Kubent 介绍
Kubent 全称Kube No Trouble是一个简单的工具,主要用于检查k8s集群中是否使用废弃的API版本
Kubent工具可以根据部署资源的进行检测,检测已弃用的API,
特别支持以下方式进行检测:
- 文件 YAML 或 JSON 中的本地清单
- kubectl 使用kubectl.kubernetes.io/last-applied-configuration注解
- Helm v2 使用存储在 K8s Secrets 或 ConfigMaps 中的 Tiller 清单
- Helm v3 使用 Helm 清单,直接在各个命名空间中存储为 Secret 或 ConfigMap
Kubent 安装
可以手动去GitHub上下载
https://github.com/doitintl/kube-no-trouble/releases/latest
我这里将kubent下载到我下载服务器上 (随着文章时间以及版本更新,不确保为最新版)
[root@k8s-01 tmp]# wget https://d.frps.cn/file/tools/kubent/kubent-0.5.1-linux-amd64.tar.gz
[root@k8s-01 tmp]# tar xf kubent-0.5.1-linux-amd64.tar.gz
[root@k8s-01 tmp]# mv kubent /usr/local/bin/
使用方法
kubent
需要通过config文件,读取k8s集群信息。如果我们/root/.kube/config
中包含多个集群信息,可以通过-k
参数指定配置文件。否则默认读取config文件
[root@k8s-01 tmp]# kubent -k /root/.kube/config_abcdocker
12:57AM INF >>> Kube No Trouble `kubent` <<<
12:57AM INF version 0.5.1 (git sha a762ff3c6b5622650b86dc982652843cc2bd123c)
12:57AM INF Initializing collectors and retrieving data
12:57AM INF Target K8s version is 1.23.5
12:57AM INF Retrieved 35 resources from collector name=Cluster
12:57AM INF Retrieved 0 resources from collector name="Helm v2"
12:57AM INF Retrieved 150 resources from collector name="Helm v3"
12:57AM INF Loaded ruleset name=custom.rego.tmpl
12:57AM INF Loaded ruleset name=deprecated-1-16.rego
12:57AM INF Loaded ruleset name=deprecated-1-22.rego
12:57AM INF Loaded ruleset name=deprecated-1-25.rego
__________________________________________________________________________________________
>>> Deprecated APIs removed in 1.25 <<<
------------------------------------------------------------------------------------------
KIND NAMESPACE NAME API_VERSION REPLACE_WITH (SINCE)
PodSecurityPolicy <undefined> psp.flannel.unprivileged policy/v1beta1 <removed> (1.21.0)
PodSecurityPolicy cattle-monitoring-system rancher-monitoring-alertmanager policy/v1beta1 <removed> (1.21.0)
PodSecurityPolicy cattle-monitoring-system rancher-monitoring-crd-manager policy/v1beta1 <removed> (1.21.0)
PodSecurityPolicy cattle-monitoring-system rancher-monitoring-grafana policy/v1beta1 <removed> (1.21.0)
PodSecurityPolicy cattle-monitoring-system rancher-monitoring-kube-state-metrics policy/v1beta1 <removed> (1.21.0)
PodSecurityPolicy cattle-monitoring-system rancher-monitoring-operator policy/v1beta1 <removed> (1.21.0)
PodSecurityPolicy cattle-monitoring-system rancher-monitoring-patch-sa policy/v1beta1 <removed> (1.21.0)
PodSecurityPolicy cattle-monitoring-system rancher-monitoring-prometheus policy/v1beta1 <removed> (1.21.0)
PodSecurityPolicy cattle-monitoring-system rancher-monitoring-prometheus-adapter policy/v1beta1 <removed> (1.21.0)
PodSecurityPolicy cattle-monitoring-system rancher-monitoring-prometheus-node-exporter policy/v1beta1 <removed> (1.21.0)
Deprecated APIs removed in 1.25下面就会显示当前k8s集群中已经废弃的apiserver
更多kubent命令
$./kubent -h
Usage of ./kubent:
-a, --additional-kind strings additional kinds of resources to report in Kind.version.group.com format
-c, --cluster enable Cluster collector (default true)
-x, --context string kubeconfig context
-e, --exit-error exit with non-zero code when issues are found
-f, --filename strings manifests to check, use - for stdin
--helm2 enable Helm v2 collector (default true)
--helm3 enable Helm v3 collector (default true)
-k, --kubeconfig string path to the kubeconfig file
-l, --log-level string set log level (trace, debug, info, warn, error, fatal, panic, disabled) (default "info")
-o, --output string output format - [text|json] (default "text")
-t, --target-version string target K8s version in SemVer format (autodetected by default)
-v, --version prints the version of kubent and exits
-
-a
指定版本中找到其他自定义资源时标记。该标志可以多次使用。格式是完整的Kind.version.group.com
形式 - 例如-a ManagedCertificate.v1.networking.gke.io
-
-x
,--context
从kubeconfig文件中选择上下文(current-context默认使用从文件中)。 -
k
, --kubeconfig 要使用的 kubeconfig 文件的路径。这优先于KUBECONFIGenvironemnt 变量,该变量也受支持并且可以包含多个路径,并且默认为~.kube/config. -
-t
, --target-version Kubent将尝试检测K8S集群版本并仅显示相关结果。当无法从实际集群进行检测时,此标志允许在 CI 中仅使用文件收集器等场景覆盖此版本。预期的格式是major.minor[.patch]
,例如1.16或1.16.3。
github地址https://github.com/doitintl/kube-no-trouble