$ the-wire · showcase
Declarative validation graduates to stable in discovery API
By RepoJournal · Filed · About Kubernetes
Kubernetes' discovery API graduates declarative validation to stable, replacing hand-written validation, and kOps adds experimental support for Amazon Linux 2027.
Kubernetes graduated the discovery API's declarative validation rules from beta to stable, per KEP-5073, and removed the handwritten validation they replace [1]. The rules have been at beta since 1.37, and this wave of twelve markers across discovery/v1 became eligible once 1.37 shipped [1]. Also, kops removed the old `NFTablesProxyMode` and `PreferSameTrafficDistribution` feature gates, both of which had gone GA earlier and were overdue for removal [2]. Additionally, admissionregistration now marks `ParamRef.parameterNotFoundAction` as required in the OpenAPI schema [3], and the `validate.UpdateValue` addition marks the last direct call to semantic DeepEqual [4]. In test-infra, a new optional presubmit for Amazon Linux 2027 e2e tests was added, gated behind `/test pull-kops-e2e-k8s-aws-al2027` [8].
kOps added experimental support for Amazon Linux 2027, which entered public preview on 2026-09-03. Detection matches on `ID=amzn` and `VERSION_ID=2027`, ignoring `VARIANT_ID=preview`, so it will keep working when images go GA [5]. The change also includes a refactor adding `Distribution.IsAmazonLinux()` because Amazon Linux is the only distro family with a version-specific project name [6]. The test-infra presubmit was
added because AL2027 is a "large jump from AL2023" with a Fedora 44/45 base, kernel 7.1, systemd 260, glibc 2.44, DNF 5, cgroup v2 only, and SELinux enforcing by default [7]. It is optional and runs only when requested with `/test pull-kops-e2e-k8s-aws-al2027` [8].
In the DigitalOcean CCM update, kOps sets `providerID` on nodes and updates CCM to v0.1.69 [9]. Previously, the CCM was pinned to v0.1.45 because newer versions resolve nodes by `spec.providerID`, and the name-based fallback in v0.1.62 filters server-side, failing to match the private-IP names [9]. Also, a new optional presubmit for lws runs the Helm-based upgrade E2E test, covering the path where Helm never touches the `crds/` directory, so CRDs must be reconciled manually [10].
Action items
References
- [1] discovery: graduate declarative validation to stable ↗ kubernetes/kubernetes
- [2] clean up PreferSameTrafficDistribution traffic gate ↗ kubernetes/kubernetes
- [3] Merge pull request #141527 from grosser/grosser/paramreq ↗ kubernetes/api
- [4] Add validate.UpdateValue, deprecate the By* forms ↗ kubernetes/kubernetes
- [5] Add experimental support for Amazon Linux 2027 ↗ kubernetes/kops
- [6] refactor: add Distribution.IsAmazonLinux() ↗ kubernetes/kops
- [7] [kops] Add an optional presubmit for Amazon Linux 2027 ↗ kubernetes/test-infra
- [8] [kops] Add an optional presubmit for Amazon Linux 2027 ↗ kubernetes/test-infra
- [9] do: set providerID on nodes and update CCM to v0.1.69 ↗ kubernetes/kops
- [10] Add lws Helm-based upgrade E2E presubmit ↗ kubernetes/test-infra