The Wire · Showcase
FEATURE GATES DROPPED, VALIDATION COVERAGE EXPANDS ACROSS K8S CORE
By RepoJournal · Filed · About Kubernetes
Kubernetes core stripped two legacy authorization feature gates [ref:3] while validation-gen tooling tightened test coverage for zero-value and optional field handling [ref:2].
The auth subsystem is shedding cruft: `AuthorizeNodeWithSelectors` and `AuthorizeWithSelectors` feature gates are gone [1], clearing the path for stricter RBAC validation without toggle overhead. Meanwhile, validation-gen now has comprehensive tests [2] ensuring minimum constraints don't break optional and required field interactions—critical for API evolution without validator surprises. Circuit breaker behavior documentation landed in KEP-5647 [3], solidifying how kube-apiserver handles overload scenarios. In supporting infrastructure, kubelet tests cleaned up unused mocks , and storage encryption (KEP-5538) moved to implemented status [4]. Resource string validation got stricter with new eachVal + maxBytes rules for validation-gen [5], tightening what makes it through the API gate.
Action items
- → Verify your RBAC policies don't rely on the dropped authorize feature gates before upgrading kubernetes/kubernetes [plan]
- → Review validation-gen minimum constraint tests if you maintain custom API validation kubernetes/code-generator [monitor]
- → Update KEP-5538 references in your security checklist—storage encryption is now implemented kubernetes/enhancements [monitor]
References
- [1] Drop AuthorizeNodeWithSelectors and AuthorizeWithSelectors feature gates
- [2] Add tests for minimum with required and optional validation tags
- [3] KEP-5647: Add section on circuit breaking behavior
- [4] docs(kep): update KEP-5538 status to implemented
- [5] feat(validation-gen): add eachVal + maxBytes validation for resource string values
FAQ
- What changed in Kubernetes on May 1, 2026?
- Kubernetes core stripped two legacy authorization feature gates while validation-gen tooling tightened test coverage for zero-value and optional field handling .
- What should Kubernetes teams do about it?
- Verify your RBAC policies don't rely on the dropped authorize feature gates before upgrading • Review validation-gen minimum constraint tests if you maintain custom API validation • Update KEP-5538 references in your security checklist—storage encryption is now implemented