Skip to content

v0.2.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 22 Oct 18:35
· 19 commits to main since this release
v0.2.1
cd9db6c

Know before you upgrade. kupre is a read-only Kubernetes upgrade preflight, health check and certificate audit, built for platform teams and CI.

Highlights

  • 61 checks across three missions. Removed APIs (live objects and Helm history), PDB drain blockers, fail-closed webhooks, version skew, kubelet, feature-gate and kubeadm breakage, certificates, and kubeadm / Cluster API / OpenStack hazards.
  • Kubernetes 1.37 data, every entry checked against CHANGELOG-1.37. New: SELinuxMount GA, cAdvisor kubelet flags, static Pod API references, kubeadm v1beta3 removal, 14 removed feature gates, and the scheduling.k8s.io/v1alpha2 removal.
  • New kubernetes-version-support check using upstream end-of-life dates. They're embedded, so no network access is needed.
  • New ingress-nginx-retired check: finds the retired controller and the Ingresses a migration has to cover.
  • Policy file .kupre.yaml: disabled checks, severity overrides, and waivers with owner and expiry. --baseline makes CI fail only on new findings. Blockers can never be waived, and accepted findings stay visible.
  • GitHub Action (uses: Rusty-Gopher/kupre@v0.2.1). It writes the report to the job summary and sets verdict, exit-code and report outputs.
  • Container image ghcr.io/rusty-gopher/kupre:0.2.1 (multi-arch, distroless, non-root), plus a ready-made in-cluster CronJob (deploy/cronjob.yaml).
  • --json-file saves the JSON report next to any output format. The JSON now carries schemaVersion.
  • Interactive mode applies .kupre.yaml too, so it always agrees with scripted runs.
  • Tidier worklist: per-check limits move behind -v, and verdict wording fits each mission. kupre checks lists every check with the missions that run it.

Trust

  • Read-only: only get and list calls. CI fails if a write call appears.
  • "Could not check" is never "pass". This is tested end to end on kind for Kubernetes 1.35, 1.36 and 1.37, including a service account with no RBAC at all.
  • Release data quotes its upstream source and is pinned by tests.

Install

go install github.com/Rusty-Gopher/kupre/cmd/kupre@v0.2.1
docker run --rm -v ~/.kube:/home/nonroot/.kube:ro ghcr.io/rusty-gopher/kupre:0.2.1 health

Or download an archive below and verify it: gh attestation verify --owner Rusty-Gopher <file>.

Assets 15
Loading