts/architecture/nodes/#swap-memory, and nodes.md at the pin contains the word swap zero times — the page moved to swap-memory-management.md. Enable swap on a node, set failSwapOn: false, and read memorySwap behaviour off a Burstable Pod. |
| Kubernetes v1.28: Introducing native sidecar containers | 08-25 | 1.28 | walk |
nodes |
The largest workload-API change of the year, introduced as an alpha gate and now stable and locked. SidecarContainers runs alpha v1.28, beta v1.29, stable v1.33, and the shape is that a sidecar is not a new field but an initContainer carrying restartPolicy: Always — so it starts before the app containers, keeps running alongside them, and does not block Job completion. Run the same helper both ways in one Pod, as an ordinary container and as a restartable init container, and compare termination order and Job status. |
| Kubernetes 1.28: A New (alpha) Mechanism For Safer Cluster Upgrades | 08-28 | 1.28 | read |
api |
UnknownVersionInteroperabilityProxy spends eight releases in alpha (v1.28 to v1.35) before reaching beta in v1.36. Demonstrating it needs two API servers at different versions serving one cluster, which is a description of a skewed control plane rather than something a single-node lab reproduces, and the post itself is an announcement rather than a walkthrough. |
| Gateway API v0.8.0: Introducing Service Mesh Support | 08-29 | — | read |
net |
Gateway API v0.8.0 folds service mesh into the same API. Out-of-tree CRDs; 2021's Gateway API exercise already covers installing them at the pin's version and diffing kinds. |
| Kubernetes Legacy Package Repositories Will Be Frozen On September 13, 2023 | 08-31 | — | read |
tooling |
The freeze notice for the legacy package repositories, carrying the same ℹ️ Update (March 26, 2024) self-annotation as post [40]. |
| Comparing Local Kubernetes Development Tools: Telepresence, Gefyra, and mirrord | 09-12 | — | read |
ecosystem |
A three-way comparison of Telepresence, Gefyra and mirrord. It is a decision post with the alternatives stated, which is exactly the case the ecosystem rule admits as a read. At the pin Telepresence has 19 occurrences in the docs tree while Gefyra and mirrord have none. |
| User Namespaces: Now Supports Running Stateful Pods in Alpha! | 09-13 | 1.28 | read |
security |
User namespaces for stateful Pods. UserNamespacesStatelessPodsSupport is a retired gate — alpha v1.25 to v1.27 and nothing after — because the feature was renamed to UserNamespacesSupport. That rename is precisely what 2022's exercise 10 walks. |
| kubeadm: Use etcd Learner to Join a Control Plane Node Safely | 09-25 | 1.28 | walk |
etcd |
The census's first etcd exercise, and it finds a second feature-gate registry. EtcdLearnerMode has no file among the 488 in the feature-gates directory and no row in the removed-gates page; it lives in a markdown table inside kubeadm-init.md, which records it as alpha v1.27, beta v1.29, GA v1.32, removed v1.33. That table is kubeadm's entire gate namespace: one live gate, RootlessControlPlane, and eight removed. Join a second control-plane node at the pin and confirm the learner promotion the post describes happens with no gate to set, then go looking for the gate in the place gates live and fail to find it. |
| Happy 7th Birthday kubeadm! | 09-26 | — | read |
history |
kubeadm's seventh birthday, written the year it turned from a bootstrapping experiment into the assumed default. A retrospective rather than a process post. |
| Announcing the 2023 Steering Committee Election Results | 10-02 | — | skip |
meta |
Election results. |
| Spotlight on SIG Architecture: Conformance | 10-05 | — | skip |
meta |
SIG spotlight. |
| CRI-O is moving towards pkgs.k8s.io | 10-10 | — | read |
tooling |
CRI-O follows Kubernetes onto pkgs.k8s.io. The runtime half of the repository migration post [40] announces. |
| Bootstrap an Air Gapped Cluster With Kubeadm | 10-12 | — | dated |
tooling |
A full walkthrough and squarely beyond the lab ceiling: it needs a genuinely disconnected network, a private registry seeded by hand, and an OS package mirror on the far side of the gap. The air gap is the exercise, and it cannot be simulated away without removing the thing being taught. |
| A Quick Recap of 2023 China Kubernetes Contributor Summit | 10-20 | — | skip |
meta |
Contributor summit recap. |
| PersistentVolume Last Phase Transition Time in Kubernetes | 10-23 | 1.28 | read |
storage |
PersistentVolumeLastPhaseTransitionTime runs alpha v1.28, beta v1.29, stable v1.31, and its stable stage ends at v1.32 — so status.lastPhaseTransitionTime is now an unconditional PersistentVolume field. |
| Plants, process and parties: the Kubernetes 1.28 release interview | 10-24 | 1.28 | read |
meta |
Release interview. |
| Introducing ingress2gateway; Simplifying Upgrades to Gateway API | 10-25 | — | read |
net |
The migration tool from Ingress to Gateway API. The post opens with a self-annotation pointing three years forward — "Update: Ingress2Gateway v1.0 is now available!" — the only forward reference in this year that lands in 2026. ingress2gateway has two occurrences in the docs tree at the pin. |
| Gateway API v1.0: GA Release | 10-31 | — | read |
net |
