v0.6.1

• Per-check timing: every finding in -o json now carries durationMs, so slow checks on big clusters are easy to spot. The field is additive, so schemaVersion stays "1".
• Scale tested: a new test runs every mission over a synthetic cluster of 16,300 objects. Measured cost is linear, about 0.3 s at 81,500 objects; on a real cluster, API list latency dominates.

Install: brew install rusty-gopher/tap/kupre · kubectl krew install rusty-gopher/kupre · go install github.com/Rusty-Gopher/kupre/cmd/kupre@v0.6.1 · ghcr.io/rusty-gopher/kupre:0.6.1 · checksums cosign-signed.

v0.6.0

New: Envoy Gateway compatibility

envoy-gateway-compatibility reads the Envoy Gateway controller version and checks it against the vendor's compatibility matrix, including the end-of-life date it publishes for each release. Envoy Gateway is a common destination for teams migrating off the retired ingress-nginx. This pairs with kupre's ingress-nginx-retired check.

Today: Envoy Gateway 1.9 supports Kubernetes 1.33 to 1.36, and no release lists 1.37 yet.

Fix

Add-on maintenance status now compares end-of-life dates with today. Before, a vendor that puts dates on every release, even current ones, made kupre treat all of them as end-of-life. That meant it couldn't suggest an upgrade target. A test now covers this.

Validated against a real Envoy Gateway v1.9.2 install on kind. Total: 65 checks.

Install: brew install rusty-gopher/tap/kupre · kubectl krew install rusty-gopher/kupre · go install github.com/Rusty-Gopher/kupre/cmd/kupre@v0.6.0 · ghcr.io/rusty-gopher/kupre:0.6.0 · checksums cosign-signed.

v0.5.1

Correctness fixes, found by an independent review.

• Every add-on install is now checked. Previously only the first matching workload was checked, so a compatible Cilium or cert-manager could hide an older second copy (another namespace, a half-finished migration). Now all installs are evaluated, and any install newer than kupre's data prevents a pass.
• kubernetes-version-support no longer passes when the target's end-of-life date is unknown. It reports the current release's status and says the target is unknown.
• kupre fleet applies .kupre.yaml (--policy, --no-policy), so fleet verdicts match single-cluster runs.
• GitHub Action:
  • fail-on is now the only threshold; a --fail-on-warn in args can no longer override it.
  • Invalid fail-on values are rejected.
  • Each invocation writes its own report, so a scan that fails early can't publish an earlier scan's verdict.

Install: brew install rusty-gopher/tap/kupre · kubectl krew install rusty-gopher/kupre · go install github.com/Rusty-Gopher/kupre/cmd/kupre@v0.5.1 · ghcr.io/rusty-gopher/kupre:0.5.1 · checksums cosign-signed.

v0.5.0

New: Calico compatibility

calico-compatibility reads the calico/node version and checks it against the Kubernetes versions Tigera tests each Calico release on. The data comes from the vendor's versioned docs: 3.33 covers 1.35 to 1.37, 3.32 covers 1.34 to 1.36, and 3.31 covers 1.32 to 1.35.

Calico 3.33 is already tested on Kubernetes 1.37, so kupre passes it on a 1.37 upgrade path. Calico publishes no end-of-life policy alongside these tables, so kupre never claims an older Calico is "unmaintained". It only says the version predates the published data.

Validated against a real Calico 3.33.0 install on kind. Total: 64 checks.

Install

brew install rusty-gopher/tap/kupre · kubectl krew install rusty-gopher/kupre · go install github.com/Rusty-Gopher/kupre/cmd/kupre@v0.5.0 · ghcr.io/rusty-gopher/kupre:0.5.0 · checksums cosign-signed.

v0.4.0

New: Cilium compatibility

cilium-compatibility reads the Cilium agent version and checks it against the Kubernetes versions Cilium e2e-tests each release on, taken from Cilium's own docs. It also flags releases that have left Cilium's maintained list (v1.18 to v1.20 today).

kupre keeps the vendor's own wording. Cilium calls listed versions "e2e tested and guaranteed". It says unlisted ones "depend on the forward / backward compatibility" of Kubernetes. So kupre reports a version outside the list as untested, never as unsupported.

Add-on checks are now driven by a data table (pkg/deprecation/addons.go). Each add-on is one entry, and every entry cites its vendor source. Total: 63 checks.

Validated against a real Cilium 1.20.3 install on kind.

