Kubernetes data-plane fidelity gaps & recommended additions (follow-ups from PR #299)

[NitinKumar004]

Summary

Tracking issue for the capabilities still missing from the Kubernetes data plane after PR #299 (minikube-like runtime parity). The core lifecycle — create → running → scale → rolling update → teardown, driven by real kubectl/client-go across EKS/GKE/AKS — is in place and tested. API discovery and both /openapi/v2 and /openapi/v3 are already served, so negotiating tooling (kubectl, helm) starts cleanly, and list/watch label selectors already work. This issue collects the remaining follow-ups so they don't get lost.

The data plane emulates the Kubernetes API + built-in controllers (objects reconcile to a healthy state); it does not run containers. Several items below are about closing the gap between "the API behaves like a cluster" and "every field/verb behaves like a cluster."

How to read this list

Items are grouped by scope confidence, not just by area, so it's clear which are ready to implement versus which need a maintainer scope call first:

• Tier A — surface fidelity & hygiene. Protocol/verb correctness and convention fixes that don't add new semantics. These align with the project's "real tooling must work" and FakeClock conventions; safe to pick up.
• Tier B — controller materialization (needs a scope decision). The reconciler already takes deliberate shortcuts here (documented in reconcile.go). Do we want fuller fidelity, or keep the shortcut?
• Tier C — enforcement / actuation (confirm as non-goals?). The README lists most of these as intentionally out of scope. Proposing we either commit to minimal enforcement or document them as non-goals — a yes/no from maintainers unblocks this.

---

Tier A — surface fidelity & hygiene (ready to implement)

• List pagination (limit / continue). Lists are unpaginated today (full set every time). Memory-bounded clients that page won't get a continue token.
• Watch resourceVersion resume + BOOKMARK events. Watches replay full state as ADDED on subscribe with no rv-based resumption; a list-then-watch reflector re-receives everything. (Overflow already emits 410 Gone correctly — that part is done.)
• Event field selectors (involvedObject.name / reason). General label selectors work, but unknown field selectors match nothing (fail-closed), so kubectl describe-style Event filtering returns empty. Honor the common Event fields.
• Server-side apply field ownership. SSA is accepted but applied as a plain merge — no field managers / managedFields. Fine for most flows; conflict-detection tooling won't behave.
• --dry-run=server support. Confirmed unimplemented. kubectl apply --dry-run=server and admission-style previews can't be exercised. Aligns directly with the "real tooling works" goal.
• Finalizers / deletionTimestamp graceful deletion. Confirmed unimplemented — deletes are immediate. Objects with finalizers should enter a terminating state until finalizers clear, which controller/operator tests depend on.
• Pod logs subresource (synthetic). No kubelet, so real logs are out of scope, but a canned/streamed line per container would let log-scraping tooling and CI assertions work. exec/attach/port-forward can stay unsupported but should return a clear typed error rather than a bare 404.
• Surface the pod-count clamp. Replicas/completions are clamped to maxReconciledPods (500) to keep the synchronous reconciler responsive, but silently — the object keeps spec.replicas: 5000 while only 500 Pods appear. Add a status condition/annotation noting the clamp.
• Deterministic clock. The reconciler/registry use time.Now() directly rather than the project's config.FakeClock convention (a documented CONTRIBUTING rule). Deviates from the standard and blocks time-travel tests (e.g. CronJob schedules).
• Automated kubectl smoke test in CI. The headline "real kubectl lifecycle" run is currently manual; the automated client-go E2E forces application/json, so the protobuf-write / OpenAPI-negotiated / kubectl-specific surface has no automated regression guard. Commit a lightweight kubectl smoke (skipped unless kubectl + a live server are present).
• Provider CA-vs-sentinel consistency. In the misconfig window where BaseURL()=="" (before SetBaseURL), EKS/GKE advertise the real CA against the *-DATAPLANE-NOT-IMPLEMENTED sentinel endpoint while AKS omits the CA. Make the three agree.

Tier B — controller materialization (needs a scope decision)

• Intermediate ReplicaSet object for Deployments. Deployment pods are currently owned directly by the Deployment; reconcile.go explicitly notes "ReplicaSet object is not yet materialized; Pods are owned by the Deployment." Real clusters interpose a ReplicaSet (owner chain Deployment→RS→Pod). Operators that walk that chain, or assert kubectl get rs, see a gap. Decision: materialize RS, or keep the documented shortcut?
• reconcileJob should reconcile a shrunk completions / changed template, not just top up — today reducing completions or editing the pod template leaves stale Pods and can overstate status.succeeded. (Jobs are near-immutable in real k8s, so low blast radius.)
• StatefulSet / DaemonSet actuation depth. Partial reconcilers exist; confirm how far their fidelity should go (ordinals, stable identity, per-node DaemonSet Pods) versus staying best-effort.

Tier C — enforcement / actuation (confirm as non-goals?)

• RBAC / ResourceQuota / LimitRange / NetworkPolicy / PodDisruptionBudget enforcement, and HPA / CronJob actuation. All served and stored but never act. The README lists these as intentionally out of scope. Even minimal enforcement (e.g. ResourceQuota rejecting an over-quota create, CronJob firing a Job on a fake-clock tick) would raise fidelity for policy/scheduling tests — but this is a direction change, so it needs a maintainer call. Each is independently scoped.
  • Note: HPA actuation is additionally blocked on there being no metric source — see below.

Not currently served — document as non-goal or split into their own issues?

Confirmed absent in the current data plane. Naming them explicitly (as non-goals or tracked features) prevents the "discovered as a surprise" problem:

• CRDs / apiextensions.k8s.io — no custom resource support; operators that install CRDs can't register their types.
• metrics.k8s.io / APIService aggregation / kubectl top — no metrics source, which is why HPA can't actuate.
• Admission webhooks (validating/mutating) — no admission chain.

Notes

These are fidelity/enhancement items, not correctness bugs — the shipped surface is tested and green. Splitting any into its own issue as it's picked up is fine; this is the umbrella. Non-k8s services are out of scope for this ticket.