Kubernetes Knowledge Patch

Kubernetes Knowledge Patch

Use this skill before changing Kubernetes manifests, cluster configuration, controllers, scheduler plugins, node setup, client integrations, or operational tooling. Start with the upgrade hazards, then open the reference matching the task; details that differ by patch release remain attributed in the references.

Reference index

Breaking changes and deprecations

Clear node startup blockers

• Linux kubelets require cgroup v2. Treat failCgroupV1: false plus an ignored kubeadm preflight error only as an explicit compatibility override.
• Remove kubelet --pod-infra-container-image; leaving it configured prevents startup. Remove --cloud-config and --register-schedulable too.
• Let kubelet discover the cgroup driver from CRI. Manual cgroupDriver and --cgroup-driver selection are deprecated.
• Upgrade old runtimes before using image volumes, strict supplemental groups, user namespaces, or other runtime-dependent features.

Migrate APIs and extension contracts

• Use resource.k8s.io/v1 for core DRA objects. Delete or recreate incompatible alpha DRA objects and partitionable-device data as the DRA reference directs.
• Use storage.k8s.io/v1 for VolumeAttributesClass and v1beta1 for StorageVersionMigration; delete unsupported alpha objects before upgrade.
• Use admissionregistration.k8s.io/v1 for MutatingAdmissionPolicy; beta-era storage may still require migration.
• Kubectl no longer accepts legacy beta CSR, EndpointSlice, Ingress, or PodDisruptionBudget objects.
• Kubernetes API Go types and extension protocols use standard protobuf. Remove gogo registry and ProtoMessage() assumptions.
• Scheduler extensions import framework types from k8s.io/kube-scheduler/framework and must implement current preflight result and workload-state contracts.

Remove obsolete configuration

• Delete feature-gate names after graduation or removal. Components reject an enabled feature when a required dependency is disabled.
• Remove kube-apiserver cloud-provider flags and configure external cloud integration separately.
• Move leader-election locks from configmapsleases or endpointsleases to leases.
• Update renamed metrics and labels before upgrading dashboards and alerts; several API-server metrics now separate API groups from resource labels.
• Configure --peer-ca-file before depending on mixed-version API-server proxying.
• When request-header and ordinary client CA bundles overlap, set --requestheader-allowed-names.

Replace deprecated networking and volumes

• Read Services through every labeled EndpointSlice, not the deprecated Endpoints object.
• Prefer kube-proxy nftables; IPVS is deprecated.
• Replace trafficDistribution: PreferClose with PreferSameZone or PreferSameNode.
• Plan alternatives to Service.spec.externalIPs with LoadBalancer, NodePort, or Gateway API exposure.
• Migrate Ingress NGINX deployments to Gateway API and inspect every warning or approximate ingress2gateway conversion.
• Replace gitRepo volumes with an init container or git-sync. The feature-gate escape hatch is gone.
• Migrate removed in-tree and flex-volume integrations to CSI before upgrading.

Update command and access assumptions

• Write kubectl exec POD -- COMMAND; the separator is required.
• Expect kubectl debug to use the general profile unless selected otherwise.
• Add --show-events when describing multiple objects and events are needed.
• Grant create on pods/exec, pods/attach, and pods/portforward; WebSocket access no longer succeeds with only get.
• Do not interpret PodReadyToStartContainers=True as proof that image pulling has completed.

Workload quick reference

Resize running Pods through the subresource

spec.containers[*].resources is desired state; container status reports actual resources. Submit CPU and memory changes through the resize subresource and inspect PodResizePending or PodResizeInProgress conditions.

kubectl edit pod <pod-name> --subresource resize

Memory reductions, swap, static CPU or Memory Manager policies, native sidecars, init containers, and Pod-level resources have distinct restrictions. Read the workload reference before automating resize.

