Feature Gates (removed)
This page contains list of feature gates that have been removed. The information on this page is for reference. A removed feature gate is different from a GA'ed or deprecated one in that a removed one is no longer recognized as a valid feature gate. However, a GA'ed or a deprecated feature gate is still recognized by the corresponding Kubernetes components although they are unable to cause any behavior differences in a cluster.
For feature gates that are still recognized by the Kubernetes components, please refer to the Alpha/Beta feature gate table or the Graduated/Deprecated feature gate table
Feature gates that are removed
In the following table:
- The "From" column contains the Kubernetes release when a feature is introduced or its release stage is changed.
- The "To" column, if not empty, contains the last Kubernetes release in which you can still use a feature gate. If the feature stage is either "Deprecated" or "GA", the "To" column is the Kubernetes release when the feature is removed.
| Feature | Default | Stage | From | To |
|---|---|---|---|---|
Accelerators |
false |
Alpha | 1.6 | 1.10 |
Accelerators |
– | Deprecated | 1.11 | 1.11 |
AdmissionWebhookMatchConditions |
false |
Alpha | 1.27 | 1.27 |
AdmissionWebhookMatchConditions |
true |
Beta | 1.28 | 1.29 |
AdmissionWebhookMatchConditions |
true |
GA | 1.30 | 1.32 |
AdvancedAuditing |
false |
Alpha | 1.7 | 1.7 |
AdvancedAuditing |
true |
Beta | 1.8 | 1.11 |
AdvancedAuditing |
true |
GA | 1.12 | 1.27 |
AffinityInAnnotations |
false |
Alpha | 1.6 | 1.7 |
AffinityInAnnotations |
– | Deprecated | 1.8 | 1.8 |
AggregatedDiscoveryEndpoint |
false |
Alpha | 1.26 | 1.26 |
AggregatedDiscoveryEndpoint |
true |
Beta | 1.27 | 1.29 |
AggregatedDiscoveryEndpoint |
true |
GA | 1.30 | 1.32 |
AllowExtTrafficLocalEndpoints |
false |
Beta | 1.4 | 1.6 |
AllowExtTrafficLocalEndpoints |
true |
GA | 1.7 | 1.9 |
AllowInsecureBackendProxy |
true |
Beta | 1.17 | 1.20 |
AllowInsecureBackendProxy |
true |
GA | 1.21 | 1.25 |
APIListChunking |
false |
Alpha | 1.8 | 1.8 |
APIListChunking |
true |
Beta | 1.9 | 1.28 |
APIListChunking |
true |
GA | 1.29 | 1.32 |
APIPriorityAndFairness |
false |
Alpha | 1.18 | 1.19 |
APIPriorityAndFairness |
true |
Beta | 1.20 | 1.28 |
APIPriorityAndFairness |
true |
GA | 1.29 | 1.30 |
APISelfSubjectReview |
false |
Alpha | 1.26 | 1.26 |
APISelfSubjectReview |
true |
Beta | 1.27 | 1.27 |
APISelfSubjectReview |
true |
GA | 1.28 | 1.29 |
AppArmor |
true |
Beta | 1.4 | 1.30 |
AppArmor |
true |
GA | 1.31 | 1.32 |
AppArmorFields |
true |
Beta | 1.30 | 1.30 |
AppArmorFields |
true |
GA | 1.31 | 1.32 |
AttachVolumeLimit |
false |
Alpha | 1.11 | 1.11 |
AttachVolumeLimit |
true |
Beta | 1.12 | 1.16 |
AttachVolumeLimit |
true |
GA | 1.17 | 1.21 |
BalanceAttachedNodeVolumes |
false |
Alpha | 1.11 | 1.21 |
BalanceAttachedNodeVolumes |
false |
Deprecated | 1.22 | 1.22 |
BlockVolume |
false |
Alpha | 1.9 | 1.12 |
BlockVolume |
true |
Beta | 1.13 | 1.17 |
BlockVolume |
true |
GA | 1.18 | 1.21 |
BoundServiceAccountTokenVolume |
false |
Alpha | 1.13 | 1.20 |
BoundServiceAccountTokenVolume |
true |
Beta | 1.21 | 1.21 |
BoundServiceAccountTokenVolume |
true |
GA | 1.22 | 1.23 |
CloudDualStackNodeIPs |
false |
Alpha | 1.27 | 1.28 |
CloudDualStackNodeIPs |
true |
Beta | 1.29 | 1.29 |
CloudDualStackNodeIPs |
true |
GA | 1.30 | 1.31 |
ConfigurableFSGroupPolicy |
false |
Alpha | 1.18 | 1.19 |
ConfigurableFSGroupPolicy |
true |
Beta | 1.20 | 1.22 |
ConfigurableFSGroupPolicy |
true |
GA | 1.23 | 1.25 |
ConsistentHTTPGetHandlers |
true |
GA | 1.25 | 1.30 |
ControllerManagerLeaderMigration |
false |
Alpha | 1.21 | 1.21 |
ControllerManagerLeaderMigration |
true |
Beta | 1.22 | 1.23 |
ControllerManagerLeaderMigration |
true |
GA | 1.24 | 1.26 |
CPUManager |
false |
Alpha | 1.8 | 1.9 |
CPUManager |
true |
Beta | 1.10 | 1.25 |
CPUManager |
true |
GA | 1.26 | 1.32 |
CRIContainerLogRotation |
false |
Alpha | 1.10 | 1.10 |
CRIContainerLogRotation |
true |
Beta | 1.11 | 1.20 |
CRIContainerLogRotation |
true |
GA | 1.21 | 1.22 |
CronJobControllerV2 |
false |
Alpha | 1.20 | 1.20 |
CronJobControllerV2 |
true |
Beta | 1.21 | 1.21 |
CronJobControllerV2 |
true |
GA | 1.22 | 1.23 |
CronJobTimeZone |
false |
Alpha | 1.24 | 1.24 |
CronJobTimeZone |
true |
Beta | 1.25 | 1.26 |
CronJobTimeZone |
true |
GA | 1.27 | 1.28 |
CSIBlockVolume |
false |
Alpha | 1.11 | 1.13 |
CSIBlockVolume |
true |
Beta | 1.14 | 1.17 |
CSIBlockVolume |
true |
GA | 1.18 | 1.21 |
CSIDriverRegistry |
false |
Alpha | 1.12 | 1.13 |
CSIDriverRegistry |
true |
Beta | 1.14 | 1.17 |
CSIDriverRegistry |
true |
GA | 1.18 | 1.21 |
CSIInlineVolume |
false |
Alpha | 1.15 | 1.15 |
CSIInlineVolume |
true |
Beta | 1.16 | 1.24 |
CSIInlineVolume |
true |
GA | 1.25 | 1.26 |
CSIMigration |
false |
Alpha | 1.14 | 1.16 |
CSIMigration |
true |
Beta | 1.17 | 1.24 |
CSIMigration |
true |
GA | 1.25 | 1.26 |
CSIMigrationAWS |
false |
Alpha | 1.14 | 1.16 |
CSIMigrationAWS |
false |
Beta | 1.17 | 1.22 |
CSIMigrationAWS |
true |
Beta | 1.23 | 1.24 |
CSIMigrationAWS |
true |
GA | 1.25 | 1.26 |
CSIMigrationAWSComplete |
false |
Alpha | 1.17 | 1.20 |
CSIMigrationAWSComplete |
– | Deprecated | 1.21 | 1.21 |
CSIMigrationAzureDisk |
false |
Alpha | 1.15 | 1.18 |
CSIMigrationAzureDisk |
false |
Beta | 1.19 | 1.22 |
CSIMigrationAzureDisk |
true |
Beta | 1.23 | 1.23 |
CSIMigrationAzureDisk |
true |
GA | 1.24 | 1.26 |
CSIMigrationAzureDiskComplete |
false |
Alpha | 1.17 | 1.20 |
CSIMigrationAzureDiskComplete |
– | Deprecated | 1.21 | 1.21 |
CSIMigrationAzureFile |
false |
Alpha | 1.15 | 1.20 |
CSIMigrationAzureFile |
false |
Beta | 1.21 | 1.23 |
CSIMigrationAzureFile |
true |
Beta | 1.24 | 1.25 |
CSIMigrationAzureFile |
true |
GA | 1.26 | 1.29 |
CSIMigrationAzureFileComplete |
false |
Alpha | 1.17 | 1.20 |
CSIMigrationAzureFileComplete |
– | Deprecated | 1.21 | 1.21 |
CSIMigrationGCE |
false |
Alpha | 1.14 | 1.16 |
CSIMigrationGCE |
false |
Beta | 1.17 | 1.22 |
CSIMigrationGCE |
true |
Beta | 1.23 | 1.24 |
CSIMigrationGCE |
true |
GA | 1.25 | 1.27 |
CSIMigrationGCEComplete |
false |
Alpha | 1.17 | 1.20 |
CSIMigrationGCEComplete |
– | Deprecated | 1.21 | 1.21 |
CSIMigrationOpenStack |
false |
Alpha | 1.14 | 1.17 |
CSIMigrationOpenStack |
true |
Beta | 1.18 | 1.23 |
CSIMigrationOpenStack |
true |
GA | 1.24 | 1.25 |
CSIMigrationOpenStackComplete |
false |
Alpha | 1.17 | 1.20 |
CSIMigrationOpenStackComplete |
– | Deprecated | 1.21 | 1.21 |
CSIMigrationRBD |
false |
Alpha | 1.23 | 1.27 |
CSIMigrationRBD |
false |
Deprecated | 1.28 | 1.30 |
CSIMigrationvSphere |
false |
Alpha | 1.18 | 1.18 |
CSIMigrationvSphere |
false |
Beta | 1.19 | 1.24 |
CSIMigrationvSphere |
true |
Beta | 1.25 | 1.25 |
CSIMigrationvSphere |
true |
GA | 1.26 | 1.28 |
CSIMigrationvSphereComplete |
false |
Beta | 1.19 | 1.21 |
