Lore

A timeline of how kubernetes/kubernetes got from "First commit" to a 3.5-million-line orchestrator running half the world's container workloads.

Dates are derived from git history (tag dates, file creation timestamps, commit timestamps). Where the "why" is not explicit, the language is hedged.

Eras

The Borg-inspired beginnings (Jun 2014 – Jul 2015)

The first commit landed on 2014-06-06 as a project Google open-sourced, drawing on lessons from internal cluster managers (Borg, then Omega). Early tags v0.10.0 through v1.0.0 show a ~12-month run-up to the public 1.0 release. By the end of this era the major actors were already present in shape: apiserver, controller-manager, scheduler, kubelet, and kube-proxy. The initial repository layout used the now-historic Godeps/ vendoring and a top-level pkg/ containing both core libraries and component implementations.

The 1.0 + CNCF era (Jul 2015 – 2017)

Kubernetes 1.0 was announced in July 2015 and the project moved to the Cloud Native Computing Foundation. This era saw two architecturally consequential moves:

• The split of the monolithic pkg/ into per-component packages and the introduction of cmd/<binary>/app/ to host bootstrap logic that needed to be reused across cmd entry points and integration tests.
• The first staging modules. Code that other projects wanted to import (clientset, apimachinery, openapi-gen) started moving into staging/src/k8s.io/<module>/ so that release tooling could publish them as independent Go modules.

Tags like v1.0.x through v1.7.x cover this period. The cluster/ directory — the pre-kubeadm bring-up scripts — still exists but is essentially frozen in time from this era.

The Pluggability era (~2017 – 2019)

A wave of "make in-tree things pluggable" KEPs shaped this stretch:

• CRI (Container Runtime Interface) replaced the in-tree dockershim and rkt runtimes with a gRPC contract. The dockershim shim itself eventually moved out-of-tree.
• CSI (Container Storage Interface) replaced in-tree volume plugins with a unified gRPC interface. The legacy plugins still live under pkg/volume/{aws_ebs,gce_pd,...} for migration but most new drivers ship out-of-tree.
• CNI (Container Network Interface) became the only supported pod network plugin model.
• kubeadm (cmd/kubeadm) graduated, providing a project-blessed way to bring up minimum viable conformant clusters.
• CRDs and the API extension server (apiextensions-apiserver) made the system extensible from outside the binary.
• RBAC matured into the default authorizer; ABAC became deprecated.

The Scheduler Framework + apiserver-aggregator era (~2019 – 2021)

The scheduler was rewritten from a hard-coded predicates+priorities loop into the scheduling framework (pkg/scheduler/framework) — a sequence of well-defined extension points (PreFilter, Filter, Score, Permit, Bind). Every existing predicate became a plugin. This unlocked features like Topology Spread, EvenPodsSpread, and the in-progress Pod Topology constraints without surgery on the core loop.

The same era saw the API aggregation layer (kube-aggregator, in staging/src/k8s.io/kube-aggregator) and the rise of admission webhooks (staging/src/k8s.io/apiserver/pkg/admission/plugin/webhook). Together these two changes opened the API server to extension by anyone with a service in-cluster.

The In-tree Cleanup era (~2021 – 2023)

A long-running effort to delete in-tree code that had been replaced by extension points:

• In-tree cloud providers (AWS, GCE, Azure, OpenStack, vSphere) were extracted into the cloud-controller-manager model with libraries in staging/src/k8s.io/cloud-provider.
• In-tree storage plugins were CSI-migrated. Code in pkg/volume/csimigration/ orchestrates the staged hand-off.
• dockershim was removed.
• Pod Security Policy (PSP) was deprecated and replaced by Pod Security admission (staging/src/k8s.io/pod-security-admission).

