KubeUpgradeRadar
An auditor that scans your Kubernetes manifests and live RBAC before a version upgrade and tells you exactly which permissions, CRDs and API paths will silently change behavior — including subtle ones like the k8s 1.31 port-forward WebSocket switch that flipped the required verb from create to get and broke tools like k9s for get-only users.
SREs and platform engineers planning a Kubernetes minor-version upgrade
- Pre-upgrade RBAC diff that flags roles relying on verbs or subresources whose semantics changed in the target version
- Workflow simulator that replays how kubectl, k9s and CI tools will behave post-upgrade
- Auto-generated patch YAMLs to add the missing get or create permissions
- Slack/Jira ticket creation with a remediation checklist per affected workload
The k9s bug is a textbook example of upgrades silently breaking get-only users — a class of incident every platform team hits once per minor release and currently debugs by hand.
Confirmed real recurring pain: K8s 1.31 WebSocket switch is documented (k8s.io blog, k9s issue #4144) and a 2026 SecurityBoulevard piece says a single minor upgrade can consume 4-6 weeks of engineering time across mid-size EKS deployments.Kubernetes Upgrades Are Eating Engineering Time: How to Get It Back ↗BUG: Port-forward pre-flight check always requires create on … ↗
Adjacent tools exist but cover slices only: Fairwinds Pluto (deprecated apiVersions), kubernetes-sigs/crdify (CRD diffs), alcide/rbac-tool (RBAC viz). None combine live RBAC + manifests + version-specific behavioral changes (e.g., SPDY→WebSocket verb switch) in one pre-upgrade audit.GitHub - FairwindsOps/pluto: A cli tool to help discover deprecated apiVersions ↗GitHub - kubernetes-sigs/crdify: a CLI tool to compare CRDs ↗
Buyer is platform/SRE teams who already pay for Fairwinds Insights, Rafay, ARMO, etc.; willingness-to-pay exists at team tier. However, the cited source trend (10 reactions on Dev.to) is weak viral signal and the overall SRE tooling market is small and procurement-heavy, capping upside.The Pulse of Enterprise Platform Teams: Cloud, Kubernetes and AI (Rafay survey) ↗Top 8 Kubernetes RBAC tools of 2025 - ARMO ↗
Kubernetes ships 3 minor releases/year with ongoing API deprecations, RBAC evolutions, and streaming-protocol changes (SPDY→WebSockets is the latest); the upgrade-audit problem re-occurs every minor, giving the product a durable, recurring wedge.Kubernetes 1.31: Streaming Transitions from SPDY to WebSockets ↗Kubernetes 1.36 Upgrade Guide: Breaking Changes & Pre-Upgrade Checklist ↗
Buildable but non-trivial: requires parsing manifests + Helm + live RBAC, maintaining a curated changelog of behavioral-breaking changes per minor, and reasoning about API verbs (SPDY vs WebSocket). Existing parsers (kubectl, Pluto) help, but the curated knowledge base and cluster-mode live audits add real engineering.GitHub - FairwindsOps/pluto: A cli tool to help discover deprecated apiVersions ↗Handling Breaking CRD Changes ↗