Gateway API reaches v1.0 and gateway.networking.k8s.io/v1 becomes the served version, which is the group-version 2021's Gateway API exercise already tells you to diff the post's kinds against. This row records the release that made that version real. |
| Spotlight on SIG Architecture: Production Readiness | 11-02 | — | skip |
meta |
SIG spotlight. |
| Kubernetes Contributor Summit: Behind-the-scenes | 11-03 | — | skip |
meta |
Contributor summit process. |
| Introducing SIG etcd | 11-07 | — | read |
etcd |
etcd gets its own SIG, jointly owned with the etcd project. Only the third etcd row the census has recorded in nine years, and it arrives in the same year as the first etcd exercise. |
| Kubernetes Removals, Deprecations, and Major Changes in Kubernetes 1.29 | 11-16 | 1.29 | read |
api |
The v1.29 removal notice. Its largest item is the in-tree cloud provider change that post [71] documents in full. |
| The Case for Kubernetes Resource Limits: Predictability vs. Efficiency | 11-16 | — | read |
nodes |
An argued case for setting resource limits, written against three named posts arguing the opposite and linking them. The clearest instance in the archive of the ecosystem rule's admitting case: a decision stated together with the alternatives it rejects. |
| Spotlight on SIG Testing | 11-24 | — | skip |
meta |
SIG spotlight. |
| New Experimental Features in Gateway API v1.0 | 11-28 | — | read |
net |
The experimental features shipped alongside Gateway API v1.0 — BackendTLSPolicy, BackendLBPolicy and the rest. Out-of-tree CRDs at an experimental channel. |
| Kubernetes v1.29: Mandala | 12-13 | 1.29 | skip |
meta |
Release announcement. |
| Kubernetes 1.29: Cloud Provider Integrations Are Now Separate Components | 12-14 | 1.29 | walk |
nodes |
The post's headline is that v1.29 components abort if you name an in-tree cloud provider. At the pin there is nothing left to abort: DisableCloudProviders and DisableKubeletCloudCredentialProviders both reach stable in v1.31 and both stable stages end at v1.32, the in-tree code is gone, and the kubelet's --cloud-provider help text offers only the empty string or external. The tree has not caught up — controller-manager-leader-migration.md is still a live task page whose first step is "an in-tree cloud provider must be set with --cloud-provider flag", a migration guide whose starting state no longer exists. Follow that page at the pin and find where it stops being possible. |
| Kubernetes 1.29: CSI Storage Resizing Authenticated and Generally Available in v1.29 | 12-15 | 1.29 | read |
storage |
Authenticated CSI resize at GA, the credential half of the volume expansion arc 2022's exercise 01 walks. |
| Kubernetes 1.29: VolumeAttributesClass for Volume Modification | 12-15 | 1.29 | walk |
storage |
A ladder with a rung the census's four stages could not name. VolumeAttributesClass runs alpha v1.29, beta v1.31, stable v1.34 — and then a second stable stage from v1.36 carrying locked: true, which is how 49 gates at the pin record that the switch can no longer be turned off. The API moved too: the post's storage.k8s.io/v1alpha1 is not served, and volume-attributes-classes.md uses storage.k8s.io/v1. Change a bound volume's attributes by editing volumeAttributesClassName on the PVC and watch the change go through the CSI driver rather than a provider API. |
| Kubernetes 1.29: New (alpha) Feature, Load Balancer IP Mode for Services | 12-18 | 1.29 | read |
net |
LoadBalancerIPMode is the one gate this year whose stage table overlaps itself: alpha runs v1.29 to v1.30 and beta runs v1.30 to v1.31, so v1.30 is recorded as both. Stable v1.32, ending at v1.34 — the gate is gone and status.loadBalancer.ingress[].ipMode is unconditional Service API. |
| Kubernetes 1.29: Single Pod Access Mode for PersistentVolumes Graduates to Stable | 12-18 | 1.29 | read |
storage |
ReadWriteOncePod at GA, closing the arc post [18] opens earlier this year and 2021 already walks. |
| Kubernetes 1.29: PodReadyToStartContainers Condition Moves to Beta | 12-19 | 1.29 | read |
nodes |
PodReadyToStartContainers at beta. The condition was renamed on the way here, and the gate file that records the rename — the only one of 488 carrying former_titles: — is what 2022's exercise 08 walks. |
| Kubernetes 1.29: Decoupling taint manager from node lifecycle controller | 12-19 | 1.29 | read |
sched |
Taint-based eviction moves out of node-lifecycle-controller into its own taint-eviction-controller. A refactor whose observable surface is a set of renamed metrics rather than any API change. |
| Contextual logging in Kubernetes 1.29: Better troubleshooting and enhanced logging | 12-20 | 1.29 | walk |
obs |
The gate file itself is malformed, and that is the exercise. ContextualLogging has an alpha stage from v1.24 with no toVersion followed by a beta stage from v1.30 — one of only four gates in 487 whose non-terminal stage never closes, so the file simultaneously asserts the gate is alpha-from-v1.24-forever and beta-from-v1.30. Fourteen releases in flight and still not stable. Run kube-scheduler with the gate on and off at the same -v level and diff what the log lines carry; then read the gate file and decide what stage the tree actually claims. |
Exercises¶
Thirteen walk verdicts, numbered in publication order, and all thirteen are written. The rubric
they are authored against was ratified in
#57.