CSIMigrationvSphereComplete |
– | Deprecated | 1.22 | 1.22 |
CSINodeExpandSecret |
false |
Alpha | 1.25 | 1.26 |
CSINodeExpandSecret |
true |
Beta | 1.27 | 1.28 |
CSINodeExpandSecret |
true |
GA | 1.29 | 1.30 |
CSINodeInfo |
false |
Alpha | 1.12 | 1.13 |
CSINodeInfo |
true |
Beta | 1.14 | 1.16 |
CSINodeInfo |
true |
GA | 1.17 | 1.22 |
CSIPersistentVolume |
false |
Alpha | 1.9 | 1.9 |
CSIPersistentVolume |
true |
Beta | 1.10 | 1.12 |
CSIPersistentVolume |
true |
GA | 1.13 | 1.16 |
CSIServiceAccountToken |
false |
Alpha | 1.20 | 1.20 |
CSIServiceAccountToken |
true |
Beta | 1.21 | 1.21 |
CSIServiceAccountToken |
true |
GA | 1.22 | 1.24 |
CSIStorageCapacity |
false |
Alpha | 1.19 | 1.20 |
CSIStorageCapacity |
true |
Beta | 1.21 | 1.23 |
CSIStorageCapacity |
true |
GA | 1.24 | 1.27 |
CSIVolumeFSGroupPolicy |
false |
Alpha | 1.19 | 1.19 |
CSIVolumeFSGroupPolicy |
true |
Beta | 1.20 | 1.22 |
CSIVolumeFSGroupPolicy |
true |
GA | 1.23 | 1.25 |
CSRDuration |
true |
Beta | 1.22 | 1.23 |
CSRDuration |
true |
GA | 1.24 | 1.25 |
CustomPodDNS |
false |
Alpha | 1.9 | 1.9 |
CustomPodDNS |
true |
Beta | 1.10 | 1.13 |
CustomPodDNS |
true |
GA | 1.14 | 1.16 |
CustomResourceDefaulting |
false |
Alpha | 1.15 | 1.15 |
CustomResourceDefaulting |
true |
Beta | 1.16 | 1.16 |
CustomResourceDefaulting |
true |
GA | 1.17 | 1.18 |
CustomResourcePublishOpenAPI |
false |
Alpha | 1.14 | 1.14 |
CustomResourcePublishOpenAPI |
true |
Beta | 1.15 | 1.15 |
CustomResourcePublishOpenAPI |
true |
GA | 1.16 | 1.18 |
CustomResourceSubresources |
false |
Alpha | 1.10 | 1.10 |
CustomResourceSubresources |
true |
Beta | 1.11 | 1.15 |
CustomResourceSubresources |
true |
GA | 1.16 | 1.18 |
CustomResourceValidation |
false |
Alpha | 1.8 | 1.8 |
CustomResourceValidation |
true |
Beta | 1.9 | 1.15 |
CustomResourceValidation |
true |
GA | 1.16 | 1.18 |
CustomResourceValidationExpressions |
false |
Alpha | 1.23 | 1.24 |
CustomResourceValidationExpressions |
true |
Beta | 1.25 | 1.28 |
CustomResourceValidationExpressions |
true |
GA | 1.29 | 1.30 |
CustomResourceWebhookConversion |
false |
Alpha | 1.13 | 1.14 |
CustomResourceWebhookConversion |
true |
Beta | 1.15 | 1.15 |
CustomResourceWebhookConversion |
true |
GA | 1.16 | 1.18 |
DaemonSetUpdateSurge |
false |
Alpha | 1.21 | 1.21 |
DaemonSetUpdateSurge |
true |
Beta | 1.22 | 1.24 |
DaemonSetUpdateSurge |
true |
GA | 1.25 | 1.26 |
DefaultHostNetworkHostPortsInPodTemplates |
false |
Deprecated | 1.28 | 1.30 |
DefaultPodTopologySpread |
false |
Alpha | 1.19 | 1.19 |
DefaultPodTopologySpread |
true |
Beta | 1.20 | 1.23 |
DefaultPodTopologySpread |
true |
GA | 1.24 | 1.25 |
DelegateFSGroupToCSIDriver |
false |
Alpha | 1.22 | 1.22 |
DelegateFSGroupToCSIDriver |
true |
Beta | 1.23 | 1.25 |
DelegateFSGroupToCSIDriver |
true |
GA | 1.26 | 1.27 |
DevicePluginCDIDevices |
false |
Alpha | 1.28 | 1.28 |
DevicePluginCDIDevices |
true |
Beta | 1.29 | 1.30 |
DevicePluginCDIDevices |
true |
GA | 1.31 | 1.33 |
DevicePlugins |
false |
Alpha | 1.8 | 1.9 |
DevicePlugins |
true |
Beta | 1.10 | 1.25 |
DevicePlugins |
true |
GA | 1.26 | 1.27 |
DisableAcceleratorUsageMetrics |
false |
Alpha | 1.19 | 1.19 |
DisableAcceleratorUsageMetrics |
true |
Beta | 1.20 | 1.24 |
DisableAcceleratorUsageMetrics |
true |
GA | 1.25 | 1.27 |
DisableCloudProviders |
false |
Alpha | 1.22 | 1.28 |
DisableCloudProviders |
true |
Beta | 1.29 | 1.30 |
DisableCloudProviders |
true |
GA | 1.31 | 1.32 |
DisableKubeletCloudCredentialProviders |
false |
Alpha | 1.23 | 1.28 |
DisableKubeletCloudCredentialProviders |
true |
Beta | 1.29 | 1.30 |
DisableKubeletCloudCredentialProviders |
true |
GA | 1.31 | 1.32 |
DownwardAPIHugePages |
false |
Alpha | 1.20 | 1.20 |
DownwardAPIHugePages |
false |
Beta | 1.21 | 1.21 |
DownwardAPIHugePages |
true |
Beta | 1.22 | 1.26 |
DownwardAPIHugePages |
true |
GA | 1.27 | 1.28 |
DRAControlPlaneController |
false |
Alpha | 1.26 | 1.31 |
DryRun |
false |
Alpha | 1.12 | 1.12 |
DryRun |
true |
Beta | 1.13 | 1.18 |
DryRun |
true |
GA | 1.19 | 1.27 |
DynamicAuditing |
false |
Alpha | 1.13 | 1.18 |
DynamicAuditing |
– | Deprecated | 1.19 | 1.19 |
DynamicKubeletConfig |
false |
Alpha | 1.4 | 1.10 |
DynamicKubeletConfig |
true |
Beta | 1.11 | 1.21 |
DynamicKubeletConfig |
false |
Deprecated | 1.22 | 1.25 |
DynamicProvisioningScheduling |
false |
Alpha | 1.11 | 1.11 |
DynamicProvisioningScheduling |
– | Deprecated | 1.12 | – |
DynamicVolumeProvisioning |
true |
Alpha | 1.3 | 1.7 |
DynamicVolumeProvisioning |
true |
GA | 1.8 | 1.12 |
EfficientWatchResumption |
false |
Alpha | 1.20 | 1.20 |
EfficientWatchResumption |
true |
Beta | 1.21 | 1.23 |
EfficientWatchResumption |
true |
GA | 1.24 | 1.32 |
EnableAggregatedDiscoveryTimeout |
true |
Deprecated | 1.16 | 1.17 |
EnableEquivalenceClassCache |
false |
Alpha | 1.8 | 1.12 |
EnableEquivalenceClassCache |
– | Deprecated | 1.13 | 1.23 |
EndpointSlice |
false |
Alpha | 1.16 | 1.16 |
EndpointSlice |
false |
Beta | 1.17 | 1.17 |
EndpointSlice |
true |
Beta | 1.18 | 1.20 |
EndpointSlice |
true |
GA | 1.21 | 1.24 |
EndpointSliceNodeName |
false |
Alpha | 1.20 | 1.20 |
EndpointSliceNodeName |
true |
GA | 1.21 | 1.24 |
EndpointSliceProxying |
false |
Alpha | 1.18 | 1.18 |
EndpointSliceProxying |
true |
Beta | 1.19 | 1.21 |
EndpointSliceProxying |
true |
GA | 1.22 | 1.24 |
EndpointSliceTerminatingCondition |
false |
Alpha | 1.20 | 1.21 |
EndpointSliceTerminatingCondition |
true |
Beta | 1.22 | 1.25 |
EndpointSliceTerminatingCondition |
true |
GA | 1.26 | 1.27 |
EphemeralContainers |
false |
Alpha | 1.16 | 1.22 |
EphemeralContainers |
true |
Beta | 1.23 | 1.24 |
EphemeralContainers |
true |
GA | 1.25 | 1.26 |
EvenPodsSpread |
false |
Alpha | 1.16 | 1.17 |
EvenPodsSpread |
true |
Beta | 1.18 | 1.18 |
EvenPodsSpread |
true |
GA | 1.19 | 1.21 |
ExpandCSIVolumes |
false |
Alpha | 1.14 | 1.15 |
ExpandCSIVolumes |
true |
Beta | 1.16 | 1.23 |
ExpandCSIVolumes |
true |
GA | 1.24 | 1.26 |
ExpandedDNSConfig |
false |
Alpha | 1.22 | 1.25 |
ExpandedDNSConfig |
true |
Beta | 1.26 | 1.27 |
ExpandedDNSConfig |
true |
GA | 1.28 | 1.29 |
ExpandInUsePersistentVolumes |
false |
Alpha | 1.11 | 1.14 |
ExpandInUsePersistentVolumes |
true |
Beta | 1.15 | 1.23 |
ExpandInUsePersistentVolumes |
true |
GA | 1.24 | 1.26 |
ExpandPersistentVolumes |
false |
Alpha | 1.8 | 1.10 |
ExpandPersistentVolumes |
true |
Beta | 1.11 | 1.23 |
ExpandPersistentVolumes |
true |
GA | 1.24 | 1.26 |
ExperimentalCriticalPodAnnotation |
false |
Alpha | 1.5 | 1.12 |
ExperimentalCriticalPodAnnotation |
false |
Deprecated | 1.13 | 1.16 |
ExperimentalHostUserNamespaceDefaulting |
false |
Beta | 1.5 | 1.27 |
ExperimentalHostUserNamespaceDefaulting |
false |
Deprecated | 1.28 | 1.29 |
ExternalPolicyForExternalIP |
true |
GA | 1.18 | 1.22 |
GCERegionalPersistentDisk |
true |
Beta | 1.10 | 1.12 |
