draforge

Kubernetes DRA Compatibility

Last updated: 2026-06-24
Kubernetes reference: v1.32 through v1.36
DRAForge version: 0.1.0

Compatibility Position

DRAForge targets Kubernetes Dynamic Resource Allocation (DRA) using the resource.k8s.io/v1 structured-parameters API. As of the current upstream Kubernetes documentation, core DRA is stable in Kubernetes v1.35 and is enabled by default.

DRAForge therefore treats Kubernetes v1.35+ as the recommended compatibility baseline. Kubernetes v1.32 through v1.34 may expose parts of the same API shape in earlier maturity states, but those versions should be treated as legacy or transition targets and must be validated per distribution.

Kubernetes version	Upstream DRA status	DRAForge stance
v1.36	Stable core DRA plus additional alpha/beta extensions	Supported target, with extension gaps documented below
v1.35	Stable core DRA, enabled by default	Recommended baseline
v1.34	Transition-era DRA support	Best-effort only; validate API availability
v1.32-v1.33	Earlier DRA API maturity	Best-effort only; feature gates and API shape must be checked
< v1.32	Legacy / incompatible API shape	Not supported

DRAForge assumes that resource.k8s.io/v1 is served by the cluster. If the API group or version is not present, the doctor and discovery layers must surface that as a partial or unavailable DRA state, not as an empty cluster.

Tested Kubernetes Versions

Distribution	Version	Test status
GitHub Actions / static CI	n/a	Helm template, web build, Go test through CI
kind	v1.32+	Automated CI matrix
DOKS	v1.34+	Manual showcase target
v1.35+ conformant clusters	v1.35-v1.36	Target for release-readiness E2E

The repository now runs an automated CI E2E matrix testing core paths for supported Kubernetes versions via kind.

Upstream DRA Feature Status

The table below captures the compatibility model DRAForge should use as of 2026-06-24. It is intentionally conservative: stable core APIs are considered baseline; alpha/beta extensions are discovered or explained only when the code explicitly supports them.

Capability	Upstream status as of v1.36 docs	DRAForge 0.1.0 support
Core Dynamic Resource Allocation	Stable since v1.35	Supported for discovery and visualization
DeviceClass	Stable core DRA	Discovered; selector evaluation is partial
ResourceClaim / ResourceClaimTemplate	Stable core DRA	Claims discovered; templates read-only / limited
ResourceSlice	Stable core DRA	Discovered and used for graph/doctor views
CEL device filtering	Stable core behavior	Partial; regex-like evaluator must be replaced
ResourceClaim device status	Observability feature	Partial display only
Device health monitoring	Observability feature	Partial; custom health label fallback remains
Admin access	Beta extension	Not implemented
Granular status authorization	Beta extension	Not implemented
Extended resource allocation by DRA	Alpha extension	Not implemented
Partitionable devices	Alpha extension	Not implemented
Consumable capacity	Alpha extension	Partially displayed; no allocation scoring
Device taints and tolerations	Alpha extension	Not implemented
Resource pool status	Alpha extension	Not implemented
Device binding conditions	Alpha extension	Not implemented
Node allocatable resources	Alpha extension	Not implemented
DRA device metadata in containers	Alpha extension	Not implemented
List type attributes	Alpha extension	Not implemented

DRAForge Support Matrix

Feature	Status	Notes
ResourceSlice discovery	Supported	Uses `resource.k8s.io/v1` and should expose API errors as partial state
ResourceClaim discovery	Supported	Reads status/allocation data and maps claims to Pods where possible
DeviceClass discovery	Partial	DeviceClasses are listed, but full CEL selector behavior is not implemented
Claim allocation explain	Partial	Useful diagnostics exist, but modern DRA selector, taint and binding features are incomplete
Simulator allocation	Partial	Demo allocation exists; full scheduler-compatible DRA semantics are work
Device health	Partial	Custom label fallback exists; native health status support is incomplete
Consumable capacity	Partial	Values can be displayed; capacity-aware allocation and exhaustion scoring are missing
CDI output	Partial	The simulator can produce CDI-oriented output, but Helm deployment modes must clearly separate demo and host-integrated operation
Helm CRD packaging	Supported	The SimulatedDevicePool CRD is packaged under chart `crds/` for Helm install
RBAC least privilege	Partial	Current chart still needs narrower controller permissions
Real-cluster E2E coverage	Partial	Automated matrix tests run across v1.32-v1.36 in CI using kind

