Login

simon / Kubernetes

Last active 1 month ago

Like 0
cmd knowledgebase

simon revised this gist 1 month ago · 2808ddc

1 file changed, 220 insertions

kubernetes.md (file created)
@@ -0,0 +1,220 @@
1 + # kubernetes
2 +
3 + * get all secrets without column headers:
4 +
5 + ```
6 + kubectl get secrets -o custom-columns=NAME:.metadata.name --no-headers=true
7 + ```
8 +
9 + * get all pods on a node:
10 +
11 + ```
12 + kg po --field-selector spec.nodeName=worker-c7j8z-7bc5db6557-dbcfz
13 + ```
14 +
15 + * get events for a specific resource:
16 +
17 + ```
18 + kubectl get events --field-selector involvedObject.kind=Pod,involvedObject.name=kube-proxy-4x6h2
19 + ```
20 +
21 + * show every resource in a namespace:
22 +
23 + ```
24 + kubectl api-resources --verbs=list --namespaced -o name | xargs -n 1 kubectl get --show-kind --ignore-not-found -n NAMESPACE
25 + ```
26 +
27 + * impersonate a service account:
28 +
29 + ```
30 + kubectl auth can-i $verb $resource/$name --as=system:serviceaccount:$namespace:$serviceaccount
31 +
32 + kubectl auth can-i use psp/kong-kong-app-psp --as=system:serviceaccount:giantswarm:kong-kong-app
33 + ```
34 +
35 + ```
36 + kubectl auth can-i get DNSEndpoint/sidero -n kube-system --as=system:serviceaccount:external-dns:external-dns
37 + ```
38 +
39 + * get logs from previous pod if it has died:
40 +
41 + ```
42 + kubectl logs --previous traefik-ingress-controller-zcspk --namespace kube-system
43 + ```
44 +
45 + * temporarily disable a daemonset, and re-enable it later:
46 +
47 + ```
48 + kubectl patch ds dsname -p '{"spec": {"template": {"spec": {"nodeSelector": {"non-existing": "true"}}}}}'
49 + kubectl patch ds dsname -p --type json -p='[{"op": "remove", "path": "/spec/template/spec/nodeSelector/non-existing"}]'
50 + k patch app rook-operator --type='json' -p='[{"op": "replace", "path": "/spec/version", "value": "2.5.0"}]'
51 + ```
52 +
53 + * roll back a deployment:
54 +
55 + ```
56 + kubectl rollout history deploy/name
57 +
58 + deployment.extensions/name
59 +
60 + REVISION CHANGE-CAUSE
61 +
62 + 276 <none>
63 + 277 <none>
64 + 278 <none>
65 + 279 <none>
66 + kubectl rollout undo deployment/happa --to-revision 279
67 +
68 + deployment.extensions/happa rolled back
69 + ```
70 +
71 + * get all evicted pods:
72 +
73 + ```
74 + kubectl get pods --all-namespaces -o json | jq '.items[] | select(.status.reason!=null) | select(.status.reason | contains("Evicted"))'
75 + ```
76 +
77 + * delete all failed pods:
78 +
79 + ```
80 + kubectl -n default delete pods --field-selector=status.phase=Failed
81 + ```
82 +
83 + * find pods consuming disk space:
84 +
85 + ```
86 + TOP_STORAGE=$(du -hs /var/lib/docker/overlay2/* | grep -Ee '^[0-9]{3}[M]+|[0-9]G' | sort -h |tail -n 10 |tee -a /dev/stderr |awk '{print $2}'|xargs|sed 's/ /|/g')
87 +
88 + docker inspect $(docker ps -q) | jq '.[]|.Config.Hostname,.Config.Labels."io.kubernetes.pod.name",.GraphDriver.Data.MergedDir,.hovno' | egrep -B2 "$TOP_STORAGE"
89 +
90 + docker image inspect $(docker images -aq) | jq '.[]|.RepoDigests[0],.GraphDriver.Data.MergedDir,.hovno' |egrep -B2 "$TOP_STORAGE"
91 + ```
92 +
93 + * find service pods which can use a specific PSP:
94 +
95 + ```
96 + kubectl get rolebindings,clusterrolebindings -A -o custom-columns='KIND:kind,NAMESPACE:metadata.namespace,NAME:metadata.name,SERVICE_ACCOUNTS:subjects[?(@.kind=="ServiceAccount")].name' | grep privileged
97 + ```
98 +
99 + * get all nodes and their taints:
100 +
101 + ```
102 + kubectl get nodes -o=jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.metadata.labels.kubernetes\.io/role}{"\t"}{.spec.taints}{"\n"}{end}'
103 + ```
104 +
105 + * show tainted nodes and their taints:
106 +
107 + ```
108 + kubectl get nodes -o=jsonpath='{range .items[?(@.spec.taints)]}{.metadata.name}{"\t"}{.metadata.labels.kubernetes\.io/role}{"\t"}{.spec.taints}{"\n"}{end}'
