Openshift / Kubernetes

kubernetes-openshift.md

Description

Some example commands for openshift/kubernetes, replace the oc with kubectl or otherwise

get all pods from all namespaces comma separated with namespace, pod name, container name, container image, pod status

oc get pods --all-namespaces -o go-template='{{range .items}}{{$status := .status.phase}}{{$namespace := .metadata.namespace}}{{$podname := .metadata.name}}{{range .spec.containers}}{{$namespace}}{{","}}{{$podname}}{{","}}{{.name}}{{","}}{{.image}}{{","}}{{$status}}{{"\n"}}{{end}}{{end}}'

get all pods from all namespaces comma separated with namespace, pod name, scc

oc get pods --all-namespaces -o go-template='{{range .items}}{{.metadata.namespace}},{{.metadata.name}},{{range $key, $element := .metadata.annotations}}{{if eq $key "openshift.io/scc"}}{{$element}}{{end}}{{end}}{{"\n"}}{{end}}'

get all sccs with attrubite .allowPrivilegedContainer true

oc get scc -o go-template='{{range .items}}{{if eq .allowPrivilegedContainer true}}{{.metadata.name}}{{"\n"}}{{end}}{{end}}'

get users and groups from privileged sccs

oc get scc -o 'go-template={{range .items}}{{if eq .allowPrivilegedContainer true}}{{$name := .metadata.name}}{{range $user := .users}}{{$name}},user={{$user}}{{"\n"}}{{end}}{{range $group := .groups}}{{$name}},group={{$group}}{{"\n"}}{{end}}{{end}}{{end}}'

get all user where identities map is null (local user)

oc get user -o go-template='{{range .items}}{{if not .identities}}{{.metadata.name}}{{"\n"}}{{end}}{{end}}'

get all pods running with privileged scc (loop over all scc and get pods from all namespaces with this scc, may be need to be optimized)

for PRIV in $(oc get scc -o go-template='{{range .items}}{{if eq .allowPrivilegedContainer true}}{{.metadata.name}}{{"\n"}}{{end}}{{end}}'); do oc get pods --all-namespaces -o go-template='{{$PRIVILEGE := "'$PRIV'"}}{{range .items}}{{if eq .status.phase "Running"}}{{$namespace := .metadata.namespace}}{{$name := .metadata.name}}{{range $key, $element := .metadata.annotations}}{{if eq $key "openshift.io/scc"}}{{if eq $element "'$PRIV'"}}{{$namespace}},{{$name}},{{$element}}{{"\n"}}{{end}}{{end}}{{end}}{{end}}{{end}}'; done

get all networkpolies except pre-defined default policies by namespace,networkpolicy

oc get networkpolicy --all-namespaces -o go-template='{{range .items}}{{if and (ne .metadata.name "allow-from-default-namespace") (ne .metadata.name "allow-from-same-namespace")}}{{.metadata.namespace}},{{.metadata.name}}{{"\n"}}{{end}}{{end}}'

get all compute nodes with allocatable cpu and memory

oc get nodes -l node-role.kubernetes.io/compute=true -o go-template='{{range .items}}{{.metadata.name}},{{.status.allocatable.cpu}},{{.status.allocatable.memory}}{{"\n"}}{{end}}'

get all rolebindings with role reference 'admin' or 'edit'

oc get rolebinding --all-namespaces -o go-template='{{range .items}}{{if or (eq .roleRef.name "edit") (eq .roleRef.name "admin") }}{{$namespace := .metadata.namespace}}{{$name := .metadata.name}}{{range .subjects}}{{$namespace}},{{$name}},{{.kind}},{{.name}}{{"\n"}}{{end}}{{end}}{{end}}'

get all secrets in plaintext

kubectl get secret -o go-template='{{range .items}}{{range $key, $value := .data}}# {{$key}}{{"\n"}}{{$value|base64decode}}{{"\n"}}{{end}}{{end}}'

get all routes with insecure traffic

oc get route --all-namespaces -o go-template='{{range .items}}{{$insecterm := ""}}{{if .spec.tls.insecureEdgeTerminationPolicy}}{{$insecterm := .spec.tls.insecureEdgeTerminationPolicy}}{{end}}{{if or (eq $insecterm "Allow") (not .spec.tls)}}{{.metadata.namespace}}{{"\t"}}{{.metadata.name}}{{"\n"}}{{end}}{{end}}'

get all csr in pending state and approve them

oc get csr -o go-template='{{range .items}}{{if not .status}}{{.metadata.name}}{{"\n"}}{{end}}{{end}}' | xargs oc adm certificate approve

get degraded clusteroperator

oc get clusteroperator -o go-template='{{$isdegraded := 0}}{{range .items}}{{$name := .metadata.name}}{{range .status.conditions}}{{if and (eq .type "Degraded") (eq .status "True")}}{{$name}} {{$isdegraded = 1}}{{end}}{{end}}{{end}}{{if eq $isdegraded 1}}degraded{{else}}ok{{end}}'

get unavailable clusteroperator

oc get clusteroperator -o go-template='{{$isUnavailable := 0}}{{range .items}}{{$name := .metadata.name}}{{range .status.conditions}}{{if and (eq .type "Available") (eq .status "False")}}{{$isUnavailable = 1}}{{$name}} {{end}}{{end}}{{end}}{{if eq $isUnavailable 1}}unavilable{{else}}ok{{end}}'

get APIResourceList for the core API group

oc get --raw '/api/v1'

get all APIResourceLists for all API groups

for i in $(oc get --raw '/apis' | jq -r '[.groups | .[].name] | join(" ")'); do version=$(oc get --raw "/apis/$i/" | jq -r '.preferredVersion.version'); oc get --raw "/apis/$i/$version" | jq . ; done

get openshift-service-ca certificate

oc get cm -n openshift-service-ca openshift-service-ca.crt -o go-template='{{range .data}}{{.}}{{end}}'