{
  "packageId": "pkgId",
  "name": "deprek8ion",
  "normalizedName": "deprek8ion",
  "isOperator": false,
  "displayName": "Deprek8ion",
  "description": "A set of rego policies to monitor Kubernetes APIs deprecations",
  "keywords": ["monitoring", "kubernetes", "deprecations", "policies", "opa"],
  "homeUrl": "https://github.com/swade1987/deprek8ion",
  "readme": "# Deprek8ion 🕵️‍\n\nA set of rego policies to monitor Kubernetes APIs deprecations.\n\nThe Kubernetes API deprecations can be found using <https://relnotes.k8s.io/?markdown=deprecated>.\n\n## Docker image\n\nThe docker container contains the most recent version of [conftest](https://github.com/instrumenta/conftest) as well as the policies at `/policies`.\n\nImage tags can be found at [https://eu.gcr.io/swade1987/deprek8ion](https://eu.gcr.io/swade1987/deprek8ion)\n\n## Example usage\n\nAn example of how to use the docker container can be seen below:\n\n```sh\ndocker run --rm --name demo -v $(pwd)/demo:/demo eu.gcr.io/swade1987/deprek8ion:1.1.17 /demo/ingress.yaml\n```\n\nOr directly pipe some resources into the container:\n\n```sh\ncat ./demo/ingress.yaml | docker run --rm -i eu.gcr.io/swade1987/deprek8ion:1.1.17 -\n```\n",
  "links": [
    {
      "url": "https://github.com/swade1987/deprek8ion/tree/master/policies",
      "name": "source"
    }
  ],
  "data": {
    "policies": {
      "_cert-manager.rego": "package main\n\ndeny[msg] {\n  input.apiVersion == \"v1\"\n  input.kind == \"List\"\n  obj := input.items[_]\n  msg := _deny with input as obj\n}\n\ndeny[msg] {\n  input.apiVersion != \"v1\"\n  input.kind != \"List\"\n  msg := _deny\n}\n\nwarn[msg] {\n  input.apiVersion == \"v1\"\n  input.kind == \"List\"\n  obj := input.items[_]\n  msg := _warn with input as obj\n}\n\nwarn[msg] {\n  input.apiVersion != \"v1\"\n  input.kind != \"List\"\n  msg := _warn\n}\n\n# Based on https://github.com/jetstack/cert-manager/releases/tag/v0.11.0\n\n_deny = msg {\n  kinds := [\"Certificate\", \"Issuer\", \"ClusterIssuer\", \"CertificateRequest\"]\n  input.apiVersion == \"certmanager.k8s.io/v1alpha1\"\n  input.kind == kinds[_]\n  msg := sprintf(\"%s/%s: API certmanager.k8s.io/v1alpha1 for %s is obsolete, use cert-manager.io/v1alpha2 instead.\", [input.kind, input.metadata.name, input.kind])\n}\n\n_deny = msg {\n  kinds := [\"Order\", \"Challenge\"]\n  input.apiVersion == \"certmanager.k8s.io/v1alpha1\"\n  input.kind == kinds[_]\n  msg := sprintf(\"%s/%s: API certmanager.k8s.io/v1alpha1 for %s is obsolete, use acme.cert-manager.io/v1alpha2 instead.\", [input.kind, input.metadata.name, input.kind])\n}",
      "kubernetes-1.16.rego": "package main\n\ndeny[msg] {\n  input.apiVersion == \"v1\"\n  input.kind == \"List\"\n  obj := input.items[_]\n  msg := _deny with input as obj\n}\n\ndeny[msg] {\n  input.apiVersion != \"v1\"\n  input.kind != \"List\"\n  msg := _deny\n}\n\n# Based on https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.16.md\n\n# All resources under apps/v1beta1 and apps/v1beta2 - use apps/v1 instead\n_deny = msg {\n  apis := [\"apps/v1beta1\", \"apps/v1beta2\"]\n  input.apiVersion == apis[_]\n  msg := sprintf(\"%s/%s: API %s has been deprecated, use apps/v1 instead.\", [input.kind, input.metadata.name, input.apiVersion])\n}\n\n# daemonsets, deployments, replicasets resources under extensions/v1beta1 - use apps/v1 instead\n_deny = msg {\n  resources := [\"DaemonSet\", \"Deployment\", \"ReplicaSet\"]\n  input.apiVersion == \"extensions/v1beta1\"\n  input.kind == resources[_]\n  msg := sprintf(\"%s/%s: API extensions/v1beta1 for %s has been deprecated, use apps/v1 instead.