Deprecated API scanner

Choose a target version. Removed APIs are listed with evidence from the dated pack, and supported ones get a proposed patch you can review before applying.

Target KubernetesSchema pack 2026.10.0, self-authored. What it covers

Manifests

Opening local draft…

# Synthetic legacy manifests
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: legacy
  namespace: shop
  annotations:
    kubernetes.io/ingress.class: nginx
spec:
  rules:
    - host: legacy.example.com
      http:
        paths:
          - path: /
            backend:
              serviceName: web
              servicePort: 80
---
apiVersion: apps/v1beta1
kind: Deployment
metadata:
  name: worker
  namespace: shop
spec:
  replicas: 2
  template:
    metadata:
      labels: { app: worker }
    spec:
      containers:
        - name: worker
          image: registry.example.com/shop/worker:0.8.0
---
apiVersion: batch/v1beta1
kind: CronJob
metadata:
  name: nightly
  namespace: shop
spec:
  schedule: "0 3 * * *"
  jobTemplate:
    spec:
      template:
        spec:
          restartPolicy: OnFailure
          containers:
            - name: report
              image: registry.example.com/shop/report:1.0.0
---
apiVersion: policy/v1beta1
kind: PodDisruptionBudget
metadata:
  name: worker
  namespace: shop
spec:
  minAvailable: 1
  selector: {}
---
apiVersion: autoscaling/v2beta1
kind: HorizontalPodAutoscaler
metadata:
  name: worker
  namespace: shop
spec:
  scaleTargetRef: { apiVersion: apps/v1, kind: Deployment, name: worker }
  maxReplicas: 6
  metrics:
    - type: Resource
      resource:
        name: cpu
        targetAverageUtilization: 75

Findings for Kubernetes 1.31

Pack 2026.10.0, 2026-10-30

removed in 1.22line 2
extensions/v1beta1 Ingress/legacy → networking.k8s.io/v1
backend.serviceName/servicePort become backend.service.name/port.number|name; spec.backend becomes spec.defaultBackend; pathType is required.
removed in 1.16line 19
apps/v1beta1 Deployment/worker → apps/v1
spec.selector is required and immutable; StatefulSet default updateStrategy changed to RollingUpdate.
removed in 1.25line 34
batch/v1beta1 CronJob/nightly → batch/v1
Field structure is compatible. Review timeZone support and controller behavior differences in your target version.
removed in 1.25line 50
policy/v1beta1 PodDisruptionBudget/worker → policy/v1
An empty spec.selector ({}) selects NO pods in v1beta1 but ALL pods in the namespace in policy/v1. This is a semantic change, not a rename.
removed in 1.25line 59
autoscaling/v2beta1 HorizontalPodAutoscaler/worker → autoscaling/v2
targetAverageUtilization/targetAverageValue become target: {type, averageUtilization|averageValue}.

Proposed migration

Ingress/legacy (ns shop) extensions/v1beta1 → networking.k8s.io/v1

apiVersion: extensions/v1beta1 → networking.k8s.io/v1
spec.rules.0.http.paths.0.backend: serviceName/servicePort → service.name/port.number
spec.rules.0.http.paths.0: added pathType ImplementationSpecific (v1beta1 behaviour)

Review: spec.rules.0.http.paths.0.pathType: ImplementationSpecific preserves controller-defined matching. Consider Prefix or Exact for portable behaviour.

Review: The kubernetes.io/ingress.class annotation ("nginx") is deprecated; consider spec.ingressClassName. Not changed automatically because controllers differ.

Deployment/worker (ns shop) apps/v1beta1 → apps/v1

apiVersion: apps/v1beta1 → apps/v1
Added spec.selector.matchLabels copied from the pod template labels (apps/v1 no longer defaults it).

Review: spec.selector is immutable after creation. If the live object had a different defaulted selector, applying this changes it and the API server will reject the update; you may need to recreate the object.

Review: Defaults differ in apps/v1 (e.g. revisionHistoryLimit 10, maxSurge/maxUnavailable 25%). Set them explicitly if you relied on the old defaults.

CronJob/nightly (ns shop) batch/v1beta1 → batch/v1

apiVersion: batch/v1beta1 → batch/v1

Review: Review: Field structure is compatible. Review timeZone support and controller behavior differences in your target version.

PodDisruptionBudget/worker (ns shop) policy/v1beta1 → policy/v1

apiVersion: policy/v1beta1 → policy/v1

Review: SEMANTIC CHANGE: spec.selector is empty. In policy/v1beta1 that selected no pods; in policy/v1 it selects EVERY pod in the namespace. Confirm this is intended before applying.

HorizontalPodAutoscaler/worker (ns shop) autoscaling/v2beta1 → autoscaling/v2

apiVersion: autoscaling/v2beta1 → autoscaling/v2
metrics[0].resource.targetAverageUtilization → target {type: Utilization}

Patch preview

Field-aware rewrite of the documents above. Comments elsewhere are kept.