GCERegionalPersistentDisk |
true |
GA | 1.13 | 1.16 |
GenericEphemeralVolume |
false |
Alpha | 1.19 | 1.20 |
GenericEphemeralVolume |
true |
Beta | 1.21 | 1.22 |
GenericEphemeralVolume |
true |
GA | 1.23 | 1.24 |
GRPCContainerProbe |
false |
Alpha | 1.23 | 1.23 |
GRPCContainerProbe |
true |
Beta | 1.24 | 1.26 |
GRPCContainerProbe |
true |
GA | 1.27 | 1.28 |
HPAContainerMetrics |
false |
Alpha | 1.20 | 1.26 |
HPAContainerMetrics |
true |
Beta | 1.27 | 1.29 |
HPAContainerMetrics |
true |
GA | 1.30 | 1.31 |
HugePages |
false |
Alpha | 1.8 | 1.9 |
HugePages |
true |
Beta | 1.10 | 1.13 |
HugePages |
true |
GA | 1.14 | 1.16 |
HugePageStorageMediumSize |
false |
Alpha | 1.18 | 1.18 |
HugePageStorageMediumSize |
true |
Beta | 1.19 | 1.21 |
HugePageStorageMediumSize |
true |
GA | 1.22 | 1.24 |
HyperVContainer |
false |
Alpha | 1.10 | 1.19 |
HyperVContainer |
false |
Deprecated | 1.20 | 1.20 |
IdentifyPodOS |
false |
Alpha | 1.23 | 1.23 |
IdentifyPodOS |
true |
Beta | 1.24 | 1.24 |
IdentifyPodOS |
true |
GA | 1.25 | 1.26 |
ImmutableEphemeralVolumes |
false |
Alpha | 1.18 | 1.18 |
ImmutableEphemeralVolumes |
true |
Beta | 1.19 | 1.20 |
ImmutableEphemeralVolumes |
true |
GA | 1.21 | 1.24 |
IndexedJob |
false |
Alpha | 1.21 | 1.21 |
IndexedJob |
true |
Beta | 1.22 | 1.23 |
IndexedJob |
true |
GA | 1.24 | 1.25 |
IngressClassNamespacedParams |
false |
Alpha | 1.21 | 1.21 |
IngressClassNamespacedParams |
true |
Beta | 1.22 | 1.22 |
IngressClassNamespacedParams |
true |
GA | 1.23 | 1.24 |
Initializers |
false |
Alpha | 1.7 | 1.13 |
Initializers |
– | Deprecated | 1.14 | 1.14 |
InTreePluginAWSUnregister |
false |
Alpha | 1.21 | 1.30 |
InTreePluginAzureDiskUnregister |
false |
Alpha | 1.21 | 1.30 |
InTreePluginAzureFileUnregister |
false |
Alpha | 1.21 | 1.30 |
InTreePluginGCEUnregister |
false |
Alpha | 1.21 | 1.30 |
InTreePluginOpenStackUnregister |
false |
Alpha | 1.21 | 1.30 |
InTreePluginRBDUnregister |
false |
Alpha | 1.23 | 1.27 |
InTreePluginRBDUnregister |
false |
Deprecated | 1.28 | 1.30 |
InTreePluginvSphereUnregister |
false |
Alpha | 1.21 | 1.30 |
IPTablesOwnershipCleanup |
false |
Alpha | 1.25 | 1.26 |
IPTablesOwnershipCleanup |
true |
Beta | 1.27 | 1.27 |
IPTablesOwnershipCleanup |
true |
GA | 1.28 | 1.29 |
IPv6DualStack |
false |
Alpha | 1.15 | 1.20 |
IPv6DualStack |
true |
Beta | 1.21 | 1.22 |
IPv6DualStack |
true |
GA | 1.23 | 1.24 |
JobMutableNodeSchedulingDirectives |
true |
Beta | 1.23 | 1.26 |
JobMutableNodeSchedulingDirectives |
true |
GA | 1.27 | 1.28 |
JobPodFailurePolicy |
false |
Alpha | 1.25 | 1.25 |
JobPodFailurePolicy |
true |
Beta | 1.26 | 1.30 |
JobPodFailurePolicy |
true |
GA | 1.31 | 1.32 |
JobReadyPods |
false |
Alpha | 1.23 | 1.23 |
JobReadyPods |
true |
Beta | 1.24 | 1.28 |
JobReadyPods |
true |
GA | 1.29 | 1.30 |
JobTrackingWithFinalizers |
false |
Alpha | 1.22 | 1.22 |
JobTrackingWithFinalizers |
false |
Beta | 1.23 | 1.24 |
JobTrackingWithFinalizers |
true |
Beta | 1.25 | 1.25 |
JobTrackingWithFinalizers |
true |
GA | 1.26 | 1.28 |
KMSv2 |
false |
Alpha | 1.25 | 1.26 |
KMSv2 |
true |
Beta | 1.27 | 1.28 |
KMSv2 |
true |
GA | 1.29 | 1.31 |
KMSv2KDF |
false |
Beta | 1.28 | 1.28 |
KMSv2KDF |
true |
GA | 1.29 | 1.31 |
KubeletConfigFile |
false |
Alpha | 1.8 | 1.9 |
KubeletConfigFile |
– | Deprecated | 1.10 | 1.10 |
KubeletCredentialProviders |
false |
Alpha | 1.20 | 1.23 |
KubeletCredentialProviders |
true |
Beta | 1.24 | 1.25 |
KubeletCredentialProviders |
true |
GA | 1.26 | 1.28 |
KubeletPluginsWatcher |
false |
Alpha | 1.11 | 1.11 |
KubeletPluginsWatcher |
true |
Beta | 1.12 | 1.12 |
KubeletPluginsWatcher |
true |
GA | 1.13 | 1.16 |
KubeletPodResources |
false |
Alpha | 1.13 | 1.14 |
KubeletPodResources |
true |
Beta | 1.15 | 1.27 |
KubeletPodResources |
true |
GA | 1.28 | 1.29 |
KubeletPodResourcesGetAllocatable |
false |
Alpha | 1.21 | 1.22 |
KubeletPodResourcesGetAllocatable |
true |
Beta | 1.23 | 1.27 |
KubeletPodResourcesGetAllocatable |
true |
GA | 1.28 | 1.29 |
KubeProxyDrainingTerminatingNodes |
false |
Alpha | 1.28 | 1.30 |
KubeProxyDrainingTerminatingNodes |
true |
Beta | 1.30 | 1.30 |
KubeProxyDrainingTerminatingNodes |
true |
GA | 1.31 | 1.32 |
LegacyNodeRoleBehavior |
false |
Alpha | 1.16 | 1.18 |
LegacyNodeRoleBehavior |
true |
Beta | 1.19 | 1.20 |
LegacyNodeRoleBehavior |
false |
GA | 1.21 | 1.22 |
LegacyServiceAccountTokenCleanUp |
false |
Alpha | 1.28 | 1.28 |
LegacyServiceAccountTokenCleanUp |
true |
Beta | 1.29 | 1.29 |
LegacyServiceAccountTokenCleanUp |
true |
GA | 1.30 | 1.31 |
LegacyServiceAccountTokenNoAutoGeneration |
true |
Beta | 1.24 | 1.25 |
LegacyServiceAccountTokenNoAutoGeneration |
true |
GA | 1.26 | 1.28 |
LegacyServiceAccountTokenTracking |
false |
Alpha | 1.26 | 1.26 |
LegacyServiceAccountTokenTracking |
true |
Beta | 1.27 | 1.27 |
LegacyServiceAccountTokenTracking |
true |
GA | 1.28 | 1.29 |
LocalStorageCapacityIsolation |
false |
Alpha | 1.7 | 1.9 |
LocalStorageCapacityIsolation |
true |
Beta | 1.10 | 1.24 |
LocalStorageCapacityIsolation |
true |
GA | 1.25 | 1.26 |
MinDomainsInPodTopologySpread |
false |
Alpha | 1.24 | 1.24 |
MinDomainsInPodTopologySpread |
false |
Beta | 1.25 | 1.26 |
MinDomainsInPodTopologySpread |
true |
Beta | 1.27 | 1.29 |
MinDomainsInPodTopologySpread |
true |
GA | 1.30 | 1.31 |
MinimizeIPTablesRestore |
false |
Alpha | 1.26 | 1.26 |
MinimizeIPTablesRestore |
true |
Beta | 1.27 | 1.27 |
MinimizeIPTablesRestore |
true |
GA | 1.28 | 1.29 |
MixedProtocolLBService |
false |
Alpha | 1.20 | 1.23 |
MixedProtocolLBService |
true |
Beta | 1.24 | 1.25 |
MixedProtocolLBService |
true |
GA | 1.26 | 1.27 |
MountContainers |
false |
Alpha | 1.9 | 1.16 |
MountContainers |
false |
Deprecated | 1.17 | 1.17 |
MountPropagation |
false |
Alpha | 1.8 | 1.9 |
MountPropagation |
true |
Beta | 1.10 | 1.11 |
MountPropagation |
true |
GA | 1.12 | 1.14 |
MultiCIDRRangeAllocator |
false |
Alpha | 1.25 | 1.28 |
NamespaceDefaultLabelName |
true |
Beta | 1.21 | 1.21 |
NamespaceDefaultLabelName |
true |
GA | 1.22 | 1.23 |
NetworkPolicyEndPort |
false |
Alpha | 1.21 | 1.21 |
NetworkPolicyEndPort |
true |
Beta | 1.22 | 1.24 |
NetworkPolicyEndPort |
true |
GA | 1.25 | 1.26 |
NetworkPolicyStatus |
false |
Alpha | 1.24 | 1.27 |
NewVolumeManagerReconstruction |
false |
Alpha | 1.25 | 1.26 |
NewVolumeManagerReconstruction |
true |
Beta | 1.27 | 1.29 |
NewVolumeManagerReconstruction |
true |
GA | 1.30 | 1.31 |
NodeDisruptionExclusion |
false |
Alpha | 1.16 | 1.18 |
NodeDisruptionExclusion |
true |
Beta | 1.19 | 1.20 |
NodeDisruptionExclusion |
true |
GA | 1.21 | 1.22 |
NodeLease |
false |
Alpha | 1.12 | 1.13 |
NodeLease |
true |
Beta | 1.14 | 1.16 |
NodeLease |
true |
GA | 1.17 | 1.23 |
NodeOutOfServiceVolumeDetach |
false |
Alpha | 1.24 | 1.25 |
NodeOutOfServiceVolumeDetach |
true |
Beta | 1.26 | 1.27 |
NodeOutOfServiceVolumeDetach |