Use Pod-level resource budgets deliberately

Pod-wide CPU, memory, and huge-page requests and limits can simplify scheduling and HPA calculations. They are unsupported on Windows, and topology-aware manager integration depends on the active behavior. A missing container limit in resourceFieldRef can fall back to the Pod-level limit.

spec:
  resources:
    requests:
      cpu: "2"
      memory: 4Gi
    limits:
      cpu: "4"
      memory: 8Gi

Distinguish sidecars and restart rules

• A native sidecar is an initContainers entry with container-level restartPolicy: Always; it preserves init ordering, runs with the app, stops in reverse order, and does not block Job completion.
• Regular and init containers can have per-container policies and exit-code rules. Restart-all rules can restart every container when a selected source exits.
• lifecycle.stopSignal can override the image or runtime signal when the Pod declares its OS.

Choose Job semantics explicitly

• Indexed Jobs support per-index retry limits, failed-index caps, FailIndex, and success policies.
• Set podReplacementPolicy: Failed to avoid overlapping a terminating Pod and its replacement.
• Suspended Jobs can accept resource and scheduling edits under the applicable feature behavior; active Pods remain immutable.
• managedBy delegates reconciliation but does not carry controller parameters.
• PodGroups provide all-or-nothing scheduling; use the current scheduling.k8s.io API and conditions.

Dynamic Resource Allocation essentials

Select claim lifecycle correctly

• A direct ResourceClaim is namespaced, reusable by multiple Pods, and manually managed.
• A ResourceClaimTemplate creates one claim per Pod and deletes it with the Pod.
• Do not set spec.nodeName on DRA Pods. Use an exact hostname node selector so scheduling still allocates and reserves devices.
• Quota can charge device-class and mapped extended-resource keys.

Account for advanced allocation

• Prioritized alternatives, taints and tolerations, shared counters, consumable capacity, binding conditions, and extended-resource mapping affect eligibility and timing.
• Drivers report device status and health; Unknown and Unhealthy allocations appear in Pod status.
• Binding can wait for external preparation and time out under scheduler configuration.
• Status writers need granular binding and driver subresource permissions.
• Drivers and ResourceSlice implementations must honor the stable kubelet plugin protocol and release-specific migrations.

Security and identity essentials

Prefer bounded workload credentials

• Bound ServiceAccount tokens carry JTI and node identity and can be restricted to a designated node.
• Kubelet image credential providers can request short-lived, audience-bound ServiceAccount tokens.
• Cached private images can require fresh credential verification according to imagePullCredentialsVerificationPolicy.
• Pod certificates let kubelet generate, request, rotate, and project X.509 credentials; verify feature and API enablement.
• CSI ServiceAccount tokens belong in the secrets channel rather than routinely logged volume context.

Harden authorization and admission

• Selector-aware authorization can require field or label selectors for list, watch, and delete-collection requests.
• Restrict anonymous authentication to explicit health paths.
• Constrained impersonation adds operation-specific checks while retaining compatibility with existing impersonate rules.
• Mutating admission policies require bindings and use CEL apply configurations or JSON Patch; escape / and ~ in JSON Patch keys.
• Restricted Pod security rejects probes and lifecycle handlers with a remote host.
• supplementalGroupsPolicy: Strict prevents image /etc/group memberships from being merged.

Networking, storage, and client essentials

• Use supported trafficDistribution values and validate canonical IP/CIDR forms while accounting for relaxed Service-name validation.
• Treat Gateway features by channel. Experimental kinds use gateway.networking.x-k8s.io and X prefixes and must be recreated if they graduate to stable identities.
• Stable VolumeAttributesClass supports CSI ModifyVolume; PV finalizers make Delete reclaim reliable; CSI allocatable counts can refresh dynamically.
• Image volumes require compatible runtimes. Volume group snapshots provide one crash-consistent recovery point across PVCs. SELinux mount labeling can fail on shared-label conflicts.
• Informers process events in order and atomic list updates expose one resource version. Large LISTs consume APF seats by memory size.
• Use /flagz and /statusz for authorized structured diagnostics; enable enableSystemLogQuery for node logs. Kubelet PSI metrics require cgroup v2.
• Keep kubectl preferences in .kuberc; use its credential-plugin policy and allowlist. Use kubectl -o kyaml for Kubernetes-oriented YAML output.