\", [input.kind, input.metadata.name, input.kind])\n}\n\n# networkpolicies resources under extensions/v1beta1 - use networking.k8s.io/v1 instead\n_deny = msg {\n  input.apiVersion == \"extensions/v1beta1\"\n  input.kind == \"NetworkPolicy\"\n  msg := sprintf(\"%s/%s: API extensions/v1beta1 for NetworkPolicy has been deprecated, use networking.k8s.io/v1 instead.\", [input.kind, input.metadata.name])\n}\n\n# podsecuritypolicies resources under extensions/v1beta1 - use policy/v1beta1 instead\n_deny = msg {\n  input.apiVersion == \"extensions/v1beta1\"\n  input.kind == \"PodSecurityPolicy\"\n  msg := sprintf(\"%s/%s: API extensions/v1beta1 for PodSecurityPolicy has been deprecated, use policy/v1beta1 instead.\", [input.kind, input.metadata.name])\n}\n\n# PriorityClass resources will no longer be served from scheduling.k8s.io/v1beta1 and scheduling.k8s.io/v1alpha1 in v1.17.\n_deny = msg {\n  apis := [\"scheduling.k8s.io/v1beta1\", \"scheduling.k8s.io/v1alpha1\"]\n  input.apiVersion == apis[_]\n  input.kind == \"PriorityClass\"\n  msg := sprintf(\"%s/%s: API %s for PriorityClass has been deprecated, use scheduling.k8s.io/v1 instead.\", [input.kind, input.metadata.name, input.apiVersion])\n}",
      "kubernetes-1.17.rego": "package main\n\ndeny[msg] {\n  input.apiVersion == \"v1\"\n  input.kind == \"List\"\n  obj := input.items[_]\n  msg := _deny with input as obj\n}\n\ndeny[msg] {\n  input.apiVersion != \"v1\"\n  input.kind != \"List\"\n  msg := _deny\n}\n\n# Based on https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.16.md\n\n# PriorityClass resources will no longer be served from scheduling.k8s.io/v1beta1 and scheduling.k8s.io/v1alpha1 in v1.17.\n_deny = msg {\n  apis := [\"scheduling.k8s.io/v1beta1\", \"scheduling.k8s.io/v1alpha1\"]\n  input.apiVersion == apis[_]\n  input.kind == \"PriorityClass\"\n  msg := sprintf(\"%s/%s: API %s for PriorityClass has been deprecated, use scheduling.k8s.io/v1 instead.\", [input.kind, input.metadata.name, input.apiVersion])\n}",
      "kubernetes-1.18.rego": "package main\n\ndeny[msg] {\n  input.apiVersion == \"v1\"\n  input.kind == \"List\"\n  obj := input.items[_]\n  msg := _deny with input as obj\n}\n\ndeny[msg] {\n  input.apiVersion != \"v1\"\n  input.kind != \"List\"\n  msg := _deny\n}\n\n# Based on https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.18.md\n\n# Within Ingress resources spec.ingressClassName replaces the deprecated kubernetes.io/ingress.class annotation.\n_deny = msg {\n  resources := [\"Ingress\"]\n  input.kind == resources[_]\n  input.metadata.annotations[\"kubernetes.io/ingress.class\"]\n  msg := sprintf(\"%s/%s: Ingress annotation kubernetes.io/ingress.class has been deprecated in 1.18, use spec.IngressClassName instead.\", [input.kind, input.metadata.name])\n}",
      "kubernetes-1.19.rego": "package main\n\nwarn[msg] {\n  input.apiVersion == \"v1\"\n  input.kind == \"List\"\n  obj := input.items[_]\n  msg := _warn with input as obj\n}\n\nwarn[msg] {\n  input.apiVersion != \"v1\"\n  input.kind != \"List\"\n  msg := _warn\n}\n\n# Based on https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.16.md\n# Based on https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.19.md\n\n# The apiextensions.k8s.io/v1beta1 version of CustomResourceDefinition is deprecated in 1.19. Migrate to use apiextensions.k8s.io/v1 instead\n_warn = msg {\n  input.apiVersion == \"apiextensions.k8s.io/v1beta1\"\n  input.kind == \"CustomResourceDefinition\"\n msg := sprintf(\"%s/%s: API apiextensions.k8s.io/v1beta1 for CustomResourceDefinition is deprecated in 1.19, use apiextensions.k8s.io/v1 instead.