Impersonate a user and group

Test RBAC as another identity without their kubeconfig; needs impersonate verb

kubectl auth can-i list secrets -n <ns> --as=<name> --as-group=system:serviceaccounts
tool
kubectl73 commands
tags
kubectlsecuritytroubleshootingk8s

More kubectl commands

  • Sort pods by container restart count
    kubectl get pods -A -o jsonpath='{range .items[*]}{.metadata.namespace}{"\t"}{.metadata.name}{"\t"}{.status.containerStatuses[0].restartCount}{"\n"}{end}' | sort -k3 -rn | head

    Surface the most-restarting pods to catch crashloops fast

  • Compare node allocatable vs capacity
    kubectl get nodes -o json | jq -r '.items[] | {node:.metadata.name, capCPU:.status.capacity.cpu, allocCPU:.status.allocatable.cpu, capMem:.status.capacity.memory, allocMem:.status.allocatable.memory}'

    Show reserved overhead per node; gap = kube/system reservations

  • ConfigMap from env-file with patch op
    kubectl create configmap <name> --from-env-file=app.env -n <ns> --dry-run=client -o yaml | kubectl apply -f -; kubectl patch deploy/<name> -n <ns> --type=json -p='[{"op":"add","path":"/spec/template/spec/containers/0/envFrom/-","value":{"configMapRef":{"name":"<name>"}}}]'

    Build a CM from KEY=VALUE file, then JSON-patch it into a container's envFrom

  • List all pods across namespaces
    kubectl get pods -A -o wide

    All pods with node placement and IPs

  • Describe a pod
    kubectl describe pod <name> -n <ns>

    Full details: events, conditions, volume mounts

all 73 kubectl commands