CI/CD gating for deprecated APIs — the pipeline enforcement

CI/CD gating is the production discipline for API deprecation. The pipeline fails on deprecated APIs; the PR is blocked until the deprecated APIs are removed. This lesson walks the integration patterns and the audit trail.

The pipeline gates

The CI/CD pipeline runs three checks:

flowchart LR
    A[PR] --> B[pluto detect-files]
    A --> C[kubent detect-cluster]
    A --> D[kubectl apply --dry-run=server]
    B --> E{Deprecated?}
    C --> E
    D --> E
    E -->|yes| F[PR blocked]
    E -->|no| G[PR passes]

Each check is a gate. A failure in any gate blocks the PR.

The pluto gate

# .github/workflows/k8s-deprecations.yml
name: K8s deprecations
on:
  pull_request:
    paths:
      - 'manifests/**'
      - 'helm-chart/**'

jobs:
  pluto:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install pluto
        run: |
          curl -L https://github.com/FairwindsOps/pluto/releases/latest/download/pluto_$(uname -s)_amd64.tar.gz | tar xz
          sudo mv pluto /usr/local/bin/
      - name: Run pluto on manifests
        run: pluto detect-files --target-k8s-version=v1.34.0 manifests/
      - name: Run pluto on Helm chart
        run: pluto detect-files --target-k8s-version=v1.34.0 helm-chart/templates/

The pipeline fails if pluto reports any deprecated APIs.

The kubent gate

# .github/workflows/k8s-deprecations.yml (continued)
  kubent:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install kubent
        run: |
          curl -L https://github.com/doitintl/kube-no-trouble/releases/latest/download/kubent-$(uname -s)-amd64.tar.gz | tar xz
          sudo mv kubent /usr/local/bin/
      - name: Run kubent
        run: kubent --target-version=v1.34.0

The kubent gate inspects the live cluster.

The kubectl gate

# .github/workflows/k8s-deprecations.yml (continued)
  kubectl-dry-run:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install kubectl
        run: |
          curl -LO "https://dl.k8s.io/release/v1.34.1/bin/linux/amd64/kubectl"
          sudo install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl
      - name: Configure kubeconfig
        run: |
          mkdir -p ~/.kube
          echo "${{ secrets.KUBECONFIG }}" > ~/.kube/config
      - name: Run kubectl dry-run
        run: |
          for f in manifests/*.yaml; do
            kubectl apply -f $f --dry-run=server --validate=true
          done

The kubectl gate validates each manifest against the live apiserver.

The audit trail

The pipeline’s output is the audit trail:

PR #1234: Update manifests to networking.k8s.io/v1
  - pluto: 0 deprecated APIs
  - kubent: 0 deprecated API objects
  - kubectl dry-run: 0 warnings
  Status: PASSED

The audit trail is the PR comment history. Each PR captures the deprecation state.

sequenceDiagram
    participant Dev as Developer
    participant CI as CI/CD
    participant Cluster as Live cluster
    Dev->>CI: Open PR
    CI->>CI: pluto detect-files
    CI->>Cluster: kubent detect-cluster
    CI->>Cluster: kubectl apply --dry-run=server
    Cluster-->>CI: Validation result
    CI-->>Dev: PR status

The PR comment

The pipeline posts a comment on the PR:

- name: Comment on PR
  uses: actions/github-script@v6
  with:
    script: |
      const output = `### K8s deprecations\n- pluto: 0 deprecated APIs\n- kubent: 0 deprecated API objects\n- kubectl dry-run: 0 warnings\n`;
      github.rest.issues.createComment({
        issue_number: context.issue.number,
        owner: context.repo.owner,
        repo: context.repo.repo,
        body: output
      });

The comment is the PR’s deprecation report.

The required checks

The GitHub branch protection requires the deprecation checks to pass:

# Branch protection settings
required_status_checks:
  - "pluto"
  - "kubent"
  - "kubectl-dry-run"

The PR cannot be merged until all checks pass.

The pipeline schedule

The pipeline runs on every PR. A scheduled run also inspects the cluster:

# .github/workflows/k8s-deprecations-scheduled.yml
on:
  schedule:
    - cron: '0 6 * * *'  # Daily at 06:00 UTC

The scheduled run catches new deprecated APIs introduced by Helm chart updates or external tooling.

The TargetVersion discipline

The pluto and kubent target version is pinned:

- name: Run pluto
  run: pluto detect-files --target-k8s-version=v1.34.0 manifests/

The pin is updated when the cluster is upgraded. The pipeline enforces the deprecation policy for the current target version.

Cross-course references

• The CI/CD course covers pipeline integration patterns.
• The Helm course covers chart template evolution.
• The GitHub Actions course covers integration patterns.

Quiz

Production discipline

• Integrate pluto, kubent, and kubectl —dry-run=server into CI/CD. Three gates.
• Make the checks required. Branch protection enforces the policy.
• Pin the target version. The pipeline enforces the current target.
• Schedule the cluster audit. Daily or weekly, to catch new deprecated APIs.
• Audit the PR comments. The history is the compliance evidence.
• Document the pipeline. The gates, the tool versions, the target version.

The CI/CD gates are the canonical enforcement of the deprecation policy. Operating it well is keeping the pipeline current and the policy enforced.