kube-no-trouble — the cluster-wide deprecation audit

kube-no-trouble (kubent) is a tool from DoiT International that detects deprecated APIs in the live cluster. It inspects the cluster’s resources, matches them against a maintained list of deprecated APIs, and reports the deprecated objects. This lesson walks kubent, the output format, and the integration with the upgrade workflow.

The kubent tool

kubent is a standalone binary:

# Install
brew install kubent
# or
curl -L https://github.com/doitintl/kube-no-trouble/releases/latest/download/kubent-$(uname -s)-amd64.tar.gz | tar xz
sudo mv kubent /usr/local/bin/

The tool inspects the cluster’s resources via the kubeconfig.

The kubent command

kubent

6:25PM INF Deprecated APIs:
6:25PM INF Total deprecated APIs: 4
6:25PM INF Target version: v1.34.0

Deprecated APIs:
------------------------------------------------------------------------------------------------------------------------------
KIND         NAMESPACE          NAME                       API_VERSION          REPLACEMENT
Ingress      ingress-nginx      ingress-test               extensions/v1beta1   networking.k8s.io/v1
CronJob      default            backup-job                 batch/v2alpha1       batch/v1
Deployment   default            legacy-app                 extensions/v1beta1   apps/v1
Service      default            legacy-headless            v1                   (current)

The output lists each deprecated API object, the API version, and the replacement.

flowchart LR
    A[Cluster] --> B[kubent]
    B --> C[Deprecated API objects]
    C --> D[Replacement versions]
    D --> E[Update manifests]

The target version

kubent --target-version=v1.34.0

The --target-version flag (or -t) sets the target Kubernetes version. Deprecated APIs that are scheduled to be removed by the target version are flagged.

kubent --target-version=v1.34.0

Target version: v1.34.0

The output confirms the target.

The output format

The default output is a table. The JSON output:

kubent --target-version=v1.34.0 --output=json

{
  "items": [
    {
      "kind": "Ingress",
      "namespace": "ingress-nginx",
      "name": "ingress-test",
      "apiVersion": "extensions/v1beta1",
      "replacement": "networking.k8s.io/v1"
    }
  ]
}

The JSON output is suitable for CI/CD integration.

The exit code

kubent returns a non-zero exit code if deprecated APIs are found:

kubent
echo $?
# 1

The non-zero exit code is the CI/CD signal: the pipeline fails.

# CI/CD
- name: Run kubent
  run: kubent --target-version=v1.34.0

The pipeline fails if deprecated APIs are detected.

The compare with pluto and kubectl deprecations

Each tool covers a different scope:

• kubectl deprecations is the canonical source for Kubernetes-native inspection.
• pluto is the most flexible for Helm charts and files.
• kubent is the cluster-wide audit; it inspects the live state.

flowchart LR
    A[Files] --> B[kubectl deprecations]
    A --> C[pluto]
    D[Helm chart] --> C
    D --> E[helm-pluto]
    F[Cluster] --> G[kubent]

The use cases

• Pre-upgrade. Run kubent before any upgrade. The output lists the deprecated API objects that must be updated before the upgrade.
• Continuous monitoring. Run kubent periodically (e.g., daily) to detect new deprecated APIs.
• CI/CD. Run kubent in the pipeline; fail on deprecated APIs.

The kubent maintained list

kubent’s list of deprecated APIs is in internal/rules/:

- deprecatedVersion: v1.16.0
  apiVersion: extensions/v1beta1
  kind: Ingress
  replacementVersion: networking.k8s.io/v1
  replacementKind: Ingress
- deprecatedVersion: v1.8.0
  apiVersion: batch/v2alpha1
  kind: CronJob
  replacementVersion: batch/v1
  replacementKind: CronJob

The list is updated with each kubent release. Operators should pin the kubent version in CI/CD.

Cross-course references

• The CI/CD course covers integration patterns.
• The Helm course covers chart template evolution.
• The Observability course covers pipeline monitoring.

Quiz

Production discipline

• Run kubent before every upgrade. The cluster-wide audit is the pre-flight gate.
• Run kubent in CI/CD. The pipeline fails on deprecated APIs.
• Pin the kubent version. The list is maintained per release.
• Update manifests and apply. The replacement is the canonical version.
• Re-run after updates. The audit is clean only when no deprecated APIs remain.
• Document the audit in the runbook. The target version, the deprecated objects, the fixes.

The kubent audit is the cluster’s live API hygiene. Operating it well is keeping the cluster clean and the manifests current.