From 2fdf76879658979efd2f0b8d29a8cfde3cdd1a46 Mon Sep 17 00:00:00 2001 From: Idryss Bourdier Date: Tue, 11 Aug 2026 12:36:21 +0200 Subject: [PATCH] Add HIP: Check Kubernetes feature gates with a new flag in Chart Propose a new kubeFeatureGates flag that allow fine-tuned, per component, check on each required k8s feature gates to be able to upgrade/install a chart. Signed-off-by: Idryss Bourdier --- hips/hip-9999.md | 58 ++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 58 insertions(+) create mode 100644 hips/hip-9999.md diff --git a/hips/hip-9999.md b/hips/hip-9999.md new file mode 100644 index 00000000..bb0abeca --- /dev/null +++ b/hips/hip-9999.md @@ -0,0 +1,58 @@ +--- +hip: 9999 +title: "Check Kubernetes feature gates with a new flag in Chart" +authors: [ "Idryss Bourdier " ] +created: "2026-08-11" +type: "feature" +status: "draft" +--- + +## Abstract + +This proposal aims to resolve issue [31432](https://github.com/helm/helm/issues/31432), offering a way to check each Kubernetes feature gates within Chart.yaml. This is an extra layer of compatibility between a Chart and a cluster, on top of the `kubeVersion` field. When a Chart is installed or upgraded, it will poll the k8s cluster for its feature gates, either per components and per nodes or per a representative node. If a feature gate required isn't activated on the component as declared in Chart.yaml, the installation/upgrade will fail. + +## Motivation + +There is currently no existing mecanism in Helm that allow polling to Kubernetes before CRDs installation and during installation/upgrade. Moreover, there is no mecanism in place that checks feature gates. + +## Specification + +Adding a new field in Chart.yaml similar to this format: +```yaml +kubeFeatureGatesPolling: representative #could also be a choice between representative, per nodes, node-name specific, etc +kubeFeatureGates: + kubelet: + SidecarContainers: true + apiserver: + ConstrainedImpersonation: true + scheduler: + ComponentFlagz: false +``` + +## Backwards compatibility + +Fully backward compatible. + +## Security implications + +Since we allow Helm to poll Kubernetes components, we have to sanitize any input and output plus securize the channel. Also, we need to ensure that the Helm operator that is executing the k8s commands on the cluster have the rights to access required Kubernetes components. + +## How to teach this + +This new field is opt-in and not used by default. It will be added to the documentation if implemented, with a guide on how to use this new feature. + +## Reference implementation + +There is a pending PR on Helm repo ; [feat(action): add KubeFeatureGates field in Chart definition to check against k8s feature gates](https://github.com/helm/helm/pull/32497) + +## Rejected ideas + +- + +## Open issues + +I suggested that we implement a new feature in Kubernetes directly that would expose an endpoint, through the apiserver, that expose all feature gates information across all components and nodes. Ref ; [[Feature request] Single API endpoint for feature gates values](https://github.com/kubernetes/kubernetes/issues/141162) + +## References + +- \ No newline at end of file