kubepug VS sample-mutatingwebhook

Agreed. The tooling around upgrades is painfully atrocious, and stuff like kubepug [1] should be part of the Kubernetes core.

[1] https://github.com/kubepug/kubepug

Not strictly related to security, but I find kubepug awesome when planning upgrades, especially if you need to jump across 2 or 3 major versions.

Also kubepug - https://github.com/rikatz/kubepug

References Kubepug net-forward Krew

Verify with a tool like kubepug, something like

kube-pug - is a plugin known as deprecations in krew. Every cluster needs to be upgraded sooner or later and at some point you will run into API deprecations and/or removals. Finding what's being deprecated can be long and error-prone process and this plugin tries to simplify that. All you need to do is run kubectl deprecations --k8s-version=v1.XX.X and you will get list of all the instances of API objects in cluster that will be deprecated or removed in the specified version.

Kubepug - Only checks whether the existing objects have any Deprecated ApiVersions

I believe there are some breaking changes to the AdmissionRegistration API as well if you are using admission/mutating webhooks. A couple of months back we went through the exercise of upgrading our mutating webhook to work with 1.22 versions and above. We have put together a sample mutating webhook project that you may find helpful: https://github.com/cloud-ark/sample-mutatingwebhook

If you are working on developing or migrating Kubernetes mutating webhook to the v1 version of the AdmissionRegistration API (for Kubernetes v1.22 and above), check out this repo: https://github.com/cloud-ark/sample-mutatingwebhook We recently went through this exercise ourselves. It was quite involved. We have put together our learnings in this repo. Hope it saves you some time. Feedback/PRs are welcome.