Introduction to Pluto (Kubernetes tool)

 

Pluto is:

• CLI tool that helps users find deprecated Kubernetes API versions in your code repositories and Helm releases. 
• It's especially useful when upgrading Kubernetes clusters, as it identifies resources that need updating before the upgrade.
• It works against:
• Live clusters
• Helm charts
• Raw YAML
• Pluto will show which APIs are deprecated or removed, what version they were deprecated in, and what the replacement API should be.

Installation on Mac (https://pluto.docs.fairwinds.com/installation/#homebrew-tap):

% brew install FairwindsOps/tap/pluto

Let's see its CLI arguments:

% pluto                    

You must specify a sub-command.

A tool to detect Kubernetes apiVersions

Usage:

  pluto [flags]

  pluto [command]

Available Commands:

  completion            Generate the autocompletion script for the specified shell

  detect                Checks a single file or stdin for deprecated apiVersions.

  detect-all-in-cluster run all in-cluster detections

  detect-api-resources  detect-api-resources

  detect-files          detect-files

  detect-helm           detect-helm

  help                  Help about any command

  list-versions         Outputs a JSON object of the versions that Pluto knows about.

  version               Prints the current version of the tool.

Flags:

  -f, --additional-versions string        Additional deprecated versions file to add to the list. Cannot contain any existing versions

      --columns strings                   A list of columns to print. Mandatory when using --output custom, optional with --output markdown

      --components strings                A list of components to run checks for. If nil, will check for all found in versions.

  -h, --help                              help for pluto

      --ignore-deprecations               Ignore the default behavior to exit 2 if deprecated apiVersions are found. (Only show removed APIs, not just deprecated ones)

      --ignore-removals                   Ignore the default behavior to exit 3 if removed apiVersions are found. (Only show deprecated APIs, not removed ones)

      --ignore-unavailable-replacements   Ignore the default behavior to exit 4 if deprecated but unavailable apiVersions are found.

  -H, --no-headers                        When using the default or custom-column output format, don't print headers (default print headers).

  -r, --only-show-removed                 Only display the apiVersions that have been removed in the target version.

  -o, --output string                     The output format to use. (normal|wide|custom|json|yaml|markdown|csv) (default "normal")

  -t, --target-versions stringToString    A map of targetVersions to use. This flag supersedes all defaults in version files. (default [])

  -v, --v Level                           number for the log level verbosity

Use "pluto [command] --help" for more information about a command.

detect-files

To scan and detect deprecated APIs in manifest files in a directory:

% pluto detect-files -d /path/to/your/manifests

detect-files is for checking YAML files in our repositories/filesystem before deploying them - that's separate from detect-helm and detect-all-in-cluster cluster commands.

To target particular k8s version:

% pluto detect-files -d . --target-versions k8s=v1.33.0

If we use Terraform to deploy Helm charts, we might want to keep chart values in separate files (.yaml or .yaml.tpl) as otherwise we won't be able to use Pluto directly (we'd need to extract values into files first). For more details, see Where to keep Helm chart values in Terraform projects | My Public Notepad. 

detect-helm

To check Helm releases in the cluster (already deployed):

% pluto detect-helm -owide

To target particular k8s version:

% pluto detect-helm -owide --target-versions k8s=v1.33.0   

There were no resources found with known deprecated apiVersions.

detect-helm specifically checks Helm release metadata stored in our cluster (in secrets or configmaps) after Helm chart have been deployed. It looks at the manifests that Helm used to install releases, which might contain deprecated APIs even if they haven't been applied yet or are stored in Helm's history.

detect-all-in-cluster

To check all resources in the cluster:

% pluto detect-all-in-cluster -o wide

I0226 12:01:02.279788   47100 warnings.go:110] "Warning: v1 ComponentStatus is deprecated in v1.19+"

There were no resources found with known deprecated apiVersions.

detect-all-in-cluster scans all live resources currently running in our cluster by querying the Kubernetes API directly. It checks deployments, services, pods, etc. that are actively deployed.

detect-all-in-cluster does NOT include detect-helm or detect-files. Here's why they're separate:

• detect-all-in-cluster sees the current state of resources
• detect-helm sees Helm's stored templates and history, which may include:
• Templated manifests that haven't been rendered yet
• Old release revisions
• Chart templates with deprecated APIs
• Run both to get complete coverage!

Target a specific Kubernetes version:

% pluto detect-all-in-cluster --target-versions k8s=v1.33.0

I0226 12:02:26.551401   47113 warnings.go:110] "Warning: v1 ComponentStatus is deprecated in v1.19+"

There were no resources found with known deprecated apiVersions.

The warning message:

Warning: v1 ComponentStatus is deprecated in v1.19+

This is just Pluto itself triggering a Kubernetes API warning while scanning - it's not something wrong with our cluster resources.

The main result:

There were no resources found with known deprecated apiVersions.

This means all our cluster resources are using API versions that are still valid in Kubernetes v1.33.0 (our target version). This means:

• Our cluster resources are already compatible with k8s v1.33.0
• No manifests need updating before upgrading
• No deprecated APIs that would be removed in v1.33.0

To be thorough before a k8s upgrade, we need to run all three commands:

• detect-files
• detect-helm
• detect-all-in-cluster

---