true |
GA | 1.28 | 1.31 |
NonPreemptingPriority |
false |
Alpha | 1.15 | 1.18 |
NonPreemptingPriority |
true |
Beta | 1.19 | 1.23 |
NonPreemptingPriority |
true |
GA | 1.24 | 1.25 |
OpenAPIV3 |
false |
Alpha | 1.23 | 1.23 |
OpenAPIV3 |
true |
Beta | 1.24 | 1.26 |
OpenAPIV3 |
true |
GA | 1.27 | 1.28 |
PDBUnhealthyPodEvictionPolicy |
false |
Alpha | 1.26 | 1.26 |
PDBUnhealthyPodEvictionPolicy |
true |
Beta | 1.27 | 1.30 |
PDBUnhealthyPodEvictionPolicy |
true |
GA | 1.31 | 1.32 |
PersistentLocalVolumes |
false |
Alpha | 1.7 | 1.9 |
PersistentLocalVolumes |
true |
Beta | 1.10 | 1.13 |
PersistentLocalVolumes |
true |
GA | 1.14 | 1.16 |
PersistentVolumeLastPhaseTransitionTime |
false |
Alpha | 1.28 | 1.28 |
PersistentVolumeLastPhaseTransitionTime |
true |
Beta | 1.29 | 1.30 |
PersistentVolumeLastPhaseTransitionTime |
true |
GA | 1.31 | 1.32 |
PodAffinityNamespaceSelector |
false |
Alpha | 1.21 | 1.21 |
PodAffinityNamespaceSelector |
true |
Beta | 1.22 | 1.23 |
PodAffinityNamespaceSelector |
true |
GA | 1.24 | 1.25 |
PodDisruptionBudget |
false |
Alpha | 1.3 | 1.4 |
PodDisruptionBudget |
true |
Beta | 1.5 | 1.20 |
PodDisruptionBudget |
true |
GA | 1.21 | 1.25 |
PodDisruptionConditions |
false |
Alpha | 1.25 | 1.25 |
PodDisruptionConditions |
true |
Beta | 1.26 | 1.30 |
PodDisruptionConditions |
true |
GA | 1.31 | 1.33 |
PodHasNetworkCondition |
false |
Alpha | 1.25 | 1.27 |
PodHostIPs |
false |
Alpha | 1.28 | 1.28 |
PodHostIPs |
true |
Beta | 1.29 | 1.30 |
PodHostIPs |
true |
GA | 1.30 | 1.31 |
PodOverhead |
false |
Alpha | 1.16 | 1.17 |
PodOverhead |
true |
Beta | 1.18 | 1.23 |
PodOverhead |
true |
GA | 1.24 | 1.25 |
PodPriority |
false |
Alpha | 1.8 | 1.10 |
PodPriority |
true |
Beta | 1.11 | 1.13 |
PodPriority |
true |
GA | 1.14 | 1.18 |
PodReadinessGates |
false |
Alpha | 1.11 | 1.11 |
PodReadinessGates |
true |
Beta | 1.12 | 1.13 |
PodReadinessGates |
true |
GA | 1.14 | 1.16 |
PodSecurity |
false |
Alpha | 1.22 | 1.22 |
PodSecurity |
true |
Beta | 1.23 | 1.24 |
PodSecurity |
true |
GA | 1.25 | 1.27 |
PodShareProcessNamespace |
false |
Alpha | 1.10 | 1.11 |
PodShareProcessNamespace |
true |
Beta | 1.12 | 1.16 |
PodShareProcessNamespace |
true |
GA | 1.17 | 1.19 |
PreferNominatedNode |
false |
Alpha | 1.21 | 1.21 |
PreferNominatedNode |
true |
Beta | 1.22 | 1.23 |
PreferNominatedNode |
true |
GA | 1.24 | 1.25 |
ProbeTerminationGracePeriod |
false |
Alpha | 1.21 | 1.21 |
ProbeTerminationGracePeriod |
false |
Beta | 1.22 | 1.24 |
ProbeTerminationGracePeriod |
true |
Beta | 1.25 | 1.27 |
ProbeTerminationGracePeriod |
true |
GA | 1.28 | 1.28 |
ProxyTerminatingEndpoints |
false |
Alpha | 1.22 | 1.25 |
ProxyTerminatingEndpoints |
true |
Beta | 1.26 | 1.27 |
ProxyTerminatingEndpoints |
true |
GA | 1.28 | 1.29 |
PVCProtection |
false |
Alpha | 1.9 | 1.9 |
PVCProtection |
– | Deprecated | 1.10 | 1.10 |
ReadOnlyAPIDataVolumes |
true |
Beta | 1.8 | 1.9 |
ReadOnlyAPIDataVolumes |
– | GA | 1.10 | 1.10 |
ReadWriteOncePod |
false |
Alpha | 1.22 | 1.26 |
ReadWriteOncePod |
true |
Beta | 1.27 | 1.28 |
ReadWriteOncePod |
true |
GA | 1.29 | 1.30 |
RemainingItemCount |
false |
Alpha | 1.15 | 1.15 |
RemainingItemCount |
true |
Beta | 1.16 | 1.28 |
RemainingItemCount |
true |
GA | 1.29 | 1.32 |
RemoveSelfLink |
false |
Alpha | 1.16 | 1.19 |
RemoveSelfLink |
true |
Beta | 1.20 | 1.23 |
RemoveSelfLink |
true |
GA | 1.24 | 1.29 |
RequestManagement |
false |
Alpha | 1.15 | 1.16 |
RequestManagement |
– | Deprecated | 1.17 | 1.17 |
ResourceLimitsPriorityFunction |
false |
Alpha | 1.9 | 1.18 |
ResourceLimitsPriorityFunction |
– | Deprecated | 1.19 | 1.19 |
ResourceQuotaScopeSelectors |
false |
Alpha | 1.11 | 1.11 |
ResourceQuotaScopeSelectors |
true |
Beta | 1.12 | 1.16 |
ResourceQuotaScopeSelectors |
true |
GA | 1.17 | 1.18 |
RetroactiveDefaultStorageClass |
false |
Alpha | 1.25 | 1.25 |
RetroactiveDefaultStorageClass |
true |
Beta | 1.26 | 1.27 |
RetroactiveDefaultStorageClass |
true |
GA | 1.28 | 1.28 |
RootCAConfigMap |
false |
Alpha | 1.13 | 1.19 |
RootCAConfigMap |
true |
Beta | 1.20 | 1.20 |
RootCAConfigMap |
true |
GA | 1.21 | 1.22 |
RotateKubeletClientCertificate |
true |
Beta | 1.8 | 1.18 |
RotateKubeletClientCertificate |
true |
GA | 1.19 | 1.21 |
RunAsGroup |
true |
Beta | 1.14 | 1.20 |
RunAsGroup |
true |
GA | 1.21 | 1.22 |
RuntimeClass |
false |
Alpha | 1.12 | 1.13 |
RuntimeClass |
true |
Beta | 1.14 | 1.19 |
RuntimeClass |
true |
GA | 1.20 | 1.24 |
ScheduleDaemonSetPods |
false |
Alpha | 1.11 | 1.11 |
ScheduleDaemonSetPods |
true |
Beta | 1.12 | 1.16 |
ScheduleDaemonSetPods |
true |
GA | 1.17 | 1.18 |
SCTPSupport |
false |
Alpha | 1.12 | 1.18 |
SCTPSupport |
true |
Beta | 1.19 | 1.19 |
SCTPSupport |
true |
GA | 1.20 | 1.22 |
SeccompDefault |
false |
Alpha | 1.22 | 1.24 |
SeccompDefault |
true |
Beta | 1.25 | 1.26 |
SeccompDefault |
true |
GA | 1.27 | 1.28 |
SecurityContextDeny |
false |
Alpha | 1.27 | 1.29 |
SelectorIndex |
false |
Alpha | 1.18 | 1.18 |
SelectorIndex |
true |
Beta | 1.19 | 1.19 |
SelectorIndex |
true |
GA | 1.20 | 1.25 |
ServerSideApply |
false |
Alpha | 1.14 | 1.15 |
ServerSideApply |
true |
Beta | 1.16 | 1.21 |
ServerSideApply |
true |
GA | 1.22 | 1.31 |
ServerSideFieldValidation |
false |
Alpha | 1.23 | 1.24 |
ServerSideFieldValidation |
true |
Beta | 1.25 | 1.26 |
ServerSideFieldValidation |
true |
GA | 1.27 | 1.31 |
ServiceAccountIssuerDiscovery |
false |
Alpha | 1.18 | 1.19 |
ServiceAccountIssuerDiscovery |
true |
Beta | 1.20 | 1.20 |
ServiceAccountIssuerDiscovery |
true |
GA | 1.21 | 1.23 |
ServiceAppProtocol |
false |
Alpha | 1.18 | 1.18 |
ServiceAppProtocol |
true |
Beta | 1.19 | 1.19 |
ServiceAppProtocol |
true |
GA | 1.20 | 1.22 |
ServiceInternalTrafficPolicy |
false |
Alpha | 1.21 | 1.21 |
ServiceInternalTrafficPolicy |
true |
Beta | 1.22 | 1.25 |
ServiceInternalTrafficPolicy |
true |
GA | 1.26 | 1.27 |
ServiceIPStaticSubrange |
false |
Alpha | 1.24 | 1.24 |
ServiceIPStaticSubrange |
true |
Beta | 1.25 | 1.25 |
ServiceIPStaticSubrange |
true |
GA | 1.26 | 1.27 |
ServiceLBNodePortControl |
false |
Alpha | 1.20 | 1.21 |
ServiceLBNodePortControl |
true |
Beta | 1.22 | 1.23 |
ServiceLBNodePortControl |
true |
GA | 1.24 | 1.25 |
ServiceLoadBalancerClass |
false |
Alpha | 1.21 | 1.21 |
ServiceLoadBalancerClass |
true |
Beta | 1.22 | 1.23 |
ServiceLoadBalancerClass |
true |
GA | 1.24 | 1.25 |
ServiceLoadBalancerFinalizer |
false |
Alpha | 1.15 | 1.15 |
ServiceLoadBalancerFinalizer |
true |
Beta | 1.16 | 1.16 |
ServiceLoadBalancerFinalizer |
true |
GA | 1.17 | 1.20 |
ServiceNodeExclusion |
false |
Alpha | 1.8 | 1.18 |
ServiceNodeExclusion |
true |
Beta | 1.19 | 1.20 |
ServiceNodeExclusion |
true |
GA | 1.21 | 1.22 |
ServiceNodePortStaticSubrange |
false |
Alpha | 1.27 | 1.27 |
ServiceNodePortStaticSubrange |
true |
Beta | 1.28 | 1.28 |
