apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: check-deprecated-apis
  annotations:
    policies.kyverno.io/title: Check deprecated APIs
    policies.kyverno.io/category: Best Practices
    policies.kyverno.io/subject: Kubernetes APIs
    kyverno.io/kyverno-version: 1.7.4
    policies.kyverno.io/minversion: 1.7.4
    kyverno.io/kubernetes-version: "1.23"
    policies.kyverno.io/description: >-
      Kubernetes APIs are sometimes deprecated and removed after a few releases.
      As a best practice, older API versions should be replaced with newer versions.
      This policy validates for APIs that are deprecated or scheduled for removal.
      Note that checking for some of these resources may require modifying the Kyverno
      ConfigMap to remove filters. In the validate-v1-22-removals rule, the Lease kind
      has been commented out due to a check for this kind having a performance penalty
      on Kubernetes clusters with many leases. Its enabling should be attended carefully
      and is not recommended on large clusters. PodSecurityPolicy is removed in v1.25
      so therefore the validate-v1-25-removals rule may not completely work on 1.25+.
      This policy requires Kyverno v1.7.4+ to function properly.
spec:
  validationFailureAction: audit
  background: true
  rules:
  - name: validate-v1-25-removals
    match:
      any:
      - resources:
          # NOTE: PodSecurityPolicy is completely removed in 1.25.
          kinds:
          - batch/*/CronJob
          - discovery.k8s.io/*/EndpointSlice
          - events.k8s.io/*/Event
          - policy/*/PodDisruptionBudget
          - node.k8s.io/*/RuntimeClass
    preconditions:
      all:
      - key: "{{ request.operation || 'BACKGROUND' }}"
        operator: NotEquals
        value: DELETE
      - key: "{{request.object.apiVersion}}"
        operator: AnyIn
        value:
        - batch/v1beta1
        - discovery.k8s.io/v1beta1
        - events.k8s.io/v1beta1
        - policy/v1beta1
        - node.k8s.io/v1beta1
    validate:
      message: >-
        {{ request.object.apiVersion }}/{{ request.object.kind }} is deprecated and will be removed in v1.25.
        See: https://kubernetes.io/docs/reference/using-api/deprecation-guide/
      deny: {}
  - name: validate-v1-26-removals
    match:
      any:
      - resources:
          kinds:
          - flowcontrol.apiserver.k8s.io/*/FlowSchema
          - flowcontrol.apiserver.k8s.io/*/PriorityLevelConfiguration
          - autoscaling/*/HorizontalPodAutoscaler
    preconditions:
      all:
      - key: "{{ request.operation || 'BACKGROUND' }}"
        operator: NotEquals
        value: DELETE
      - key: "{{request.object.apiVersion}}"
        operator: AnyIn
        value:
        - flowcontrol.apiserver.k8s.io/v1beta1
        - autoscaling/v2beta2
    validate:
      message: >-
        {{ request.object.apiVersion }}/{{ request.object.kind }} is deprecated and will be removed in v1.26.
        See: https://kubernetes.io/docs/reference/using-api/deprecation-guide/
      deny: {}
  - name: validate-v1-27-removals
    match:
      any:
      - resources:
          kinds:
          - storage.k8s.io/*/CSIStorageCapacity
    preconditions:
      all:
      - key: "{{ request.operation || 'BACKGROUND' }}"
        operator: NotEquals
        value: DELETE
      - key: "{{request.object.apiVersion}}"
        operator: AnyIn
        value:
        - storage.k8s.io/v1beta1
    validate:
      message: >-
        {{ request.object.apiVersion }}/{{ request.object.kind }} is deprecated and will be removed in v1.27.
        See: https://kubernetes.io/docs/reference/using-api/deprecation-guide/
      deny: {}
  - name: validate-v1-29-removals
    match:
      any:
      - resources:
          kinds:
          - flowcontrol.apiserver.k8s.io/*/FlowSchema
          - flowcontrol.apiserver.k8s.io/*/PriorityLevelConfiguration
    preconditions:
      all:
      - key: "{{ request.operation || 'BACKGROUND' }}"
        operator: NotEquals
        value: DELETE
      - key: "{{request.object.apiVersion}}"
        operator: AnyIn
        value:
        - flowcontrol.apiserver.k8s.io/v1beta2
    validate:
      message: >-
        {{ request.object.apiVersion }}/{{ request.object.kind }} is deprecated and will be removed in v1.29.
        See: https://kubernetes.io/docs/reference/using-api/deprecation-guide/
      deny: {}