Passes pack schema (partial coverage)10 warning(s)Kubernetes 1.31, pack 2026.10.0

container "worker" does not set allowPrivilegeEscalation: false.

container "worker": runAsNonRoot is not true at container or pod level.

container "worker" does not drop ALL capabilities.

container "worker": seccompProfile is unset at container and pod level.

container "worker" has no resources.requests (BestEffort QoS).

container "report" does not set allowPrivilegeEscalation: false.

container "report": runAsNonRoot is not true at container or pod level.

container "report" does not drop ALL capabilities.

1# Synthetic legacy manifests

− 2apiVersion: extensions/v1beta1

+ 2apiVersion: networking.k8s.io/v1

3kind: Ingress

4metadata:

5 name: legacy

6 namespace: shop

7 annotations:

8 kubernetes.io/ingress.class: nginx

9spec:

10 rules:

11 - host: legacy.example.com

12 http:

13 paths:

14 - path: /

15 backend:

− 16 serviceName: web

− 17 servicePort: 80

+ 16 service:

+ 17 name: web

+ 18 port:

+ 19 number: 80

+ 20 pathType: ImplementationSpecific

18---

− 19apiVersion: apps/v1beta1

+ 22apiVersion: apps/v1

20kind: Deployment

21metadata:

22 name: worker

23 namespace: shop

24spec:

25 replicas: 2

26 template:

27 metadata:

28 labels: { app: worker }

29 spec:

30 containers:

31 - name: worker

32 image: registry.example.com/shop/worker:0.8.0

+ 36 selector:

+ 37 matchLabels:

+ 38 app: worker

33---

− 34apiVersion: batch/v1beta1

+ 40apiVersion: batch/v1

35kind: CronJob

36metadata:

37 name: nightly

38 namespace: shop

39spec:

40 schedule: "0 3 * * *"

41 jobTemplate:

42 spec:

43 template:

44 spec:

45 restartPolicy: OnFailure

46 containers:

47 - name: report

48 image: registry.example.com/shop/report:1.0.0

49---

− 50apiVersion: policy/v1beta1

+ 56apiVersion: policy/v1

51kind: PodDisruptionBudget

52metadata:

53 name: worker

54 namespace: shop

55spec:

56 minAvailable: 1

57 selector: {}

58---

− 59apiVersion: autoscaling/v2beta1

+ 65apiVersion: autoscaling/v2

60kind: HorizontalPodAutoscaler

61metadata:

62 name: worker

63 namespace: shop

64spec:

65 scaleTargetRef: { apiVersion: apps/v1, kind: Deployment, name: worker }

66 maxReplicas: 6

67 metrics:

68 - type: Resource

69 resource:

70 name: cpu

− 71 targetAverageUtilization: 75

+ 77 target:

+ 78 type: Utilization

+ 79 averageUtilization: 75

Removal pack contents (28 entries, 2026-10-30)

Hand-compiled from the public Kubernetes Deprecated API Migration Guide. Covers removals in 1.16 through 1.32 for the listed kinds.

