rbac.authorization.k8s.io/v1beta1 should be flagged deprecated also

[sotoiwa]

All resources within the rbac.authorization.k8s.io/v1beta1 API groups are deprecated in favor of rbac.authorization.k8s.io/v1

$ kubectl get --raw /apis/rbac.authorization.k8s.io/v1beta1/clusterrolebindings > /dev/null
Warning: rbac.authorization.k8s.io/v1beta1 ClusterRoleBinding is deprecated in v1.17+, unavailable in v1.22+; use rbac.authorization.k8s.io/v1 ClusterRoleBinding

https://v1-17.docs.kubernetes.io/docs/setup/release/notes/#deprecations-and-removals

All resources within the rbac.authorization.k8s.io/v1alpha1 and rbac.authorization.k8s.io/v1beta1 API groups are deprecated in favor of rbac.authorization.k8s.io/v1, and will no longer be served in v1.20. (#84758, @liggitt)

[stepanstipl]

Thanks @sotoiwa, thanks for reporting this. This has been already merged to master in #160. You should be able to test this in the latest nightly pre-release, but the experience may vary as we've added quite a few resources, so before we cut the next release, we're looking to implement some intelligent filtering #130 to display only relevant resources. The groundwork for that has already been done in #139, so this should happen fairly soon.

[zcicala]

@stepanstipl It looks like the 160 PR adds the right fixture, but I think the rego should be updated from 1.8 to 1.17

[stepanstipl]

Hi @zcicala thanks, I originally took the info about this from the Deprecated API Migration Guide, and it seems to be correct -https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.8.md:

The rbac.authorization.k8s.io/v1beta1 API has been promoted to rbac.authorization.k8s.io/v1 with no changes. (#49642, @liggitt)

I think the terminology here is a bit unclear (the version for resources to be removed changed a few times), but the idea of thesince field was to signal from which version is the resource available so that we can recommend it to be upgraded. Arguably I guess we could only list since when it has been deprecated 🤷 . Maybe you have an example that would allow me to better understand?

[zcicala]

@stepanstipl Ah,, I think I understand now. I interpreted the since field as the version where this was deprecated.

Where does this project configure the version that an API is deprecate or removed?

[stepanstipl]

So this is currently not tracked on individual resources, but the rules are grouped by the K8S version when APIs are removed, you can see this in pkg/rules/rego:

$ ls pkg/rules/rego
custom.rego.tmpl        deprecated-1-16.rego    deprecated-1-22.rego    deprecated-1-25.rego

and in the output, it looks like:

...
__________________________________________________________________________________________
>>> Deprecated APIs removed in 1.22 <<<
------------------------------------------------------------------------------------------
...

I hope this makes sense. This might change in future to support some more advanced use-cases (see #154), but that's a bit of an open topic atm.

[stepanstipl]

I'm going to close this, as support for detecting rbac.authorization.k8s.io/v1beta1 as deprecated has now been added and is part of the latest 0.5.0 release. Please give it a go @sotoiwa, and let me know in case there are any issues. Cheers 🎉