ServiceNodePortStaticSubrange |
true |
GA | 1.29 | 1.30 |
ServiceTopology |
false |
Alpha | 1.17 | 1.19 |
ServiceTopology |
false |
Deprecated | 1.20 | 1.22 |
SetHostnameAsFQDN |
false |
Alpha | 1.19 | 1.19 |
SetHostnameAsFQDN |
true |
Beta | 1.20 | 1.21 |
SetHostnameAsFQDN |
true |
GA | 1.22 | 1.24 |
SkipReadOnlyValidationGCE |
false |
Alpha | 1.28 | 1.28 |
SkipReadOnlyValidationGCE |
true |
Deprecated | 1.29 | 1.30 |
StableLoadBalancerNodeSet |
true |
Beta | 1.27 | 1.29 |
StableLoadBalancerNodeSet |
true |
GA | 1.30 | 1.31 |
StartupProbe |
false |
Alpha | 1.16 | 1.17 |
StartupProbe |
true |
Beta | 1.18 | 1.19 |
StartupProbe |
true |
GA | 1.20 | 1.23 |
StatefulSetMinReadySeconds |
false |
Alpha | 1.22 | 1.22 |
StatefulSetMinReadySeconds |
true |
Beta | 1.23 | 1.24 |
StatefulSetMinReadySeconds |
true |
GA | 1.25 | 1.26 |
StorageObjectInUseProtection |
true |
Beta | 1.10 | 1.10 |
StorageObjectInUseProtection |
true |
GA | 1.11 | 1.24 |
StreamingProxyRedirects |
false |
Beta | 1.5 | 1.5 |
StreamingProxyRedirects |
true |
Beta | 1.6 | 1.17 |
StreamingProxyRedirects |
true |
Deprecated | 1.18 | 1.21 |
StreamingProxyRedirects |
false |
Deprecated | 1.22 | 1.24 |
SupportIPVSProxyMode |
false |
Alpha | 1.8 | 1.8 |
SupportIPVSProxyMode |
false |
Beta | 1.9 | 1.9 |
SupportIPVSProxyMode |
true |
Beta | 1.10 | 1.10 |
SupportIPVSProxyMode |
true |
GA | 1.11 | 1.20 |
SupportNodePidsLimit |
false |
Alpha | 1.14 | 1.14 |
SupportNodePidsLimit |
true |
Beta | 1.15 | 1.19 |
SupportNodePidsLimit |
true |
GA | 1.20 | 1.23 |
SupportPodPidsLimit |
false |
Alpha | 1.10 | 1.13 |
SupportPodPidsLimit |
true |
Beta | 1.14 | 1.19 |
SupportPodPidsLimit |
true |
GA | 1.20 | 1.23 |
SuspendJob |
false |
Alpha | 1.21 | 1.21 |
SuspendJob |
true |
Beta | 1.22 | 1.23 |
SuspendJob |
true |
GA | 1.24 | 1.25 |
Sysctls |
true |
Beta | 1.11 | 1.20 |
Sysctls |
true |
GA | 1.21 | 1.22 |
TaintBasedEvictions |
false |
Alpha | 1.6 | 1.12 |
TaintBasedEvictions |
true |
Beta | 1.13 | 1.17 |
TaintBasedEvictions |
true |
GA | 1.18 | 1.20 |
TaintNodesByCondition |
false |
Alpha | 1.8 | 1.11 |
TaintNodesByCondition |
true |
Beta | 1.12 | 1.16 |
TaintNodesByCondition |
true |
GA | 1.17 | 1.18 |
TokenRequest |
false |
Alpha | 1.10 | 1.11 |
TokenRequest |
true |
Beta | 1.12 | 1.19 |
TokenRequest |
true |
GA | 1.20 | 1.21 |
TokenRequestProjection |
false |
Alpha | 1.11 | 1.11 |
TokenRequestProjection |
true |
Beta | 1.12 | 1.19 |
TokenRequestProjection |
true |
GA | 1.20 | 1.21 |
TopologyManager |
false |
Alpha | 1.16 | 1.17 |
TopologyManager |
true |
Beta | 1.18 | 1.26 |
TopologyManager |
true |
GA | 1.27 | 1.28 |
TTLAfterFinished |
false |
Alpha | 1.12 | 1.20 |
TTLAfterFinished |
true |
Beta | 1.21 | 1.22 |
TTLAfterFinished |
true |
GA | 1.23 | 1.24 |
UserNamespacesStatelessPodsSupport |
false |
Alpha | 1.25 | 1.27 |
ValidateProxyRedirects |
false |
Alpha | 1.12 | 1.13 |
ValidateProxyRedirects |
true |
Beta | 1.14 | 1.21 |
ValidateProxyRedirects |
true |
Deprecated | 1.22 | 1.24 |
ValidatingAdmissionPolicy |
false |
Alpha | 1.26 | 1.27 |
ValidatingAdmissionPolicy |
false |
Beta | 1.28 | 1.29 |
ValidatingAdmissionPolicy |
true |
GA | 1.30 | 1.31 |
VolumeCapacityPriority |
false |
Alpha | 1.21 | 1.32 |
VolumePVCDataSource |
false |
Alpha | 1.15 | 1.15 |
VolumePVCDataSource |
true |
Beta | 1.16 | 1.17 |
VolumePVCDataSource |
true |
GA | 1.18 | 1.21 |
VolumeScheduling |
false |
Alpha | 1.9 | 1.9 |
VolumeScheduling |
true |
Beta | 1.10 | 1.12 |
VolumeScheduling |
true |
GA | 1.13 | 1.16 |
VolumeSnapshotDataSource |
false |
Alpha | 1.12 | 1.16 |
VolumeSnapshotDataSource |
true |
Beta | 1.17 | 1.19 |
VolumeSnapshotDataSource |
true |
GA | 1.20 | 1.22 |
VolumeSubpath |
true |
GA | 1.10 | 1.24 |
VolumeSubpathEnvExpansion |
false |
Alpha | 1.14 | 1.14 |
VolumeSubpathEnvExpansion |
true |
Beta | 1.15 | 1.16 |
VolumeSubpathEnvExpansion |
true |
GA | 1.17 | 1.24 |
WarningHeaders |
true |
Beta | 1.19 | 1.21 |
WarningHeaders |
true |
GA | 1.22 | 1.24 |
WatchBookmark |
false |
Alpha | 1.15 | 1.15 |
WatchBookmark |
true |
Beta | 1.16 | 1.16 |
WatchBookmark |
true |
GA | 1.17 | 1.32 |
WindowsEndpointSliceProxying |
false |
Alpha | 1.19 | 1.20 |
WindowsEndpointSliceProxying |
true |
Beta | 1.21 | 1.21 |
WindowsEndpointSliceProxying |
true |
GA | 1.22 | 1.24 |
WindowsGMSA |
false |
Alpha | 1.14 | 1.15 |
WindowsGMSA |
true |
Beta | 1.16 | 1.17 |
WindowsGMSA |
true |
GA | 1.18 | 1.18 |
WindowsHostProcessContainers |
false |
Alpha | 1.22 | 1.22 |
WindowsHostProcessContainers |
true |
Beta | 1.23 | 1.25 |
WindowsHostProcessContainers |
true |
GA | 1.26 | 1.27 |
WindowsRunAsUserName |
false |
Alpha | 1.16 | 1.16 |
WindowsRunAsUserName |
true |
Beta | 1.17 | 1.17 |
WindowsRunAsUserName |
true |
GA | 1.18 | 1.20 |
ZeroLimitedNominalConcurrencyShares |
false |
Beta | 1.29 | 1.29 |
ZeroLimitedNominalConcurrencyShares |
true |
GA | 1.30 | 1.31 |
Descriptions for removed feature gates
AcceleratorsProvided an early form of plugin to enable Nvidia GPU support when using Docker Engine; no longer available. See Device Plugins for an alternative.
AdmissionWebhookMatchConditionsEnable match conditions on mutating & validating admission webhooks.
AdvancedAuditingEnable advanced auditing
AffinityInAnnotationsEnable setting Pod affinity or anti-affinity.
AggregatedDiscoveryEndpointEnable a single HTTP endpoint
/discovery/<version>which supports native HTTP caching with ETags containing all APIResources known to the API server.AllowExtTrafficLocalEndpointsEnable a service to route external requests to node local endpoints.
AllowInsecureBackendProxyEnable the users to skip TLS verification of kubelets on Pod log requests.
APIListChunkingEnable the API clients to retrieve (
LISTorGET) resources from API server in chunks.APIPriorityAndFairnessEnable managing request concurrency with prioritization and fairness at each server. (Renamed from
RequestManagement)APISelfSubjectReviewActivate the
SelfSubjectReviewAPI which allows users to see the requesting subject's authentication information. See API access to authentication information for a client for more details.AppArmorEnable use of AppArmor mandatory access control for Pods running on Linux nodes. See AppArmor Tutorial for more details.
AppArmorFieldsEnable AppArmor related security context settings.
For more information about AppArmor and Kubernetes, read the AppArmor section within security features in the Linux kernel.
AttachVolumeLimitEnable volume plugins to report limits on number of volumes that can be attached to a node. See dynamic volume limits for more details.
BalanceAttachedNodeVolumesInclude volume count on node to be considered for balanced resource allocation while scheduling. A node which has closer CPU, memory utilization, and volume count is favored by the scheduler while making decisions.
