Feature gates: 20+ overdue removals, 30+ stalled in alpha/beta

[Davanum Srinivas]

Hi all,

I checked every feature gate on master (1.38 dev) against contributors/devel/sig-architecture/feature-gates.md, as the source.

Four things I looked for:

• OVERDUE — locked in release X, still here after X+3. This breaks the rule.
• DUE 1.38 — hits X+3 this cycle. Remove it now and the backlog stops growing.
• NEVER LOCKED — GA or deprecated, but LockToDefault is still false.
• STALE — no stage change in 6 or more releases. Breaks no rule, but nobody has made a call on it.

---

SIG Node (29)

• OVERDUE: TopologyManagerPolicyOptions (locked 1.32), CPUManagerPolicyOptions (1.33), RecursiveReadOnlyMounts (1.33), KubeletCgroupDriverFromCRI (1.34), NodeSwap (1.34), RelaxedEnvironmentVariableValidation (1.34)
• DUE 1.38: AllowOverwriteTerminationGracePeriodSeconds, DynamicResourceAllocation (k/k#134459), ExecProbeTimeout, ImageMaximumGCAge, InPlacePodVerticalScaling (k/k#133537), PodObservedGenerationTracking, SupplementalGroupsPolicy, SystemdWatchdog
• NEVER LOCKED: CustomCPUCFSQuotaPeriod (GA 1.36), KubeletPodResourcesListUseActivePods (deprecated 1.34), KubeletRegistrationGetOnExistsOnly (deprecated 1.32)
• STALE ALPHA: QOSReserved (1.11), EventedPLEG (1.26), RuntimeClassInImageCriApi (1.29), InPlacePodVerticalScalingExclusiveCPUs (1.32), PodLogsQuerySplitStreams (1.32)
• STALE BETA: RotateKubeletServerCertificate (1.12), GracefulNodeShutdown (1.21), GracefulNodeShutdownBasedOnPodPriority (1.24), ContainerCheckpoint (1.30), KubeletSeparateDiskGC (1.31), LocalStorageCapacityIsolationFSQuotaMonitoring (1.31, off by default), ReloadKubeletServerCertificateFile (1.31)

SIG API Machinery (17)

• OVERDUE: CustomResourceFieldSelectors (locked 1.32), CRDValidationRatcheting (1.33)
• DUE 1.38: AggregatedDiscoveryRemoveBetaType
• NEVER LOCKED: MutatingAdmissionPolicy (GA 1.36), StorageNamespaceIndex (deprecated 1.33)
• STALE ALPHA: StorageVersionAPI (1.20), APIServingWithRoutine (1.30), CBORServingAndStorage (1.32)
• STALE BETA: StorageVersionHash (1.15), APIResponseCompression (1.16), OpenAPIEnums (1.24), UnauthenticatedHTTP2DOSMitigation (1.25), APIServerIdentity (1.26), TranslateStreamCloseWebsocketRequests (1.30), ConcurrentWatchObjectDecode (1.31), PortForwardWebsockets (1.31), WatchList (1.32)

SIG Auth (7)

• OVERDUE: ServiceAccountTokenJTI (locked 1.32), ServiceAccountTokenNodeBindingValidation (1.32), ServiceAccountTokenNodeBinding (1.33)
• NEVER LOCKED: KMSv1 (deprecated 1.28), AllowDNSOnlyNodeCSR (1.31), AllowInsecureKubeletCertificateSigningRequests (1.31). The last two are covered by k/k#139410.
• STALE BETA: ServiceAccountNodeAudienceRestriction (1.32)

SIG Scheduling (5)

• OVERDUE: PodSchedulingReadiness (locked 1.30), MatchLabelKeysInPodAffinity (1.33), NodeInclusionPolicyInPodTopologySpread (1.33), SeparateTaintEvictionController (1.34)
• STALE BETA: MatchLabelKeysInPodTopologySpread (1.27)

SIG Network (4)

• OVERDUE: NFTablesProxyMode (locked 1.33), MultiCIDRServiceAllocator (1.34)
• DUE 1.38: DisableAllocatorDualWrite, PreferSameTrafficDistribution

SIG Windows (4)

• OVERDUE: WinDSR (locked 1.34), WinOverlay (1.34)
• NEVER LOCKED: WindowsHostNetwork (deprecated 1.33)
• STALE ALPHA: WindowsCPUAndMemoryAffinity (1.32)

SIG Storage (3)

• OVERDUE: RecoverVolumeExpansionFailure (locked 1.34). PR k/k#139079 exists but is a draft and needs a rebase.
• STALE ALPHA: CSIVolumeHealth (1.21), CrossNamespaceVolumeDataSource (1.26)

SIG Instrumentation (2)

• OVERDUE: KubeletTracing (locked 1.34)
• STALE BETA: ContextualLogging (1.30)

SIG Apps (2)

• DUE 1.38: JobManagedBy
• STALE BETA: PodDeletionCost (1.22)

SIG Cloud Provider (1)

• STALE ALPHA: CloudControllerManagerWebhook (1.27)

SIG leads, take your block. For OVERDUE and DUE 1.38, please do what's necessary. For STALE, pick one: graduate, remove, or name an owner and a target release in appropriate issue or pr in enhancements (update KEP?)

