Kubectl随记

kubectl set default editor

export  KUBE_EDITOR=/usr/bin/vim

kubectl completion bash not working 排障随记

需要已经安装 bash-completion

如果提示 _get_comp_words_by_ref: command not found 错误的话，需要执行

source /usr/share/bash-completion/bash_completion

执行命令 set 看一下当前环境的相关配置有没有kube相关项

set | grep -i kube

没有的话需要执行

source <(kubectl completion bash)

正常的话,打开 kubectl debug

__kubectl_debug() {
   if [[ -n ${BASH_COMP_DEBUG_FILE} ]]; then
       echo "$*" >> "${BASH_COMP_DEBUG_FILE}"
   fi
}

export BASH_COMP_DEBUG_FILE=****

根据debug file里面的记录去排查出错点

kubectl to get all api-resource and filter by verbs

kubectl api-resources -o name --cached --request-timeout=5s --verbs=get

kubectl api-resources --api-group=networking.k8s.io

explain api-resource with sprcific api version

kubectl api-resources --api-group=networking.k8s.io -v8 2>&1| grep ingress

kubectl explain ingress --api-version="networking.k8s.io/v1beta1"

get service account token faster / 一条命令结合jsonpath揭秘base64处理后的secret

kubectl get secret sa-secret -o jsonpath={.data.token} | base64 -d

Check k8s account privilege / k8s 对象权限相关

kubectl options:
    --as=: Username to impersonate for the operation
    --as-group=[]: Group to impersonate for the operation, this flag can be repeated to specify multiple groups.

假设有名为registry-test的serviceAccount位于kube-system，这时候我们要测试他的RBAC权限，可以使用如下命令

kubectl --as "system:serviceaccount:kube-system:registry-test" get serviceaccount

Usage: kubectl auth can-i VERB [TYPE | TYPE/NAME | NONRESOURCEURL] [options]

# Check to see if I can do everything in my current namespace ("*" means all)
kubectl auth can-i '*' '*'

[root@node-a ~]# kubectl --as "system:serviceaccount:kube-system:registry-test" auth can-i list pods
yes

PS: 在RBAC定义中(例如role / clusterrole)对 resources 的 pods/* 声明不会对诸如 pods/exec pods/log pods/status 等资源授权起效果

原因: K8s-rbac关于子资源授权的一些记录

kubectl get resources with custom column / 利用custom-columns自定义输出字段 (语法相对go-template简单)

通过custom-columns只输出pod所在租户，pod名字和pod uid

kubectl get pods -o custom-columns='namespace:metadata.namespace,pod:metadata.name,uid:metadata.uid'

通过custom-columns只输出namespace名字和ns annotation中定义的node selector

kubectl get namespaces -o custom-columns="NAMESPACE:.metadata.name, NODE_SELECTOR:.metadata.annotations.scheduler\.alpha\.kubernetes\.io/node-selector"

Get node info order by node ip address / 根据ip地址排序获取节点信息

kubectl get nodes -owide --sort-by status.addresses[0].address

Get pods order by running node name / 根据pod运行节点排序获取pod信息

kubectl get pods -owide --sort-by .spec.nodeName

kubectl get pods -owide --sort-by spec.nodeName

Get pod order by pod create time / 根据pod创建时间排序获取pod

kubectl get pods -n efk-system --sort-by status.startTime

kubectl get pods -n efk-system --sort-by status.startTime| grep filebeat

kubectl get pods -n efk-system --sort-by status.startTime| grep filebeat|tac

GET Pod Volumes / 获取某个租户下所有pod所绑定的volumes (依赖jq)

过滤了 POD 所挂载的 k8s service account token

kubectl get pods -n ${your_name_space} -o json | jq -r '.items[] | [
  .metadata.name,
  ([.spec.volumes[] | select(.name | startswith("kube-api-access") | not)] | tostring)
] | @tsv' | column -t