Install

brew install rusty-gopher/tap/kupre · kubectl krew install rusty-gopher/kupre · go install github.com/Rusty-Gopher/kupre/cmd/kupre@v0.4.0 · ghcr.io/rusty-gopher/kupre:0.4.0 · checksums cosign-signed.

v0.3.0

New: add-on compatibility

cert-manager-compatibility reads the installed cert-manager version and checks it against cert-manager's published support matrix. It flags end-of-life releases, and any cluster or target version outside cert-manager's supported range.

This matters right now: no cert-manager release lists Kubernetes 1.37 support yet. The newest, 1.21, covers 1.33 to 1.36, and 1.22 is due around November 2026. Planning a 1.37 upgrade? kupre will tell you.

The check runs in both the upgrade and health missions, bringing the total to 62. It was validated against a real cert-manager v1.21.2 install on kind.

Install

brew install rusty-gopher/tap/kupre · kubectl krew install rusty-gopher/kupre · go install github.com/Rusty-Gopher/kupre/cmd/kupre@v0.3.0 · ghcr.io/rusty-gopher/kupre:0.3.0

Checksums are cosign-signed:

cosign verify-blob --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp 'https://github.com/Rusty-Gopher/kupre/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com checksums.txt

v0.2.2

Hardening release. No change to checks or verdicts.

• Signed releases: checksums.txt is now signed with keyless cosign (Sigstore). It covers every archive and sits alongside the existing build attestation:

  cosign verify-blob --bundle checksums.txt.sigstore.json \
    --certificate-identity-regexp 'https://github.com/Rusty-Gopher/kupre/' \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com checksums.txt

• go install builds report their real version instead of dev.
• Install with Homebrew (brew install rusty-gopher/tap/kupre) or krew (kubectl krew index add rusty-gopher https://github.com/Rusty-Gopher/homebrew-tap && kubectl krew install rusty-gopher/kupre).
• Supply chain: every GitHub Action is pinned by commit SHA, workflow permissions are scoped per job, and CodeQL, staticcheck, OpenSSF Scorecard and Dependabot are in place.
• Fuzz tests for --target-version parsing and .kupre.yaml loading. The policy fuzzer asserts that no policy can unblock a blocker without an explicit severity override.

v0.2.1

Know before you upgrade. kupre is a read-only Kubernetes upgrade preflight, health check and certificate audit, built for platform teams and CI.

Highlights

• 61 checks across three missions. Removed APIs (live objects and Helm history), PDB drain blockers, fail-closed webhooks, version skew, kubelet, feature-gate and kubeadm breakage, certificates, and kubeadm / Cluster API / OpenStack hazards.
• Kubernetes 1.37 data, every entry checked against CHANGELOG-1.37. New: SELinuxMount GA, cAdvisor kubelet flags, static Pod API references, kubeadm v1beta3 removal, 14 removed feature gates, and the scheduling.k8s.io/v1alpha2 removal.
• New kubernetes-version-support check using upstream end-of-life dates. They're embedded, so no network access is needed.
• New ingress-nginx-retired check: finds the retired controller and the Ingresses a migration has to cover.
• Policy file .kupre.yaml: disabled checks, severity overrides, and waivers with owner and expiry. --baseline makes CI fail only on new findings. Blockers can never be waived, and accepted findings stay visible.
• GitHub Action (uses: Rusty-Gopher/kupre@v0.2.1). It writes the report to the job summary and sets verdict, exit-code and report outputs.
• Container image ghcr.io/rusty-gopher/kupre:0.2.1 (multi-arch, distroless, non-root), plus a ready-made in-cluster CronJob (deploy/cronjob.yaml).
• --json-file saves the JSON report next to any output format. The JSON now carries schemaVersion.
• Interactive mode applies .kupre.yaml too, so it always agrees with scripted runs.
• Tidier worklist: per-check limits move behind -v, and verdict wording fits each mission. kupre checks lists every check with the missions that run it.

Trust

• Read-only: only get and list calls. CI fails if a write call appears.
• "Could not check" is never "pass". This is tested end to end on kind for Kubernetes 1.35, 1.36 and 1.37, including a service account with no RBAC at all.
• Release data quotes its upstream source and is pinned by tests.

Install

go install github.com/Rusty-Gopher/kupre/cmd/kupre@v0.2.1
docker run --rm -v ~/.kube:/home/nonroot/.kube:ro ghcr.io/rusty-gopher/kupre:0.2.1 health

Or download an archive below and verify it: gh attestation verify --owner Rusty-Gopher <file>.