The Modern era (~2023 – 2026)

Active investment areas reflected by recent commit activity:

• Dynamic Resource Allocation (DRA) — staging/src/k8s.io/dynamic-resource-allocation and pkg/scheduler/framework/plugins/dynamicresources add a workflow for scheduling pods that need named, opaque devices (GPUs, accelerators).
• Validating Admission Policy (CEL) — declarative admission written in CEL instead of webhooks. pkg/registry/admissionregistration/ and staging/src/k8s.io/apiserver/pkg/admission/plugin/policy/.
• Structured authentication / authorization config — JWT and authz webhook config files instead of CLI flags.
• Sidecar containers as a first-class init-container kind.
• kube-proxy nftables backend (pkg/proxy/nftables/) — a long-overdue successor to the iptables backend.
• EndpointSlice everywhere — the legacy Endpoints resource is now a compatibility shim.
• Scheduler async API calls — see pkg/scheduler/backend/api_dispatcher and the SchedulerAsyncAPICalls feature gate, which decouples scheduling decisions from API write latency.
• Generic data path improvements in apiserver: WatchList, consistent reads from cache, and proto-friendly streaming.

Longest-standing features

• The kubelet pod sync loop (pkg/kubelet/kubelet.go, pkg/kubelet/pod_workers.go). The high-level shape — read desired pods from the API, drive the runtime to match, push status back — has been preserved since 2014, though every internal interface has been replaced multiple times.
• The controller-manager fan-out (cmd/kube-controller-manager/app/controllermanager.go). The pattern of "spawn one goroutine per controller, each consuming shared informers" has been stable for nearly a decade.
• The REST registry (staging/src/k8s.io/apiserver/pkg/registry/generic). The "strategy + storage" pattern that backs every resource has not fundamentally changed since the early move out of pkg/api.
• Workqueues + informers (staging/src/k8s.io/client-go/tools/cache, staging/src/k8s.io/client-go/util/workqueue). The library shape that every controller in the world now imports is older than most cloud-native projects.

Deprecated features

• dockershim — removed in 1.24 (early 2022). Its retirement triggered a year of cluster-operator angst.
• In-tree cloud providers — AWS, GCE, Azure, vSphere, OpenStack code paths were retired in favor of out-of-tree CCMs. Stub directories may still exist in the tree.
• In-tree volume plugins — most are CSI-migrated. pkg/volume/{aws_ebs, gce_pd, azure_dd, vsphere_volume} are kept only for migration compatibility.
• PodSecurityPolicy (PSP) — removed in 1.25 in favor of PodSecurity admission.
• ABAC authorizer — deprecated in favor of RBAC + Node + webhook.
• HorizontalPodAutoscaler v1 — superseded by autoscaling/v2. The v1 type still exists for compatibility.
• RuntimeClass v1beta1, CronJob v1beta1, etc. — many *v1beta1 types are no longer served, only the v1 versions are.
• Heapster / cAdvisor REST endpoints — long since replaced by metrics-server and the Kubelet stats API.

Major rewrites

• Scheduler → Scheduling Framework (~2019). Hardcoded predicates/priorities replaced by plug-in extension points.
• Endpoints → EndpointSlice (~2020). Replaced an O(N) write per service-update problem with sharded slices.
• iptables-only kube-proxy → multi-backend (iptables, ipvs, nftables, winkernel). The pkg/proxy/ package now hosts four data-plane implementations behind the same control loop.
• In-tree volume plugins → CSI (multi-year migration).
• In-tree cloud providers → Cloud Controller Manager (multi-year migration).
• PodSecurityPolicy → Pod Security admission.
• etcd2 → etcd3 (ancient history but the migration code lives on in pkg/storage/).
• OpenAPI v2 → v3 — both schemas are now served simultaneously.

Growth trajectory

• Code mass has roughly tripled from 2017 to today, mostly through staging-module growth and generated code (clientsets, OpenAPI schemas, conversion functions).
• Contributor count crossed 5,000 unique authors lifetime by 2026. Roughly 1,000 contributors land at least one commit per year.
• Release cadence has held a 3-major-versions-per-year rhythm since 2017, with a steady stream of patch releases for each line.
• API surface continues to grow: every release adds new resources (ResourceClaim, ValidatingAdmissionPolicy, ClusterTrustBundle, ServiceCIDR, etc.) without retiring many existing ones.

The git history before 2014-06-06 doesn't exist publicly — the current repo's "First commit" is the seed of the open-source project, not the seed of the design ideas behind it. Those go back to internal Google projects.