deprek8's Introduction

deprek8

Evergreen policy to monitor Kubernetes APIs deprecations.

Quick how-to with Helm and Conftest

First, install Conftest (for MacOS users: brew install instrumenta/instrumenta/conftest)

$ cd stable/prometheus
$ curl https://raw.githubusercontent.com/naquada/deprek8/master/policy/deprek8.rego > deprek8.rego
$ $ helm template --set podSecurityPolicy.enabled=true --set server.ingress.enabled=true . | conftest test -p deprek8.rego -
WARN - Ingress/release-name-prometheus-server: API extensions/v1beta1 for PriorityClass is deprecated, use networking.k8s.io/v1beta1 instead.
FAIL - PodSecurityPolicy/release-name-prometheus-node-exporter: API extensions/v1beta1 for PodSecurityPolicy is no longer served by default, use policy/v1beta1 instead.
FAIL - DaemonSet/release-name-prometheus-node-exporter: API extensions/v1beta1 for DaemonSet is no longer served by default, use apps/v1 instead.
FAIL - Deployment/release-name-prometheus-alertmanager: API extensions/v1beta1 for Deployment is no longer served by default, use apps/v1 instead.
FAIL - Deployment/release-name-prometheus-kube-state-metrics: API extensions/v1beta1 for Deployment is no longer served by default, use apps/v1 instead.
FAIL - Deployment/release-name-prometheus-pushgateway: API extensions/v1beta1 for Deployment is no longer served by default, use apps/v1 instead.
FAIL - Deployment/release-name-prometheus-server: API extensions/v1beta1 for Deployment is no longer served by default, use apps/v1 instead.

deprek8's People

Contributors

Stargazers

Watchers

deprek8's Issues

Joining forces ...

Is it worth us joining forces and maintaining a single repo moving forward (see https://github.com/swade1987/deprek8ion)?

Create a data-only OCI image

Create a Conftest + policy OCI image

Add Github-Actions integration example

Add CircleCI integration example

the rego filename should reflect the k8s version it is written for

The current deprek8.rego is written for 1.16, when a new Kubernetes version is released with breaking API changes my conftest run would apparently require a different policy file.

That's why I propose the rego filename should reflect the Kubernetes version it is written for.

So instead of running conftest test -p deprek8.rego ... one would run conftest test -p deprek8_1_16.rego ...

Seems more future proof to me.

Create a release

Create a registry to host a pullable by conftest release

Add Travis-ci integration example

Add Gitlab-ci integration example

Add more deprecations from k8s 1.17

From 1.17 changelogs:

All resources within the rbac.authorization.k8s.io/v1alpha1 and rbac.authorization.k8s.io/v1beta1 API groups are deprecated in favor of rbac.authorization.k8s.io/v1, and will no longer be served in v1.20.

Recommend Projects