BlockVolumeEnable the definition and consumption of raw block devices in Pods. See Raw Block Volume Support for more details.
BoundServiceAccountTokenVolumeMigrate ServiceAccount volumes to use a projected volume consisting of a ServiceAccountTokenVolumeProjection. Cluster admins can use metric
serviceaccount_stale_tokens_totalto monitor workloads that are depending on the extended tokens. If there are no such workloads, turn off extended tokens by startingkube-apiserverwith flag--service-account-extend-token-expiration=false.Check Bound Service Account Tokens for more details.
CloudDualStackNodeIPsEnables dual-stack
kubelet --node-ipwith external cloud providers. See Configure IPv4/IPv6 dual-stack for more details.ConfigurableFSGroupPolicyAllows user to configure volume permission change policy for fsGroups when mounting a volume in a Pod. See Configure volume permission and ownership change policy for Pods for more details.
ConsistentHTTPGetHandlersNormalize HTTP get URL and Header passing for lifecycle handlers with probers.
ControllerManagerLeaderMigrationEnables Leader Migration for kube-controller-manager and cloud-controller-manager which allows a cluster operator to live migrate controllers from the kube-controller-manager into an external controller-manager (e.g. the cloud-controller-manager) in an HA cluster without downtime.
CPUManagerEnable container level CPU affinity support, see CPU Management Policies.
CRIContainerLogRotationEnable container log rotation for CRI container runtime. The default max size of a log file is 10MB and the default max number of log files allowed for a container is 5. These values can be configured in the kubelet config. See logging at node level for more details.
CronJobControllerV2Use an alternative implementation of the CronJob controller. Otherwise, version 1 of the same controller is selected.
CronJobTimeZoneAllow the use of the
timeZoneoptional field in CronJobsCSIBlockVolumeEnable external CSI volume drivers to support block storage. See
csiraw block volume support for more details.CSIDriverRegistryEnable all logic related to the CSIDriver API object in
csi.storage.k8s.io.CSIInlineVolumeEnable CSI Inline volumes support for pods.
CSIMigrationEnables shims and translation logic to route volume operations from in-tree plugins to corresponding pre-installed CSI plugins
CSIMigrationAWSEnables shims and translation logic to route volume operations from the AWS-EBS in-tree plugin to EBS CSI plugin. Supports falling back to in-tree EBS plugin for mount operations to nodes that have the feature disabled or that do not have EBS CSI plugin installed and configured. Does not support falling back for provision operations, for those the CSI plugin must be installed and configured.
CSIMigrationAWSCompleteStops registering the EBS in-tree plugin in kubelet and volume controllers and enables shims and translation logic to route volume operations from the AWS-EBS in-tree plugin to EBS CSI plugin. Requires CSIMigration and CSIMigrationAWS feature flags enabled and EBS CSI plugin installed and configured on all nodes in the cluster. This flag has been deprecated in favor of the
InTreePluginAWSUnregisterfeature flag which prevents the registration of in-tree EBS plugin.CSIMigrationAzureDiskEnables shims and translation logic to route volume operations from the Azure-Disk in-tree plugin to AzureDisk CSI plugin. Supports falling back to in-tree AzureDisk plugin for mount operations to nodes that have the feature disabled or that do not have AzureDisk CSI plugin installed and configured. Does not support falling back for provision operations, for those the CSI plugin must be installed and configured. Requires CSIMigration feature flag enabled.
CSIMigrationAzureDiskCompleteStops registering the Azure-Disk in-tree plugin in kubelet and volume controllers and enables shims and translation logic to route volume operations from the Azure-Disk in-tree plugin to AzureDisk CSI plugin. Requires CSIMigration and CSIMigrationAzureDisk feature flags enabled and AzureDisk CSI plugin installed and configured on all nodes in the cluster. This flag has been deprecated in favor of the
InTreePluginAzureDiskUnregisterfeature flag which prevents the registration of in-tree AzureDisk plugin.CSIMigrationAzureFileEnables shims and translation logic to route volume operations from the Azure-File in-tree plugin to AzureFile CSI plugin. Supports falling back to in-tree AzureFile plugin for mount operations to nodes that have the feature disabled or that do not have AzureFile CSI plugin installed and configured. Does not support falling back for provision operations, for those the CSI plugin must be installed and configured. Requires CSIMigration feature flag enabled.
CSIMigrationAzureFileCompleteStops registering the Azure-File in-tree plugin in kubelet and volume controllers and enables shims and translation logic to route volume operations from the Azure-File in-tree plugin to AzureFile CSI plugin. Requires CSIMigration and CSIMigrationAzureFile feature flags enabled and AzureFile CSI plugin installed and configured on all nodes in the cluster. This flag has been deprecated in favor of the
InTreePluginAzureFileUnregisterfeature flag which prevents the registration of in-tree AzureFile plugin.CSIMigrationGCEEnables shims and translation logic to route volume operations from the GCE-PD in-tree plugin to PD CSI plugin. Supports falling back to in-tree GCE plugin for mount operations to nodes that have the feature disabled or that do not have PD CSI plugin installed and configured. Does not support falling back for provision operations, for those the CSI plugin must be installed and configured. Requires CSIMigration feature flag enabled.
CSIMigrationGCECompleteStops registering the GCE-PD in-tree plugin in kubelet and volume controllers and enables shims and translation logic to route volume operations from the GCE-PD in-tree plugin to PD CSI plugin. Requires CSIMigration and CSIMigrationGCE feature flags enabled and PD CSI plugin installed and configured on all nodes in the cluster. This flag has been deprecated in favor of the
InTreePluginGCEUnregisterfeature flag which prevents the registration of in-tree GCE PD plugin.CSIMigrationOpenStackEnables shims and translation logic to route volume operations from the Cinder in-tree plugin to Cinder CSI plugin. Supports falling back to in-tree Cinder plugin for mount operations to nodes that have the feature disabled or that do not have Cinder CSI plugin installed and configured. Does not support falling back for provision operations, for those the CSI plugin must be installed and configured. Requires CSIMigration feature flag enabled.
CSIMigrationOpenStackCompleteStops registering the Cinder in-tree plugin in kubelet and volume controllers and enables shims and translation logic to route volume operations from the Cinder in-tree plugin to Cinder CSI plugin. Requires CSIMigration and CSIMigrationOpenStack feature flags enabled and Cinder CSI plugin installed and configured on all nodes in the cluster. This flag has been deprecated in favor of the
InTreePluginOpenStackUnregisterfeature flag which prevents the registration of in-tree openstack cinder plugin.CSIMigrationRBDEnables shims and translation logic to route volume operations from the RBD in-tree plugin to Ceph RBD CSI plugin. Requires CSIMigration and csiMigrationRBD feature flags enabled and Ceph CSI plugin installed and configured in the cluster.
This feature gate was deprecated in favor of the
InTreePluginRBDUnregisterfeature gate, which prevents the registration of in-tree RBD plugin.CSIMigrationvSphereEnables shims and translation logic to route volume operations from the vSphere in-tree plugin to vSphere CSI plugin. Supports falling back to in-tree vSphere plugin for mount operations to nodes that have the feature disabled or that do not have vSphere CSI plugin installed and configured. Does not support falling back for provision operations, for those the CSI plugin must be installed and configured. Requires CSIMigration feature flag enabled.
CSIMigrationvSphereCompleteStops registering the vSphere in-tree plugin in kubelet and volume controllers and enables shims and translation logic to route volume operations from the vSphere in-tree plugin to vSphere CSI plugin. Requires CSIMigration and CSIMigrationvSphere feature flags enabled and vSphere CSI plugin installed and configured on all nodes in the cluster. This flag has been deprecated in favor of the
InTreePluginvSphereUnregisterfeature flag which prevents the registration of in-tree vsphere plugin.CSINodeExpandSecretEnable passing secret authentication data to a CSI driver for use during a
NodeExpandVolumeCSI operation.CSINodeInfoEnable all logic related to the CSINodeInfo API object in
csi.storage.k8s.io.CSIPersistentVolumeEnable discovering and mounting volumes provisioned through a CSI (Container Storage Interface) compatible volume plugin.
CSIServiceAccountTokenEnable CSI drivers to receive the pods' service account token that they mount volumes for. See Token Requests.
CSIStorageCapacityEnables CSI drivers to publish storage capacity information and the Kubernetes scheduler to use that information when scheduling pods. See Storage Capacity. Check the
csivolume type documentation for more details.CSIVolumeFSGroupPolicyAllows CSIDrivers to use the
fsGroupPolicyfield. This field controls whether volumes created by a CSIDriver support volume ownership and permission modifications when these volumes are mounted.CSRDurationAllows clients to request a duration for certificates issued via the Kubernetes CSR API.
CustomPodDNSEnable customizing the DNS settings for a Pod using its
dnsConfigproperty. Check Pod's DNS Config for more details.CustomResourceDefaultingEnable CRD support for default values in OpenAPI v3 validation schemas.
CustomResourcePublishOpenAPIEnables publishing of CRD OpenAPI specs.
CustomResourceSubresourcesEnable
/statusand/scalesubresources on resources created from CustomResourceDefinition.CustomResourceValidationEnable schema based validation on resources created from CustomResourceDefinition.
CustomResourceValidationExpressionsEnable expression language validation in CRD which will validate customer resource based on validation rules written in the
x-kubernetes-validationsextension.CustomResourceWebhookConversionEnable webhook-based conversion on resources created from CustomResourceDefinition.
DaemonSetUpdateSurgeEnables the DaemonSet workloads to maintain availability during update per node. See Perform a Rolling Update on a DaemonSet.
DefaultHostNetworkHostPortsInPodTemplatesThis feature gate controls the point at which a default value for
.spec.containers[*].ports[*].hostPortis assigned, for Pods usinghostNetwork: true. The default since Kubernetes v1.28 is to only set a default value in Pods.Enabling this means a default will be assigned even to the
.specof an embedded PodTemplate (for example, in a Deployment), which is the way that older releases of Kubernetes worked. You should migrate your code so that it does not rely on the legacy behavior.DefaultPodTopologySpreadEnables the use of
PodTopologySpreadscheduling plugin to do default spreading.DelegateFSGroupToCSIDriverIf supported by the CSI driver, delegates the role of applying
fsGroupfrom a Pod'ssecurityContextto the driver by passingfsGroupthrough the NodeStageVolume and NodePublishVolume CSI calls.DevicePluginCDIDevicesEnable support to CDI device IDs in the Device Plugin API.