Known Limitations

DeviceClass selector evaluation is incomplete. DRAForge can discover DeviceClasses, but the explain and simulator paths do not yet implement the full Kubernetes CEL matching behavior.
Simulator allocation is not scheduler-equivalent. It should not be used as a conformance oracle until ResourceClaim request modes, DeviceClass selectors, capacities, taints, binding conditions and reserved-for behavior are fully modeled.
Native health and status features are incomplete. DRAForge still relies on custom labels or simplified status interpretation in some paths.
CDI mode must be explicit. Demo-local output and host-integrated kubelet CDI output are different operational modes and should not be presented as the same production behavior. This is configured via the nodePlugin.outputMode Helm chart value:
- demo (default): Uses an emptyDir for testing without modifying the host.
- node: Mounts a hostPath (/var/lib/kubelet/device-plugins/cdi) to provide output to the node’s kubelet.
Granular authorization is not implemented. DRAForge currently assumes broad enough read access to observe DRA objects. Per-device status visibility and admin-access flows are future work.
Alpha/beta DRA extensions are not guaranteed. v1.36-era alpha features such as partitionable devices, consumable capacity, device taints, binding conditions and node allocatable resources require explicit support before DRAForge can diagnose them accurately.

API Surface

DRAForge uses or plans around the following Kubernetes APIs.

Resource	API group	Current use
Pods	`core/v1`	Read-only discovery and owner mapping
Nodes	`core/v1`	Read-only node and graph context
Events	`core/v1`	Diagnostics and controller events
ResourceClaims	`resource.k8s.io/v1`	Discovery, explain and simulator status paths
ResourceClaimTemplates	`resource.k8s.io/v1`	Read-only discovery
ResourceSlices	`resource.k8s.io/v1`	Discovery, graph, simulator output
DeviceClasses	`resource.k8s.io/v1`	Discovery and future selector evaluation
SimulatedDevicePools	`draforge.oaslananka/v1alpha1`	DRAForge simulator CRD

DRAForge does not aim to support legacy non-v1 DRA API groups by default. If a distribution serves only older APIs, users should upgrade the cluster or add an explicit compatibility adapter.

Quick Troubleshooting

`resource.k8s.io/v1` is missing

Symptoms include errors such as:

the server could not find the requested resource
resource.k8s.io/v1 API group is not registered

Check:

kubectl api-resources --api-group=resource.k8s.io
kubectl version

Use Kubernetes v1.35+ for the default compatibility path. For older clusters, verify feature gates and served API versions before using DRAForge.

SimulatedDevicePool CRD is missing

The Helm chart now packages the CRD under deploy/helm/draforge/crds/. For manual installs, the standalone CRD remains available:

kubectl apply -f deploy/crds/simulateddevicepool-crd.yaml

For Helm installs, use:

helm install draforge deploy/helm/draforge --namespace draforge-system --create-namespace

Discovery shows no DRA objects

An empty graph can mean either “no DRA objects exist” or “the DRA API is not available.” The discovery layer should preserve those as different states. If the current UI shows only an empty result, run the doctor command and inspect API availability warnings.

RBAC Guidance

Server

The server should remain read-only:

apiGroups: [""]
resources: [pods, nodes, namespaces, events]
verbs: [get, list, watch]

apiGroups: [resource.k8s.io]
resources: [resourceclaims, resourceclaimtemplates, resourceslices, deviceclasses]
verbs: [get, list, watch]

apiGroups: [draforge.oaslananka]
resources: [simulateddevicepools]
verbs: [get, list, watch]

Controller

The controller should use the narrowest write access possible:

apiGroups: [""]
resources: [pods, nodes, namespaces]
verbs: [get, list, watch]

apiGroups: [""]
resources: [events]
verbs: [create, patch]

apiGroups: [resource.k8s.io]
resources: [resourceslices]
verbs: [get, list, watch, create, update, patch, delete]

apiGroups: [resource.k8s.io]
resources: [resourceclaims]
verbs: [get, list, watch, patch]

apiGroups: [resource.k8s.io]
resources: [resourceclaims/status]
verbs: [get, update, patch]

apiGroups: [resource.k8s.io]
resources: [deviceclasses, resourceclaimtemplates]
verbs: [get, list, watch]

apiGroups: [draforge.oaslananka]
resources: [simulateddevicepools]
verbs: [get, list, watch]

apiGroups: [draforge.oaslananka]
resources: [simulateddevicepools/status]
verbs: [get, update, patch]

This is the target policy. The chart must be audited separately to remove any remaining wildcard verbs.

Release Readiness Implications

Before DRAForge is called release-ready for Kubernetes DRA, the following must be true:

The compatibility matrix must be checked against current upstream Kubernetes docs during every minor release.
CI must run Go, web, Helm, Terraform and GoReleaser checks.
Helm installs must include the simulator CRD.
The doctor command must distinguish missing APIs from empty clusters.
The simulator and explain engine must clearly mark unsupported DRA features as unsupported rather than silently approximating them.
Real-cluster E2E tests cover v1.32+ clusters using kind in CI.

References

This site is open source. Improve this page.