pluto — finding deprecated APIs in Helm charts

pluto is a tool from FairwindsOps that detects deprecated Kubernetes APIs in Helm charts. It uses a maintained list of deprecated API versions and provides a fast, offline check. This lesson walks pluto, the helm-pluto plugin, and the CI/CD integration.

The pluto tool

pluto is a standalone binary:

# Install
brew install pluto
# or
curl -L https://github.com/FairwindsOps/pluto/releases/latest/download/pluto_$(uname -s)_amd64.tar.gz | tar xz
sudo mv pluto /usr/local/bin/

The tool inspects:

• Helm values files.
• Helm chart templates.
• Live cluster state (via kubectl).
• Files at rest.

The pluto command

pluto detect-files --target-k8s-version=v1.34.0 manifests/

NAME                               KIND                        VERSION              REPLACEMENT
manifests/pod.yaml                 Pod                         v1                   (current)
manifests/deploy.yaml              Deployment                 extensions/v1beta1   apps/v1
manifests/ingress.yaml             Ingress                    extensions/v1beta1   networking.k8s.io/v1
manifests/cronjob.yaml             CronJob                    batch/v2alpha1       batch/v1

The output lists the deprecated APIs, the replacement, and the API version.

flowchart LR
    A[manifests/] --> B[pluto detect-files]
    B --> C[Deprecated APIs]
    C --> D[Replacement versions]
    D --> E[Update manifests]

The pluto detect-cluster

pluto detect-cluster

NAME                          KIND             VERSION              REPLACEMENT
ingress-nginx/ingress-test    Ingress          extensions/v1beta1   networking.k8s.io/v1
cert-manager/cert-manager     Certificate      v1alpha1             v1

The command inspects the live cluster’s API objects. The output lists the deprecated API objects that are still running.

The detect-cluster command is the production safety check: a cluster with deprecated API objects is at risk when the API is removed.

The helm-pluto plugin

helm-pluto inspects Helm charts before they are installed:

helm plugin install https://github.com/FairwindsOps/helm-pluto
helm pluto my-release ./my-chart --target-k8s-version=v1.34.0

NAME                  KIND           VERSION            REPLACEMENT
my-chart/templates/deployment.yaml  Deployment  extensions/v1beta1  apps/v1
my-chart/templates/ingress.yaml     Ingress     extensions/v1beta1  networking.k8s.io/v1

The plugin renders the chart with the given values and inspects the rendered manifests.

The output format

pluto supports multiple output formats:

pluto detect-files -o json --target-k8s-version=v1.34.0 manifests/

{
  "items": [
    {
      "name": "manifests/deploy.yaml",
      "kind": "Deployment",
      "version": "extensions/v1beta1",
      "replacement": "apps/v1"
    }
  ]
}

The JSON output is suitable for CI/CD integration.

The CI/CD integration

# .github/workflows/k8s-upgrade-check.yml
name: K8s upgrade check
on:
  pull_request:
    paths:
      - 'manifests/**'
      - 'helm-chart/**'
jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run pluto
        run: |
          pluto detect-files --target-k8s-version=v1.34.0 manifests/
          pluto detect-files --target-k8s-version=v1.34.0 helm-chart/templates/
      - name: Run helm-pluto
        run: |
          helm plugin install https://github.com/FairwindsOps/helm-pluto
          helm pluto my-release ./helm-chart --target-k8s-version=v1.34.0

The CI/CD pipeline fails if pluto reports any deprecated APIs. The PR is blocked until the deprecated APIs are removed.

The pluto vs kubectl deprecations

kubectl deprecations is the authoritative source for Kubernetes-native inspection. pluto is more flexible for Helm charts and provides a wider feature set.

flowchart LR
    A[Manifests] --> B[kubectl deprecations]
    A --> C[pluto]
    D[Helm chart] --> E[helm-pluto]
    D --> C
    F[Cluster] --> G[pluto detect-cluster]

The API version list

pluto’s API version list is in pkg/api/deprecations.go:

versions := []DeprecatedAPI{
  {
    Kind: "Ingress",
    Version: "extensions/v1beta1",
    Replacement: "networking.k8s.io/v1",
    Removed: "1.22.0",
  },
  ...
}

The list is updated with each pluto release. The list includes the removal version; the operator can see when the API is gone.

Cross-course references

• The Helm course covers chart template evolution.
• The Observability course covers CI/CD pipeline monitoring.
• The GitHub Actions course covers integration patterns.

Quiz

Production discipline

• Run pluto in CI/CD. The pipeline fails on deprecated APIs.
• Pin the pluto version. The list is maintained per release.
• Run pluto detect-cluster before any upgrade. The live cluster’s state is the truth.
• Update manifests and Helm templates. The replacement is the canonical version.
• Re-run after updates. The audit is clean only when no deprecated APIs remain.
• Track pluto runs in the runbook. The deprecation list, the upgrade target, the audit date.

The pluto audit is the cluster’s API hygiene. Operating it well is keeping the manifests current and the cluster ed deprecation-free.