DevicePluginsEnable the device-plugins based resource provisioning on nodes.
DisableAcceleratorUsageMetricsDisableCloudProvidersEnabling this feature gate deactivated functionality in
kube-apiserver,kube-controller-managerandkubeletthat related to the--cloud-providercommand line argument.In Kubernetes v1.31 and later, the only valid values for
--cloud-providerare the empty string (no cloud provider integration), or "external" (integration via a separate cloud-controller-manager).DisableKubeletCloudCredentialProvidersEnabling the feature gate deactivated the legacy in-tree functionality within the kubelet, that allowed the kubelet to to authenticate to a cloud provider container registry for container image pulls.
DownwardAPIHugePagesEnables usage of hugepages in downward API.
DRAControlPlaneControllerEnables support for resources with custom parameters and a lifecycle that is independent of a Pod. Allocation of resources is handled by a resource driver's control plane controller.
DryRunEnable server-side dry run requests so that validation, merging, and mutation can be tested without committing.
DynamicAuditingUsed to enable dynamic auditing before v1.19.
DynamicKubeletConfigEnable the dynamic configuration of kubelet. The feature is no longer supported outside of supported skew policy. The feature gate was removed from kubelet in 1.24.
DynamicProvisioningSchedulingExtend the default scheduler to be aware of volume topology and handle PV provisioning. This feature was superseded by the
VolumeSchedulingfeature in v1.12.DynamicVolumeProvisioningEnable the dynamic provisioning of persistent volumes to Pods.
EfficientWatchResumptionAllows for storage-originated bookmark (progress notify) events to be delivered to the users. This is only applied to watch operations.
EnableAggregatedDiscoveryTimeoutEnable the five second timeout on aggregated discovery calls.
EnableEquivalenceClassCacheEnable the scheduler to cache equivalence of nodes when scheduling Pods.
EndpointSliceEnables EndpointSlices for more scalable and extensible network endpoints. See Enabling EndpointSlices.
EndpointSliceNodeNameEnables EndpointSlice
nodeNamefield.EndpointSliceProxyingWhen enabled, kube-proxy running on Linux will use EndpointSlices as the primary data source instead of Endpoints, enabling scalability and performance improvements. See Enabling Endpoint Slices.
EndpointSliceTerminatingConditionEnables EndpointSlice
terminatingandservingcondition fields.EphemeralContainersEnable the ability to add ephemeral containers to running Pods.
EvenPodsSpreadEnable pods to be scheduled evenly across topology domains. See Pod Topology Spread Constraints.
ExpandCSIVolumesEnable the expanding of CSI volumes.
ExpandedDNSConfigEnable kubelet and kube-apiserver to allow more DNS search paths and longer list of DNS search paths. This feature requires container runtime support(Containerd: v1.5.6 or higher, CRI-O: v1.22 or higher). See Expanded DNS Configuration.
ExpandInUsePersistentVolumesEnable expanding in-use PVCs. See Resizing an in-use PersistentVolumeClaim.
ExpandPersistentVolumesEnable the expanding of persistent volumes. See Expanding Persistent Volumes Claims.
ExperimentalCriticalPodAnnotationEnable annotating specific pods as critical so that their scheduling is guaranteed. This feature is deprecated by Pod Priority and Preemption as of v1.13.
ExperimentalHostUserNamespaceDefaultingEnabling the defaulting user namespace to host. This is for containers that are using other host namespaces, host mounts, or containers that are privileged or using specific non-namespaced capabilities (e.g.
MKNODE,SYS_MODULEetc.). This should only be enabled if user namespace remapping is enabled in the Docker daemon.ExternalPolicyForExternalIPFix a bug where ExternalTrafficPolicy is not applied to Service ExternalIPs.
GCERegionalPersistentDiskEnable the regional PD feature on GCE.
GenericEphemeralVolumeEnables ephemeral, inline volumes that support all features of normal volumes (can be provided by third-party storage vendors, storage capacity tracking, restore from snapshot, etc.). See Ephemeral Volumes.
GRPCContainerProbeEnables the gRPC probe method for {Liveness,Readiness,Startup}Probe. See Configure Liveness, Readiness and Startup Probes.
HPAContainerMetricsAllow HorizontalPodAutoscalers to scale based on metrics from individual containers within target pods.
HugePagesEnable the allocation and consumption of pre-allocated huge pages.
HugePageStorageMediumSizeEnable support for multiple sizes pre-allocated huge pages.
HyperVContainerEnable Hyper-V isolation for Windows containers.
IdentifyPodOSAllows the Pod OS field to be specified. This helps in identifying the OS of the pod authoritatively during the API server admission time.
ImmutableEphemeralVolumesAllows for marking individual Secrets and ConfigMaps as immutable for better safety and performance.
IndexedJobAllows the Job controller to manage Pod completions per completion index.
IngressClassNamespacedParamsAllow namespace-scoped parameters reference in
IngressClassresource. This feature adds two fields -ScopeandNamespacetoIngressClass.spec.parameters.InitializersAllow asynchronous coordination of object creation using the Initializers admission plugin.
InTreePluginAWSUnregisterStops registering the aws-ebs in-tree plugin in kubelet and volume controllers.
InTreePluginAzureDiskUnregisterStops registering the azuredisk in-tree plugin in kubelet and volume controllers.
InTreePluginAzureFileUnregisterStops registering the azurefile in-tree plugin in kubelet and volume controllers.
InTreePluginGCEUnregisterStops registering the gce-pd in-tree plugin in kubelet and volume controllers.
InTreePluginOpenStackUnregisterStops registering the OpenStack cinder in-tree plugin in kubelet and volume controllers.
InTreePluginRBDUnregisterStops registering the RBD in-tree plugin within kubelet and volume controllers.
InTreePluginvSphereUnregisterStops registering the vSphere in-tree plugin in kubelet and volume controllers.
IPTablesOwnershipCleanupThis causes kubelet to no longer create legacy iptables rules.
IPv6DualStackEnable dual stack support for IPv6.
JobMutableNodeSchedulingDirectivesAllows updating node scheduling directives in the pod template of Job.
JobPodFailurePolicyAllow users to specify handling of pod failures based on container exit codes and pod conditions.
JobReadyPodsEnables tracking the number of Pods that have a
Readycondition. The count ofReadypods is recorded in the status of a Job status.JobTrackingWithFinalizersEnables tracking Job completions without relying on Pods remaining in the cluster indefinitely. The Job controller uses Pod finalizers and a field in the Job status to keep track of the finished Pods to count towards completion.
KMSv2Enables KMS v2 API for encryption at rest. See Using a KMS Provider for data encryption for more details.
KMSv2KDFEnables KMS v2 to generate single use data encryption keys. See Using a KMS Provider for data encryption for more details. If the
KMSv2feature gate is not enabled in your cluster, the value of theKMSv2KDFfeature gate has no effect.KubeletConfigFileEnable loading kubelet configuration from a file specified using a config file. See setting kubelet parameters via a config file for more details.
KubeletCredentialProvidersEnable kubelet exec credential providers for image pull credentials.
KubeletPluginsWatcherEnable probe-based plugin watcher utility to enable kubelet to discover plugins such as CSI volume drivers.
KubeletPodResourcesEnable the kubelet's pod resources gRPC endpoint. See Support Device Monitoring for more details.
KubeletPodResourcesGetAllocatableEnable the kubelet's pod resources
GetAllocatableResourcesfunctionality. This API augments the resource allocation reportingKubeProxyDrainingTerminatingNodesImplement connection draining for terminating nodes for
externalTrafficPolicy: Clusterservices.LegacyNodeRoleBehaviorWhen disabled, legacy behavior in service load balancers and node disruption will ignore the
node-role.kubernetes.io/masterlabel in favor of the feature-specific labels provided byNodeDisruptionExclusionandServiceNodeExclusion.LegacyServiceAccountTokenCleanUpEnable cleaning up Secret-based service account tokens when they are not used in a specified time (default to be one year).
LegacyServiceAccountTokenNoAutoGenerationStop auto-generation of Secret-based service account tokens.
LegacyServiceAccountTokenTrackingTrack usage of Secret-based service account tokens.
LocalStorageCapacityIsolationEnable the consumption of local ephemeral storage and also the
sizeLimitproperty of an emptyDir volume.MinDomainsInPodTopologySpreadEnable
minDomainsin Pod topology spread constraints.MinimizeIPTablesRestoreEnables new performance improvement logics in the kube-proxy iptables mode.
MixedProtocolLBServiceEnable using different protocols in the same
LoadBalancertype Service instance.MountContainersEnable using utility containers on host as the volume mounter.
MountPropagationEnable sharing volume mounted by one container to other containers or pods. For more details, please see mount propagation.
MultiCIDRRangeAllocatorEnables the MultiCIDR range allocator.
NamespaceDefaultLabelNameConfigure the API Server to set an immutable label
kubernetes.io/metadata.nameon all namespaces, containing the namespace name.NetworkPolicyEndPortAllows you to define ports in a NetworkPolicy rule as a range of port numbers.
NetworkPolicyStatusEnable the
statussubresource for NetworkPolicy objects.NewVolumeManagerReconstructionEnables improved discovery of mounted volumes during kubelet startup. Since the associated code had been significantly refactored, Kubernetes versions 1.25 to 1.29 allowed you to opt-out in case the kubelet got stuck at the startup, or did not unmount volumes from terminated Pods.
This refactoring was behind the
SELinuxMountReadWriteOncePodfeature gate in Kubernetes releases 1.25 and 1.26.NodeDisruptionExclusionEnable use of the Node label
node.kubernetes.io/exclude-disruptionwhich prevents nodes from being evacuated during zone failures.NodeLeaseEnable the new Lease API to report node heartbeats, which could be used as a node health signal.
NodeOutOfServiceVolumeDetachWhen a Node is marked out-of-service using the
node.kubernetes.io/out-of-servicetaint, Pods on the node will be forcefully deleted if they can not tolerate this taint, and the volume detach operations for Pods terminating on the node will happen immediately. The deleted Pods can recover quickly on different nodes.NonPreemptingPriorityEnable
preemptionPolicyfield for PriorityClass and Pod.OpenAPIV3Enables the API server to publish OpenAPI v3.