Thanks,
Dims

--

Davanum Srinivas :: https://twitter.com/dims

[Michael McCune]

thanks for the heads up Dims!

peace o/

--
You received this message because you are subscribed to the Google Groups "dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to dev+uns...@kubernetes.io.
To view this discussion visit https://groups.google.com/a/kubernetes.io/d/msgid/dev/CANw6fcHbRE-FLAg7R_%3DPtpcO-i6iSMsYMAGArgiuvNFYGmjqag%40mail.gmail.com.

[Hemant Kumar]

We just pushed a major API and design change for CSI volume health feature - https://github.com/kubernetes/kubernetes/pull/140194 

It should not be considered stale.

To view this discussion visit https://groups.google.com/a/kubernetes.io/d/msgid/dev/CADE%2BktSQ3i-FPyHNkqyZfP6s%2B17wbnKYj4zZHuOdMOMOXqajaQ%40mail.gmail.com.

[Francesco Romani]

On Monday, August 31, 2026 at 4:30:35 PM UTC+2 Davanum Srinivas wrote:

Hi all,

I checked every feature gate on master (1.38 dev) against contributors/devel/sig-architecture/feature-gates.md, as the source.

Four things I looked for:

• OVERDUE — locked in release X, still here after X+3. This breaks the rule.
• DUE 1.38 — hits X+3 this cycle. Remove it now and the backlog stops growing.
• NEVER LOCKED — GA or deprecated, but LockToDefault is still false.
• STALE — no stage change in 6 or more releases. Breaks no rule, but nobody has made a call on it.

---

SIG Node (29)

• OVERDUE: TopologyManagerPolicyOptions (locked 1.32), CPUManagerPolicyOptions (1.33), RecursiveReadOnlyMounts (1.33), KubeletCgroupDriverFromCRI (1.34), NodeSwap (1.34), RelaxedEnvironmentVariableValidation (1.34)
• DUE 1.38: AllowOverwriteTerminationGracePeriodSeconds, DynamicResourceAllocation (k/k#134459), ExecProbeTimeout, ImageMaximumGCAge, InPlacePodVerticalScaling (k/k#133537), PodObservedGenerationTracking, SupplementalGroupsPolicy, SystemdWatchdog
• NEVER LOCKED: CustomCPUCFSQuotaPeriod (GA 1.36), KubeletPodResourcesListUseActivePods (deprecated 1.34), KubeletRegistrationGetOnExistsOnly (deprecated 1.32)
• STALE ALPHA: QOSReserved (1.11), EventedPLEG (1.26), RuntimeClassInImageCriApi (1.29), InPlacePodVerticalScalingExclusiveCPUs (1.32), PodLogsQuerySplitStreams (1.32)
• STALE BETA: RotateKubeletServerCertificate (1.12), GracefulNodeShutdown (1.21), GracefulNodeShutdownBasedOnPodPriority (1.24), ContainerCheckpoint (1.30), KubeletSeparateDiskGC (1.31), LocalStorageCapacityIsolationFSQuotaMonitoring (1.31, off by default), ReloadKubeletServerCertificateFile (1.31)

I started to take care of some of these. All of the following are kubelet-only FGs: 

• DisableCPUQuotaWithExclusiveCPUs

• CPUManagerPolicyOptions

• KubeletCgroupDriverFromCRI

• KubeletPodResourcesDynamicResources

• KubeletPodResourcesGet

• TopologyManagerPolicyOptions

Yet `hack/update-featuregates.sh` complains about emulated version which however IIRC is not yet enforced on the kubelet, nor relevant in this case. See: https://github.com/kubernetes/kubernetes/pull/141758#discussion_r3906685120 and following. I guess it's ok to ignore this specific error?

Bests,

[Shingo Omura]

Thanks for the heads-up, Dims!

> SIG Node (29)

> DUE 1.38: ..., SupplementalGroupsPolicy

I'll handle this feature gate in this release cycle.

Best,

2026年9月2日水曜日 22:40:44 UTC+9 Francesco Romani:

[yuanliang zhang]

Ack, sig-windows will work on corresponding ones

--

You received this message because you are subscribed to the Google Groups "dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to dev+uns...@kubernetes.io.

To view this discussion visit https://groups.google.com/a/kubernetes.io/d/msgid/dev/b6b3be9f-f24b-4c79-8f84-722c709b84can%40kubernetes.io.