Project
The kube-apiserver is Kubernetes' central control-plane component, exposing the REST API that validates, processes, and stores cluster state and requests.
A ZoomEye query counted hosts answering on Kubernetes' default API port on 2026-09-20. The write-up keeps the unit honest: a host that responded to one port query, with no authentication test behind the number.
Reality
The NativeHistograms gate is on by default in v1.37, and components answer /metrics in both formats. What Prometheus stores depends on two per-job flags, one of which defaults to false and leaves classic dashboards with no data.
Reality
Native histograms are beta and on by default, and Kubernetes keeps emitting classic buckets beside them, so the advertised 90 percent cut in time series depends on a later call about what to stop collecting.
Reality
The release counts 67 enhancements and 16 graduations to Stable, but the item that changes behaviour on every large cluster is a feature gate now locked on, leaving controller authors to absorb HTTP 429 responses.
Reality
KEP-3257 adds a ClusterTrustBundle object and a kubelet projected volume source, which lets a signer publish its roots without running a controller that holds create-ConfigMap permission in every namespace.
Reality
KEP-4317 pairs a pod-scoped certificate request with a projected volume, so the kubelet provisions the key and kube-apiserver enforces node restriction. What is left for a signer to do is the CA work.
Reality
In-place Pod resizing is GA and the kubelet can now issue pod certificates itself, but the fix for feature skew between control plane and nodes is still alpha. Read the removals list first.
Reality