Kubernetes

What it coversCopy Anchor Link

Use Kubernetes when a symptom suggests pod churn, a rollout gap, OOM kills or replica-count anomalies. The read surface shows restarts, container last state, cluster events, rollout history, deployment status and resource pressure.

ConnectCopy Anchor Link

Clusters are usually separate per environment, so tie each connection to one:

reckon connect k8s-prod --org acme --provider kubernetes --for-env prod

Kubernetes has no secrets file settings of its own and no reckon login. Reckon points KUBECONFIG at the connection's own file, ~/.reckon/orgs/acme/config/k8s-prod/kube/config. Put a kubeconfig there whose current context is the cluster you want, for example for EKS:

mkdir -p ~/.reckon/orgs/acme/config/k8s-prod/kube
aws eks update-kubeconfig --name <cluster> --region <region> \
  --kubeconfig ~/.reckon/orgs/acme/config/k8s-prod/kube/config

An EKS kubeconfig calls aws eks get-token. Put the AWS settings it needs (AWS_REGION, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY) in ~/.reckon/orgs/acme/secrets/k8s-prod.env; this connection accepts KUBE* and AWS_* keys.

reckon verify k8s-prod runs kubectl get ns -o name --request-timeout=15s.

Read-only contractCopy Anchor Link

kubectl has no read-only mode, so Reckon allows only get, describe, logs, top, events, rollout history, rollout status, version, api-resources, explain, auth can-i, config current-context and config get-contexts. It refuses get or describe of the secrets resource (secret, secrets, secret/name, in any list); the target and identity flags --kubeconfig, --context, --cluster, --user, --token, --server, -s, --as, --as-group, --username, --password, --client-certificate, --client-key, --certificate-authority, --tls-server-name, --as-uid, --insecure-skip-tls-verify and --raw; and the file flags -f, --filename, -k, --kustomize, -R and --recursive. A read-only RBAC role is the real barrier.

Put the command before its flags: get pods -n <ns>, not -n <ns> get pods.

Key commandsCopy Anchor Link

reckon run kubernetes -- get pods -n <ns> -o wide
reckon run kubernetes -- describe pod <pod> -n <ns>
reckon run kubernetes -- get events -n <ns> --sort-by=.lastTimestamp
reckon run kubernetes -- rollout history deploy/<deployment> -n <ns>
reckon run kubernetes -- get deploy <deployment> -n <ns> -o json
reckon run kubernetes -- top pods -n <ns>

top requires metrics-server.

LinksCopy Anchor Link

• kubectl reference