\", [input.kind, input.metadata.name])\n}\n\n# The apiregistration.k8s.io/v1beta1 version is deprecated in 1.19. Migrate to use apiregistration.k8s.io/v1 instead\n_warn = msg {\n  input.apiVersion == \"apiregistration.k8s.io/v1beta1\"\n  msg := sprintf(\"%s/%s: API apiregistration.k8s.io/v1beta1 is deprecated in Kubernetes 1.19, use apiregistration.k8s.io/v1 instead.\", [input.kind, input.metadata.name])\n}\n\n# The authentication.k8s.io/v1beta1 version is deprecated in 1.19. Migrate to use authentication.k8s.io/v1 instead\n_warn = msg {\n  input.apiVersion == \"authentication.k8s.io/v1beta1\"\n  msg := sprintf(\"%s/%s: API authentication.k8s.io/v1beta1 is deprecated in Kubernetes 1.19, use authentication.k8s.io/v1 instead.\", [input.kind, input.metadata.name])\n}\n\n# The authorization.k8s.io/v1beta1 version is deprecated in 1.19. Migrate to use authorization.k8s.io/v1 instead\n_warn = msg {\n  input.apiVersion == \"authorization.k8s.io/v1beta1\"\n  msg := sprintf(\"%s/%s: API authorization.k8s.io/v1beta1 is deprecated in Kubernetes 1.19, use authorization.k8s.io/v1 instead.\", [input.kind, input.metadata.name])\n}\n\n# The autoscaling/v2beta1 version is deprecated in 1.19. Migrate to use autoscaling/v2beta2 instead\n_warn = msg {\n  input.apiVersion == \"autoscaling/v2beta1\"\n  msg := sprintf(\"%s/%s: API autoscaling/v2beta1 is deprecated in Kubernetes 1.19, use autoscaling/v2beta2 instead.\", [input.kind, input.metadata.name])\n}\n\n# The coordination.k8s.io/v1beta1 version is deprecated in 1.19. Migrate to use coordination.k8s.io/v1 instead\n_warn = msg {\n  input.apiVersion == \"coordination.k8s.io/v1beta1\"\n  msg := sprintf(\"%s/%s: API coordination.k8s.io/v1beta1 is deprecated in Kubernetes 1.19, use coordination.k8s.io/v1 instead.\", [input.kind, input.metadata.name])\n}\n\n# The storage.k8s.io/v1beta1 version is deprecated in 1.19. Migrate to use storage.k8s.io/v1 instead\n_warn = msg {\n  input.apiVersion == \"storage.k8s.io/v1beta1\"\n  msg := sprintf(\"%s/%s: API storage.k8s.io/v1beta1 is deprecated in Kubernetes 1.19, use storage.k8s.io/v1 instead.\", [input.kind, input.metadata.name])\n}\n",
      "kubernetes-1.20.rego": "package main\n\nwarn[msg] {\n  input.apiVersion == \"v1\"\n  input.kind == \"List\"\n  obj := input.items[_]\n  msg := _warn with input as obj\n}\n\nwarn[msg] {\n  input.apiVersion != \"v1\"\n  input.kind != \"List\"\n  msg := _warn\n}\n\n# Based on https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.16.md\n\n# Ingress resources will no longer be served from extensions/v1beta1 in v1.20. Migrate use to the networking.k8s.io/v1beta1 API, available since v1.14.\n_warn = msg {\n  input.apiVersion == \"extensions/v1beta1\"\n  input.kind == \"Ingress\"\n  msg := sprintf(\"%s/%s: API extensions/v1beta1 for Ingress is deprecated from Kubernetes 1.20, use networking.k8s.io/v1beta1 instead.\", [input.kind, input.metadata.name])\n}\n\n# All resources will no longer be served from rbac.authorization.k8s.io/v1alpha1 and rbac.authorization.k8s.io/v1beta1 in 1.20. Migrate to use rbac.authorization.k8s.io/v1 instead\n_warn = msg {\n  apis := [\"rbac.authorization.k8s.io/v1alpha1\", \"rbac.authorization.k8s.io/v1beta1\"]\n  input.apiVersion == apis[_]\n  msg := sprintf(\"%s/%s: API %s is deprecated from Kubernetes 1.20, use rbac.authorization.k8s.io/v1 instead.