• @tsv是为了将输出格式化成两列，column命令在这里起到对齐的作用

如果需要过滤configmap和secret，也可以用命令

kubectl get pods -n ${your_name_space} -o json | jq -r '.items[] | [
  .metadata.name,
  ([.spec.volumes[] | 
  select( (.name | startswith("kube-api-access") | not) 
    and (.configMap == null) 
    and (.secret == null) )] | tostring)
] | @tsv' | column -t

kubectl get resources with go-template / 利用go-template自定义输出(功能扩展性高度自由,但是有一定的编码调试成本)

Deployments - image / 只获取deployment名字和image

kubectl get deployments -o go-template --template '{{range .items}}{{.metadata.name}}{{" -- "}}{{range .spec.template.spec.containers}}{{.image}}{{" "}}{{end}}{{"\n"}}{{end}}'

稍微格式化输出，输出deployment名字 + container名字 + 对应的image

kubectl get deployments.apps -o go-template --template '{{range .items}}{{printf "%-30s " .metadata.name}}{{range .spec.template.spec.containers}}{{.name}}{{":"}}{{.image}}{{" "}}{{end}}{{"\n"}}{{end}}'

Pods - image / 只获取pod名字和image

kubectl get pods -o go-template --template '{{range .items}}{{.metadata.name}}{{" -- "}}{{range .spec.containers}}{{.image}}{{end}}{{"\n"}}{{end}}'

Get the ip address of the specified node / 只获取节点名字和对应的Internal IP地址

kubectl get nodes -l kubernetes.io/hostname=nodename -o go-template --template '{{range .items}}{{range .status.addresses}}{{ if eq .type "InternalIP" }}{{.address}}{{end}}{{end}}{{end}}{{"\n"}}'

Get node taints / 只获取节点名字和taints

kubectl get nodes  -o go-template --template '{{range .items}}{{.metadata.name}}{{":\n"}}{{range .spec.taints}}{{.key}}{{"="}}{{.value}}{{":"}}{{.effect}}{{" "}}{{end}}{{"\n\n"}}{{end}}'

kubectl get nodes -l kubernetes.io/hostname=nodename -o go-template --template '{{range .items}}{{.metadata.name}}{{":\n"}}{{range .spec.taints}}{{.key}}{{"="}}{{.value}}{{":"}}{{.effect}}{{" "}}{{end}}{{"\n\n"}}{{end}}'

Get node labels and format output / 只获取节点名字和labels并格式化输出

kubectl get node -o go-template --template '{{range .items}}{{.metadata.name}}{{"\n"}}{{range $key, $value := .metadata.labels}}{{"\t\t"}}{{$key}}{{":"}}{{$value}}{{"\n"}}{{end}}{{"\n"}}{{end}}'

获取namespace名字和ns annotation中定义的node selector

kubectl get namespaces -o go-template='{{range .items}}{{.metadata.name}}{{" "}}{{index .metadata.annotations "scheduler.alpha.kubernetes.io/node-selector" -}}{{"\n"}}{{end}}'

稍微处理一下，格式化对齐输出

kubectl get namespaces -o go-template='{{range .items}}{{printf "%-30s " .metadata.name}}{{if index .metadata.annotations "scheduler.alpha.kubernetes.io/node-selector"}}{{index .metadata.annotations "scheduler.alpha.kubernetes.io/node-selector"}}{{else}} {{end}}{{"\n"}}{{end}}'

kubectl get event filter by pod name / 根据对象进行过滤获取k8s事件

kubectl get event -n kube-system --field-selector involvedObject.name=${pod_name}

kubectl get event sort by lastTime / 根据事件最后触发时间进行排序

kubectl get event -n kube-system --sort-by=.lastTimestamp

kubectl patch

K8s的patch命令随记

kubectl patch 调整 annotation

kubectl patch ns demo -p '{"metadata":{"annotations":{"scheduler.alpha.kubernetes.io/node-selector": "kubernetes.io/hostname=node1"}}}'