$ the-wire · showcase
FEATURE GATES DROPPED, VALIDATION COVERAGE EXPANDS ACROSS K8S CORE
By RepoJournal · Filed · About Kubernetes · Composed from the cited sources · methodology
Kubernetes core stripped two legacy authorization feature gates [ref:3] while validation-gen tooling tightened test coverage for zero-value and optional field handling [ref:2].
The auth subsystem is shedding cruft: `AuthorizeNodeWithSelectors` and `AuthorizeWithSelectors` feature gates are gone [1], clearing the path for stricter RBAC validation without toggle overhead. Meanwhile, validation-gen now has comprehensive tests [2] ensuring minimum constraints don't break optional and required field interactions—critical for API evolution without validator surprises. Circuit breaker behavior documentation landed in KEP-5647 [3], solidifying how kube-apiserver handles overload scenarios. In supporting infrastructure, kubelet tests cleaned up unused mocks , and storage encryption (KEP-5538) moved to implemented status [4]. Resource string validation got stricter with new eachVal + maxBytes rules for validation-gen [5], tightening what makes it through the API gate.
Action items
- → Verify your RBAC policies don't rely on the dropped authorize feature gates before upgrading kubernetes/kubernetes [plan]
- → Review validation-gen minimum constraint tests if you maintain custom API validation kubernetes/code-generator [monitor]
- → Update KEP-5538 references in your security checklist—storage encryption is now implemented kubernetes/enhancements [monitor]
References
- [1] Drop AuthorizeNodeWithSelectors and AuthorizeWithSelectors feature gates
- [2] Add tests for minimum with required and optional validation tags
- [3] KEP-5647: Add section on circuit breaking behavior
- [4] docs(kep): update KEP-5538 status to implemented
- [5] feat(validation-gen): add eachVal + maxBytes validation for resource string values