API	Kinds	Removed	Replacement	Status for 1.31	Automatic transform
extensions/v1beta1	Deployment, DaemonSet, ReplicaSet	1.16	apps/v1	removed	field-aware
apps/v1beta1	Deployment, StatefulSet	1.16	apps/v1	removed	field-aware
apps/v1beta2	Deployment, StatefulSet, DaemonSet, ReplicaSet	1.16	apps/v1	removed	field-aware
extensions/v1beta1	NetworkPolicy	1.16	networking.k8s.io/v1	removed	rename + review
extensions/v1beta1	PodSecurityPolicy	1.16	policy/v1beta1	removed	manual
extensions/v1beta1	Ingress	1.22	networking.k8s.io/v1	removed	field-aware
networking.k8s.io/v1beta1	Ingress	1.22	networking.k8s.io/v1	removed	field-aware
networking.k8s.io/v1beta1	IngressClass	1.22	networking.k8s.io/v1	removed	rename + review
rbac.authorization.k8s.io/v1beta1	ClusterRole, ClusterRoleBinding, Role, RoleBinding	1.22	rbac.authorization.k8s.io/v1	removed	rename + review
apiextensions.k8s.io/v1beta1	CustomResourceDefinition	1.22	apiextensions.k8s.io/v1	removed	manual
admissionregistration.k8s.io/v1beta1	MutatingWebhookConfiguration, ValidatingWebhookConfiguration	1.22	admissionregistration.k8s.io/v1	removed	manual
scheduling.k8s.io/v1beta1	PriorityClass	1.22	scheduling.k8s.io/v1	removed	rename + review
storage.k8s.io/v1beta1	CSIDriver, CSINode, StorageClass, VolumeAttachment	1.22	storage.k8s.io/v1	removed	rename + review
certificates.k8s.io/v1beta1	CertificateSigningRequest	1.22	certificates.k8s.io/v1	removed	manual
coordination.k8s.io/v1beta1	Lease	1.22	coordination.k8s.io/v1	removed	rename + review
apiregistration.k8s.io/v1beta1	APIService	1.22	apiregistration.k8s.io/v1	removed	rename + review
batch/v1beta1	CronJob	1.25	batch/v1	removed	rename + review
discovery.k8s.io/v1beta1	EndpointSlice	1.25	discovery.k8s.io/v1	removed	manual
events.k8s.io/v1beta1	Event	1.25	events.k8s.io/v1	removed	manual
autoscaling/v2beta1	HorizontalPodAutoscaler	1.25	autoscaling/v2	removed	field-aware
policy/v1beta1	PodDisruptionBudget	1.25	policy/v1	removed	field-aware
policy/v1beta1	PodSecurityPolicy	1.25	—	removed	manual
node.k8s.io/v1beta1	RuntimeClass	1.25	node.k8s.io/v1	removed	rename + review
autoscaling/v2beta2	HorizontalPodAutoscaler	1.26	autoscaling/v2	removed	rename + review
flowcontrol.apiserver.k8s.io/v1beta1	FlowSchema, PriorityLevelConfiguration	1.26	flowcontrol.apiserver.k8s.io/v1	removed	manual
storage.k8s.io/v1beta1	CSIStorageCapacity	1.27	storage.k8s.io/v1	removed	rename + review
flowcontrol.apiserver.k8s.io/v1beta2	FlowSchema, PriorityLevelConfiguration	1.29	flowcontrol.apiserver.k8s.io/v1	removed	manual
flowcontrol.apiserver.k8s.io/v1beta3	FlowSchema, PriorityLevelConfiguration	1.32	flowcontrol.apiserver.k8s.io/v1	still served	manual

Migration is not a rename

Some migrations are pure renames, like batch/v1beta1 CronJob to batch/v1. Others change fields or meaning. Ingress backends change shape and pathType becomes required. apps/v1 no longer infers spec.selector. An empty PodDisruptionBudget selector selects nothing in policy/v1beta1 but everything in policy/v1. The assistant rewrites known fields and lists everything it could not decide.

What the pack cannot know

The pack says which versions of upstream Kubernetes stopped serving an API. Your cluster may differ through runtime-config flags or managed-service policies, so check what your API server actually serves.

Questions

Does it change apiVersion with find-and-replace?

No. Each document is parsed, fields are transformed per kind, and the result is shown as a diff with unresolved notes. You decide whether to apply it.

How current is the pack?

The pack version and date are shown with every result. It covers removals from 1.16 through 1.32.

Other tools

Manifest editorEdit multi-document Kubernetes YAML with per-document identity, duplicate detection, a relationship graph with an accessible table, and findings tied to source lines.YAML validatorValidate Kubernetes YAML against a versioned schema pack with separate YAML, schema, cross-object and policy findings.Deployment generatorGenerate a Deployment with Service, Ingress, PodDisruptionBudget and HPA: named ports, probes, requests and a hardened security context, validated as you type.Service generatorBuild ClusterIP, NodePort, LoadBalancer, headless and ExternalName Services, and check selector and targetPort mapping against a pasted workload.Resource calculatorExact Kubernetes quantity parsing (100m vs 100Mi), unit conversion, and requests/limits totals that account for init containers, native sidecars, replicas, rollout surge and overhead.RBAC analyzerInspect Roles, ClusterRoles and bindings offline: subject-to-permission matrix, aggregated-role handling, risky verbs, and "can this subject do X" checks scoped to the supplied rules.NetworkPolicy explainerExplain which pods each NetworkPolicy isolates and test traffic scenarios between pods, namespaces and IPs with additive allow-list reasoning.Probe builderBuild liveness, readiness and startup probes and see their timing: when the first check runs, how long until a failure triggers action, and what that action is.Manifest diffCompare two Kubernetes bundles by text or by object: objects matched by identity, list items matched by name, and status or server fields ignored only when you choose.CronJob schedulePreview the next runs of a Kubernetes CronJob schedule in its spec.timeZone, explain concurrency and deadline settings, and catch TZ= in the schedule string.Secret encoderEncode and decode Kubernetes Secret values locally, build Secret YAML with data or stringData, and inspect an existing Secret with values masked by default.Redact exportFind Secret data, tokens, credential-bearing env values and last-applied annotations in Kubernetes YAML, review each one, and export a redacted copy.TemplatesSynthetic Kubernetes templates with safe defaults — web app, StatefulSet, CronJob, NetworkPolicy, RBAC, HPA, sidecar — each tested against the schema pack for every supported version.