PDBUnhealthyPodEvictionPolicyEnables the
unhealthyPodEvictionPolicyfield of aPodDisruptionBudget. This specifies when unhealthy pods should be considered for eviction. Please see Unhealthy Pod Eviction Policy for more details.PersistentLocalVolumesEnable the usage of
localvolume type in Pods. Pod affinity has to be specified if requesting alocalvolume.PersistentVolumeLastPhaseTransitionTimeAdds a new field to PersistentVolume which holds a timestamp of when the volume last transitioned its phase.
PodAffinityNamespaceSelectorEnable the Pod Affinity Namespace Selector and CrossNamespacePodAffinity quota scope features.
PodDisruptionBudgetEnable the PodDisruptionBudget feature.
PodDisruptionConditionsEnabled support for appending a dedicated pod condition indicating that the pod is being deleted due to a disruption.
PodHasNetworkConditionEnable the kubelet to mark the PodHasNetwork condition on pods. This was renamed to
PodReadyToStartContainersConditionin 1.28.PodHostIPsEnable the
status.hostIPsfield for pods and the downward API. The field lets you expose host IP addresses to workloads.PodOverheadEnable the PodOverhead feature to account for pod overheads.
PodPriorityEnable the descheduling and preemption of Pods based on their priorities.
PodReadinessGatesEnable the setting of
PodReadinessGatefield for extending Pod readiness evaluation. See Pod readiness gate for more details.PodSecurityEnables the
PodSecurityadmission plugin.Enable the setting of
shareProcessNamespacein a Pod for sharing a single process namespace between containers running in a pod. More details can be found in Share Process Namespace between Containers in a Pod.PreferNominatedNodeThis flag tells the scheduler whether the nominated nodes will be checked first before looping through all the other nodes in the cluster.
ProbeTerminationGracePeriodEnable setting probe-level
terminationGracePeriodSecondson pods. See the enhancement proposal for more details.ProxyTerminatingEndpointsEnable the kube-proxy to handle terminating endpoints when
ExternalTrafficPolicy=Local.PVCProtectionEnable the prevention of a PersistentVolumeClaim (PVC) from being deleted when it is still used by any Pod.
ReadOnlyAPIDataVolumesSet
configMap,secret,downwardAPIandprojectedvolumes to be mounted read-only.Since Kubernetes v1.10, these volume types are always read-only and you cannot opt out.
ReadWriteOncePodEnables the usage of
ReadWriteOncePodPersistentVolume access mode.RemainingItemCountAllow the API servers to show a count of remaining items in the response to a chunking list request.
RemoveSelfLinkSets the
.metadata.selfLinkfield to blank (empty string) for all objects and collections. This field has been deprecated since the Kubernetes v1.16 release. When this feature is enabled, the.metadata.selfLinkfield remains part of the Kubernetes API, but is always unset.RequestManagementEnables managing request concurrency with prioritization and fairness at each API server. Deprecated by
APIPriorityAndFairnesssince 1.17.ResourceLimitsPriorityFunctionEnable a scheduler priority function that assigns a lowest possible score of 1 to a node that satisfies at least one of the input Pod's cpu and memory limits. The intent is to break ties between nodes with same scores.
ResourceQuotaScopeSelectorsEnable resource quota scope selectors.
RetroactiveDefaultStorageClassAllow assigning StorageClass to unbound PVCs retroactively.
RootCAConfigMapConfigure the
kube-controller-managerto publish a ConfigMap namedkube-root-ca.crtto every namespace. This ConfigMap contains a CA bundle used for verifying connections to the kube-apiserver. See Bound Service Account Tokens for more details.RotateKubeletClientCertificateEnable the rotation of the client TLS certificate on the kubelet. See kubelet configuration for more details.
RunAsGroupEnable control over the primary group ID set on the init processes of containers.
RuntimeClassEnable the RuntimeClass feature for selecting container runtime configurations.
ScheduleDaemonSetPodsEnable DaemonSet Pods to be scheduled by the default scheduler instead of the DaemonSet controller.
SCTPSupportEnables the SCTP
protocolvalue in Pod, Service, Endpoints, EndpointSlice, and NetworkPolicy definitions.SeccompDefaultEnables the use of
RuntimeDefaultas the default seccomp profile for all workloads. The seccomp profile is specified in thesecurityContextof a Pod and/or a Container.SecurityContextDenyThis gate signals that the
SecurityContextDenyadmission controller is deprecated.SelectorIndexAllows label and field based indexes in API server watch cache to accelerate list operations.
ServerSideApplyEnables the Sever Side Apply (SSA) feature on the API Server.
ServerSideFieldValidationEnables server-side field validation. This means the validation of resource schema is performed at the API server side rather than the client side (for example, the
kubectl createorkubectl applycommand line).ServiceAccountIssuerDiscoveryEnable OIDC discovery endpoints (issuer and JWKS URLs) for the service account issuer in the API server. See Configure Service Accounts for Pods for more details.
ServiceAppProtocolEnables the
appProtocolfield on Services and Endpoints.ServiceInternalTrafficPolicyEnables the
internalTrafficPolicyfield on ServicesServiceIPStaticSubrangeEnables a strategy for Services ClusterIP allocations, whereby the ClusterIP range is subdivided. Dynamic allocated ClusterIP addresses will be allocated preferently from the upper range allowing users to assign static ClusterIPs from the lower range with a low risk of collision. See Avoiding collisions for more details.
ServiceLBNodePortControlEnables the
allocateLoadBalancerNodePortsfield on Services.ServiceLoadBalancerClassEnables the
loadBalancerClassfield on Services. See Specifying class of load balancer implementation for more details.ServiceLoadBalancerFinalizerEnable finalizer protection for Service load balancers.
ServiceNodeExclusionEnable the exclusion of nodes from load balancers created by a cloud provider. A node is eligible for exclusion if labelled with "
node.kubernetes.io/exclude-from-external-load-balancers".ServiceNodePortStaticSubrangeEnables the use of different port allocation strategies for NodePort Services. For more details, see reserve NodePort ranges to avoid collisions.
ServiceTopologyEnable service to route traffic based upon the Node topology of the cluster.
SetHostnameAsFQDNEnable the ability of setting Fully Qualified Domain Name(FQDN) as the hostname of a pod. See Pod's
setHostnameAsFQDNfield.SkipReadOnlyValidationGCESkip validation that GCE PersistentDisk volumes are in read-only mode.
StableLoadBalancerNodeSetEnables less load balancer re-configurations by the service controller (KCCM) as an effect of changing node state.
StartupProbeEnable the startup probe in the kubelet.
StatefulSetMinReadySecondsAllows
minReadySecondsto be respected by the StatefulSet controller.StorageObjectInUseProtectionPostpone the deletion of PersistentVolume or PersistentVolumeClaim objects if they are still being used.
StreamingProxyRedirectsInstructs the API server to intercept (and follow) redirects from the backend (kubelet) for streaming requests. Examples of streaming requests include the
exec,attachandport-forwardrequests.SupportIPVSProxyModeEnable providing in-cluster service load balancing using IPVS. See service proxies for more details.
SupportNodePidsLimitEnable the support to limiting PIDs on the Node. The parameter
pid=<number>in the--system-reservedand--kube-reservedoptions can be specified to ensure that the specified number of process IDs will be reserved for the system as a whole and for Kubernetes system daemons respectively.SupportPodPidsLimitEnable the support to limiting PIDs in Pods.
SuspendJobEnable support to suspend and resume Jobs. For more details, see the Jobs docs.
SysctlsEnable support for namespaced kernel parameters (sysctls) that can be set for each pod. See sysctls for more details.
TaintBasedEvictionsEnable evicting pods from nodes based on taints on Nodes and tolerations on Pods. See taints and tolerations for more details.
TaintNodesByConditionEnable automatic tainting nodes based on node conditions.
TokenRequestEnable the
TokenRequestendpoint on service account resources.TokenRequestProjectionEnable the injection of service account tokens into a Pod through a
projectedvolume.TopologyManagerEnable a mechanism to coordinate fine-grained hardware resource assignments for different components in Kubernetes. See Control Topology Management Policies on a node.
TTLAfterFinishedAllow a TTL controller to clean up resources after they finish execution.
UserNamespacesStatelessPodsSupportEnable user namespace support for stateless Pods. This feature gate was superseded by the
UserNamespacesSupportfeature gate in the Kubernetes v1.28 release.ValidateProxyRedirectsThis flag controls whether the API server should validate that redirects are only followed to the same host. Only used if the
StreamingProxyRedirectsflag is enabled.ValidatingAdmissionPolicyEnable ValidatingAdmissionPolicy support for CEL validations be used in Admission Control.
VolumeCapacityPriorityEnable support for prioritizing nodes in different topologies based on available PV capacity. This feature is renamed to
StorageCapacityScoringin v1.33.VolumePVCDataSourceEnable support for specifying an existing PVC as a DataSource.
VolumeSchedulingEnable volume topology aware scheduling and make the PersistentVolumeClaim (PVC) binding aware of scheduling decisions. It also enables the usage of
localvolume type when used together with thePersistentLocalVolumesfeature gate.VolumeSnapshotDataSourceEnable volume snapshot data source support.
VolumeSubpathAllow mounting a subpath of a volume in a container.
VolumeSubpathEnvExpansionEnable
subPathExprfield for expanding environment variables into asubPath.WarningHeadersAllow sending warning headers in API responses.
WatchBookmarkEnable support for watch bookmark events.
WindowsEndpointSliceProxyingWhen enabled, kube-proxy running on Windows will use EndpointSlices as the primary data source instead of Endpoints, enabling scalability and performance improvements. See Enabling Endpoint Slices.
WindowsGMSAEnables passing of GMSA credential specs from pods to container runtimes.
WindowsHostProcessContainersEnables support for Windows HostProcess containers.
WindowsRunAsUserNameEnable support for running applications in Windows containers with as a non-default user. See Configuring RunAsUserName for more details.
Allow priority & fairness in the API server to use a zero value for the
nominalConcurrencySharesfield of thelimitedsection of a priority level.