Kube no trouble

Kube No Trouble (kubent) is a simple tool to check whether you're using any of these API versions in your cluster and therefore should upgrade your workloads first, before upgrading your Kubernetes cluster.

You can run kubent with Testkube to use it in your automated tests for your Kubernetes clusters.

Usage

Step 1 - Add the executor to Testkube

testkube create executor --name kubent-executor --types kubent
--image ghcr.io/doitintl/kube-no-trouble:latest

Step 2 - Add ServiceAccount for kubent

kubent needs to be able to list all the resources in the cluster. To do that, you need to create a ServiceAccount and a ClusterRoleBinding for it.

kubent-sa.yaml

apiVersion: v1
kind: ServiceAccount
metadata:
  name: kubent
  namespace: testkube
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: kubent-reader
  namespace: testkube
rules:
- apiGroups: ["*"]
  resources: ["*"]
  verbs: ["get", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: kubent-read-everything
  namespace: testkube
subjects:
- kind: ServiceAccount
  name: kubent
  namespace: testkube
roleRef:
  kind: ClusterRole
  name: kubent-reader
  apiGroup: rbac.authorization.k8s.io

kubectl apply -f kubent-sa.yaml

Step 3 - Update the Job Template to include the Service ServiceAccount

Testkube allows you to override the Job template that will be used to run the tests. You can use this to add the ServiceAccount to the Job.

job-template.yaml

apiVersion: batch/v1
kind: Job
metadata: 
  name: "{{ .Name }}"
  namespace: "{{ .Namespace }}"
spec:
  template:
    spec:
      restartPolicy: Never
      serviceAccountName: kubent
      containers:
        - name: "{{ .Name }}"
          image: "{{ .Image }}"

testkube update executor --name kubent-executor --job-template job-template.yaml

Step 4 - Create a test

testkube create test --name kubent-test --type kubent

And now run the test to see if you're using any of the deprecated API versions.

testkube run test kubent-test

If you look at the logs of the Job, you should see something like this:

$ testkube watch execution kubent-test-1

Getting logs from test job 64820fce90a243e72062576c
5:28PM INF Target K8s version is 1.27.1
5:28PM INF Retrieved 6 resources from collector name=Cluster
5:28PM INF Retrieved 69 resources from collector name="Helm v3"
5:28PM INF Loaded ruleset name=custom.rego.tmpl
5:28PM INF Loaded ruleset name=deprecated-1-16.rego
5:28PM INF Loaded ruleset name=deprecated-1-22.rego
5:28PM INF Loaded ruleset name=deprecated-1-25.rego
5:28PM INF Loaded ruleset name=deprecated-1-26.rego
5:28PM INF Loaded ruleset name=deprecated-future.rego

.
Use following command to get test execution details:
$ kubectl testkube get execution 64820fce90a243e72062576c