Alpha may vanish, beta may change, stable is supported for a long time.

Know the maturity ladder before an upgrade, and know which port and endpoint to check when a control-plane component misbehaves.

alpha v1alpha1

Off by default, may have bugs, can be removed any time without notice.

beta v1beta1

Tested and often on by default, but the shape may still change incompatibly.

stable v1

Supported across many releases, with a formal deprecation policy before removal.

Ports to remember

6443	kube-apiserver (everyone)
2379 / 2380	etcd client (API server only) / peer (Raft)
10250	kubelet API: exec, logs. Never leave it open.
10259 / 10257	scheduler / controller-manager metrics

health and upgrade checks

$ kubectl get --raw='/readyz?verbose'
[+]ping ok
[+]etcd ok
[+]poststarthook/start-kube-apiserver-admission-initializer ok
readyz check passed
$ kubectl get --raw /metrics | \
    grep apiserver_requested_deprecated_apis

Versions, ports and health checks you will actually use

API versions signal stability. Alpha features are disabled by default and may be dropped without notice. Beta APIs are tested and frequently on by default, but their shape can still change in incompatible ways. Stable APIs (v1) are supported for many releases and follow a formal deprecation policy, so operators have predictable time to migrate before removal.

This matters for upgrades. A manifest or Helm chart that references an API version removed in the new control plane fails outright. The classic example is the extensions/v1beta1 Ingress, removed in Kubernetes 1.22. Always scan for deprecated API usage before a minor-version upgrade, using the apiserver_requested_deprecated_apis metric or a tool such as pluto or kubent. Deck 6 builds this into an upgrade runbook.

The ports table is more than trivia: it is your firewall and security-group checklist for self-managed clusters. The kubelet API on 10250 deserves special attention, because it lets the API server run commands in containers and read logs; an unauthenticated kubelet is a well-known attack path, so disable anonymous auth and use webhook authorization.

Finally, the API server exposes /livez, /readyz and /healthz. Use /readyz?verbose to see each internal check, including etcd connectivity, when a freshly started or upgraded control plane misbehaves.