Data & infrastructure
Read Kubernetes, routing, Kafka, Redis, PostgreSQL, MySQL, MongoDB and ClickHouse state through reckon run without changing anything.
Use these tools after alerts and telemetry have narrowed the problem to a
workload, a route, a queue, a cache or a query. Most of their CLIs can change
production. Reckon allows only read commands for kubectl, redis-cli and
rpk, runs nginxpm in its read-only mode, and asks you before every database,
Redis and Kafka run.
Kubernetes
reckon run kubernetes -- get pods -n <ns> -o wide
reckon run kubernetes -- describe pod <pod> -n <ns>
reckon run kubernetes -- get events -n <ns> --sort-by=.lastTimestamp
reckon run kubernetes -- rollout history deploy/<deployment> -n <ns>
reckon run kubernetes -- get deploy <deployment> -n <ns> -o json
reckon run kubernetes -- top pods -n <ns>These show restarts, OOM kills, rollout history, replica state, events and
resource pressure. Current state cannot tell you historical pod state; correlate
event timestamps with the window. top requires metrics-server.
Nginx Proxy Manager
reckon run nginxpm -- proxy list -o json
reckon run nginxpm -- proxy get <id> -o json
reckon run nginxpm -- cert list -o json
reckon run nginxpm -- audit list -o jsonCheck whether a host's upstream, a certificate's expiry or a recent change in the audit log lines up with the symptom.
Kafka
reckon run kafka -- -L -J -t <topic>
reckon run kafka -- -C -t <topic> -o -10 -e -q
reckon run kafka-rpk -- group describe <consumer-group>
reckon run kafka-rpk -- group list
reckon run kafka-rpk -- topic describe <topic>Never join a production consumer group: it rebalances the real consumers and
commits offsets. Reckon refuses kcat -G and rpk -g, and producing with
kcat -P. The broker principal should have only Describe and Read.
Redis
reckon run redis -- INFO memory
reckon run redis -- INFO stats
reckon run redis -- SLOWLOG GET 20
reckon run redis -- LATENCY LATEST
reckon run redis -- DBSIZEUse SCAN with a COUNT for key inspection, never KEYS *. Reckon allows only
read commands such as these.
Databases
Database reads are a last step. Before each query, the connection's user must
be a true read-only role, you approve the run, non-trivial reads get EXPLAIN
first, and every SELECT has a LIMIT (default 100).
PostgreSQL
reckon run postgres -- -c "SHOW default_transaction_read_only;"
reckon run postgres -- -c "SELECT pid, state, wait_event_type, wait_event, now()-query_start AS dur, query FROM pg_stat_activity WHERE state != 'idle' ORDER BY dur DESC LIMIT 20;"
reckon run postgres -- -c "SELECT relation::regclass, mode, granted, pid FROM pg_locks WHERE NOT granted LIMIT 100;"The first must report on: Reckon sets default_transaction_read_only=on and
a 30 second statement timeout. EXPLAIN ANALYZE executes the query.
MySQL
reckon run mysql -- -e "SELECT @@transaction_read_only;"
reckon run mysql -- -e "SELECT id, user, host, db, command, time, state, LEFT(info, 200) AS query FROM information_schema.processlist WHERE command != 'Sleep' ORDER BY time DESC LIMIT 20;"
reckon run mysql -- -e "SHOW ENGINE INNODB STATUS\G"The first must report 1. Reckon passes an option file that starts each
session READ ONLY.
MongoDB
reckon run mongodb -- --quiet --eval 'db.currentOp({active:true, secs_running:{$gt:1}})'
reckon run mongodb -- --quiet --eval 'db.serverStatus().connections'
reckon run mongodb -- --quiet --eval 'db.<collection>.find({<filter>}).limit(10).toArray()'readPreference=secondary is routing, not authorization. The read-only role is
the write barrier.
ClickHouse
reckon run clickhouse -- --query "SHOW TABLES"
reckon run clickhouse -- --query "SELECT event_time, query_duration_ms, read_rows, query FROM system.query_log WHERE type = 'QueryFinish' ORDER BY query_duration_ms DESC LIMIT 20"Reckon always adds --readonly=1. The user's server-side readonly=1 profile
is the real barrier.
Read every proposed database query before you approve it, even though the session is read-only. Session settings stop accidents, not a determined write.