\", [input.kind, input.metadata.name, input.apiVersion])\n}\n\n# Ingress resources will no longer be served from extensions/v1beta1 in v1.20. Migrate use to the networking.k8s.io/v1beta1 API, available since v1.14.\n_warn = msg {\n  input.apiVersion == \"extensions/v1beta1\"\n  input.kind == \"Ingress\"\n  msg := sprintf(\"%s/%s: API extensions/v1beta1 for Ingress is deprecated from Kubernetes 1.20, use networking.k8s.io/v1beta1 instead.\", [input.kind, input.metadata.name])\n}",
      "kubernetes-1.22.rego": "package main\n\nwarn[msg] {\n  input.apiVersion == \"v1\"\n  input.kind == \"List\"\n  obj := input.items[_]\n  msg := _warn with input as obj\n}\n\nwarn[msg] {\n  input.apiVersion != \"v1\"\n  input.kind != \"List\"\n  msg := _warn\n}\n\n# Based on https://github.com/kubernetes/kubernetes/issues/82021\n\n# The admissionregistration.k8s.io/v1beta1 versions of MutatingWebhookConfiguration and ValidatingWebhookConfiguration are deprecated in 1.19. Migrate to use admissionregistration.k8s.io/v1 instead\n_warn = msg {\n  kinds := [\"MutatingWebhookConfiguration\", \"ValidatingWebhookConfiguration\"]\n  input.apiVersion == \"admissionregistration.k8s.io/v1beta1\"\n  input.kind == kinds[_]\n  msg := sprintf(\"%s/%s: API admissionregistration.k8s.io/v1beta1 is deprecated in Kubernetes 1.22, use admissionregistration.k8s.io/v1 instead.\", [input.kind, input.metadata.name])\n}\n",
      "_service-account.rego": "package main\n\nwarn[msg] {\n  input.apiVersion == \"v1\"\n  input.kind == \"List\"\n  obj := input.items[_]\n  msg := _warn with input as obj\n}\n\nwarn[msg] {\n  input.apiVersion != \"v1\"\n  input.kind != \"List\"\n  msg := _warn\n}\n\n# Based on https://github.com/kubernetes/kubernetes/issues/47198\n# Warn about the deprecated serviceAccount field in podSpec.\n\n_warn = msg {\n  resources := [\"Pod\"]\n  input.kind == resources[_]\n  input.spec.serviceAccount\n  msg := sprintf(\"%s/%s: The serviceAccount field in the podSpec will be deprecated soon, use serviceAccountName instead.\", [input.kind, input.metadata.name])\n}\n\n_warn = msg {\n  resources := [\"CronJob\"]\n  input.kind == resources[_]\n  input.spec.jobTemplate.spec.template.spec.serviceAccount\n  msg := sprintf(\"%s/%s: The serviceAccount field in the podSpec will be deprecated soon, use serviceAccountName instead.\", [input.kind, input.metadata.name])\n}\n\n_warn = msg {\n  resources := [\"Deployment\", \"DaemonSet\", \"Job\", \"ReplicaSet\", \"ReplicationController\", \"StatefulSet\"]\n  input.kind == resources[_]\n  input.spec.template.spec.serviceAccount\n  msg := sprintf(\"%s/%s: The serviceAccount field in the podSpec will be deprecated soon, use serviceAccountName instead.\", [input.kind, input.metadata.name])\n}\n\n"
    }
  },
  "version": "0.1.0",
  "availableVersions": [
    {
      "version": "0.1.0",
      "ts": 1595872800
    }
  ],
  "deprecated": false,
  "license": "MIT",
  "signed": false,
  "containersImages": [
    {
      "image": "eu.gcr.io/swade1987/deprek8ion:1.1.17"
    }
  ],
  "provider": "Provider name",
  "ts": 1595872800,
  "maintainers": [
    {
      "name": "Maintainer 1",
      "email": "maintainer@email.com"
    }
  ],
  "repository": {
    "url": "https://github.com/swade1987/deprek8ion/policies",
    "kind": 2,
    "name": "deprek8ion",
    "userAlias": "alias",
    "displayName": "deprek8ion",
    "repositoryId": "repoId"
  }
}