109 + ```
110 +
111 + * find all pods which have unhealthy containers:
112 +
113 + ```
114 + kubectl get po --all-namespaces | gawk 'match($3, /([0-9]+)\/([0-9]+)/, a) {if (a[1] < a[2] && $4 != "Completed") print}'
115 + ```
116 +
117 + * find all pods with `hostNetwork: true`:
118 +
119 + ```
120 + ykg po | yq -r '.items[] | select(.spec.hostNetwork == true).metadata.name'
121 + ```
122 +
123 + * work around bug in `sops`:
124 +
125 + ```
126 + sops --config <(echo '') --encrypt --input-type yaml --output-type yaml ./my-secret.yaml
127 + ```
128 +
129 + * view old CRD version:
130 +
131 + ```
132 + k explain helmrepository.spec --api-version source.toolkit.fluxcd.io/v1beta1
133 + ```
134 +
135 + * check out node resources:
136 +
137 + ```
138 + kdes no -l giantswarm.io/node-pool=worker |grep "Allocated resources" -A6
139 +
140 + Allocated resources:
141 + (Total limits may be over 100 percent, i.e., overcommitted.)
142 + Resource Requests Limits
143 + -------- -------- ------
144 + cpu 3678m (91%) 4295m (107%)
145 + memory 4327953122 (26%) 7271217318 (43%)
146 + ephemeral-storage 0 (0%) 0 (0%)
147 + ```
148 +
149 + * delete namespace stuck finalising:
150 +
151 + ```
152 + NS=broken-namespace
153 +
154 + k get namespace $NS -ojson | k neat | jq '.spec.finalizers=null' > ns.json
155 +
156 + kubectl proxy
157 +
158 + # from another terminal in the same context:
159 +
160 + curl -k -H "Content-Type: application/json" -X PUT --data-binary @ns.json http://127.0.0.1:8001/api/v1/namespaces/$NS/finalize
161 + ```
162 +
163 + or as a one-liner:
164 +
165 + ```
166 + NS=test
167 +
168 + k get namespace $NS -ojson | k neat | jq '.spec.finalizers=null' > /tmp/ns.json && k proxy& sleep 2 && curl -k -H "Content-Type: application/json" -X PUT --data-binary @/tmp/ns.json http://127.0.0.1:8001/api/v1/namespaces/$NS/finalize && pkill kubectl
169 + ```
170 +
171 + observing traffic with hubble
172 +
173 + ```
174 + hubble observe -4 -f --to-pod vpn-proxy/vpn-proxy-ccbcb9bb7-8v5rq
175 + ```
176 +
177 + ```
178 + k port-forward -n kube-system svc/hubble-relay --address 0.0.0.0 --address :: 4245:80
179 +
180 + hubble observe -4 -f --to-pod vpn-proxy/vpn-proxy-ccbcb9bb7-8v5rq
181 + ```
182 +
183 + * remove finalizers from a lot of resources at once:
184 +
185 + ```
186 + for app in $(k get app | awk '!/NAME/ {print $1}') ; do kubectl patch app $app -p '{"metadata":{"finalizers":null}}' --type=merge ; done
187 + ```
188 +
189 + * find all pods in the cluster with proxy vars set:
190 +
191 + ```
192 + kubectl get pods --all-namespaces --output yaml | yq '
193 + .items[]
194 + | select((.metadata.name | test("^(capi|dex-k8s)-")) | not)
195 + | select((.metadata.namespace | test("^(kube-system|kyverno)$")) | not)
196 + | select(
197 + [ (.spec.containers // []) + (.spec.initContainers // [])
198 + | .[]
199 + | ([ (.env // [])[].name ] | any_c(. == "http_proxy" or . == "HTTP_PROXY"))
200 + ] | any_c(. == false)
201 + )
202 + | .metadata.namespace + "/" + .metadata.name
203 + '
204 + ```
205 +
206 + * fix pods stuck due to kyverno cluster policy:
207 +
208 + ```
209 + kubectl get clusterpolicies.kyverno.io inject-proxy-env --output yaml > /tmp/inject-proxy-env.yaml && kubectl delete clusterpolicies.kyverno.io inject-proxy-env && kubectl edit --namespace giantswarm $(kubectl get pods --namespace giantswarm --output name | grep scan-vulnerabilityreport) && sleep 1 && kubectl get pods --namespace giantswarm --output name | grep scan-vulnerabilityreport && kubectl create --filename /tmp/inject-proxy-env.yaml
210 + ```
211 +
212 + ## kubectl plugins
213 +
214 + #### pexec
215 +
216 + <https://github.com/ssup2/kpexec>
217 +
218 + ```
219 + kubectl pexec -it -T capz-controller-manager-6b44b58485-nscf7 -c manager -- bash
220 + ```