Table: kubernetes_daemonset - Query Kubernetes DaemonSets using SQL
A Kubernetes DaemonSet ensures that all (or some) nodes run a copy of a pod. This is used to run system-level applications, such as log collectors, monitoring agents, and more. DaemonSets are crucial for maintaining the desired state and ensuring the smooth operation of Kubernetes clusters.
Some typical uses of a DaemonSet are:
- running a cluster storage daemon on every node
- running a logs collection daemon on every node
- running a node monitoring daemon on every node
Table Usage Guide
The kubernetes_daemonset
table provides insights into DaemonSets within Kubernetes. As a DevOps engineer, explore DaemonSet-specific details through this table, including the current status, spec details, and associated metadata. Utilize it to uncover information about DaemonSets, such as the number of desired and current scheduled pods, the DaemonSet's labels, and the node selector terms.
Examples
Basic Info
Explore which Kubernetes daemonsets are currently scheduled and ready, and determine how long they have been running. This information can be used to assess the status and performance of your Kubernetes environment.
select name, namespace, desired_number_scheduled as desired, current_number_scheduled as current, number_ready as ready, number_available as available, selector, age(current_timestamp, creation_timestamp)from kubernetes_daemonset;
select name, namespace, desired_number_scheduled as desired, current_number_scheduled as current, number_ready as ready, number_available as available, selector, strftime('%s', 'now') - strftime('%s', creation_timestamp) as agefrom kubernetes_daemonset;
Get container and image used in the daemonset
Explore the relationship between container names and images used within a daemonset. This can be helpful in understanding how resources are being utilized and managed across different namespaces.
select name, namespace, c ->> 'name' as container_name, c ->> 'image' as imagefrom kubernetes_daemonset, jsonb_array_elements(template -> 'spec' -> 'containers') as corder by namespace, name;
select name, namespace, json_extract(c.value, '$.name') as container_name, json_extract(c.value, '$.image') as imagefrom kubernetes_daemonset, json_each(json_extract(template, '$.spec.containers')) as corder by namespace, name;
Get update strategy for the daemonset
Analyze the update strategy settings for daemonsets to understand the maximum number of unavailable updates and their types. This is beneficial in managing and planning updates without disrupting the functioning of the system.
select namespace, name, update_strategy -> 'maxUnavailable' as max_unavailable, update_strategy -> 'type' as typefrom kubernetes_daemonset;
select namespace, name, json_extract(update_strategy, '$.maxUnavailable') as max_unavailable, json_extract(update_strategy, '$.type') as typefrom kubernetes_daemonset;
List manifest resources
Explore the status of various resources in your Kubernetes Daemonset to understand if resource allocation aligns with your current needs. This can help assess if resources are being efficiently utilized or if adjustments are needed.
select name, namespace, desired_number_scheduled as desired, current_number_scheduled as current, number_available as available, selector, pathfrom kubernetes_daemonsetwhere path is not null;
select name, namespace, desired_number_scheduled as desired, current_number_scheduled as current, number_available as available, selector, pathfrom kubernetes_daemonsetwhere path is not null;
Query examples
- cluster_daemonsets_count
- daemonset_1_year_count
- daemonset_24_hours_count
- daemonset_30_90_days_count
- daemonset_30_days_count
- daemonset_90_365_days_count
- daemonset_age_table
- daemonset_annotations
- daemonset_by_context
- daemonset_by_context_name
- daemonset_by_creation_month
- daemonset_by_namespace
- daemonset_container_host_ipc
- daemonset_container_host_ipc_count
- daemonset_container_host_network
- daemonset_container_host_network_count
- daemonset_container_host_pid
- daemonset_container_host_pid_count
- daemonset_count
- daemonset_default_namespace
- daemonset_default_namespace_count
- daemonset_host_table
- daemonset_input
- daemonset_labels
- daemonset_node_detail
- daemonset_overview
- daemonset_strategy
- daemonset_tree
- daemonsets_for_namespace
- daemonsets_for_pod
- namespace_daemonset_count
- namespace_daemonset_table
Control examples
- All Controls > DaemonSet > DaemonSet containers --service-account-key-file argument should be set as appropriate
- All Controls > DaemonSet > DaemonSet containers admission control plugin should be set to 'always pull images'
- All Controls > DaemonSet > DaemonSet containers admission control plugin should not be set to 'always admit'
- All Controls > DaemonSet > DaemonSet containers argument --streaming-connection-idle-timeout should not be set to 0
- All Controls > DaemonSet > DaemonSet containers argument admission control plugin NamespaceLifecycle should be enabled
- All Controls > DaemonSet > DaemonSet containers argument admission control plugin NodeRestriction should be enabled
- All Controls > DaemonSet > DaemonSet containers argument admission control plugin PodSecurityPolicy should be enabled
- All Controls > DaemonSet > DaemonSet containers argument admission control plugin ServiceAccount should be enabled
- All Controls > DaemonSet > DaemonSet containers argument admission control plugin where either PodSecurityPolicy or SecurityContextDeny should be enabled
- All Controls > DaemonSet > DaemonSet containers argument anonymous auth should be disabled
- All Controls > DaemonSet > DaemonSet containers argument apiserver etcd certfile and keyfile should be configured
- All Controls > DaemonSet > DaemonSet containers argument authorization mode should have node
- All Controls > DaemonSet > DaemonSet containers argument authorization mode should have RBAC
- All Controls > DaemonSet > DaemonSet containers argument authorization mode should not be set to 'always allow'
- All Controls > DaemonSet > DaemonSet containers argument basic auth file should not be set
- All Controls > DaemonSet > DaemonSet containers argument etcd auto TLS should be disabled
- All Controls > DaemonSet > DaemonSet containers argument etcd cafile should be set
- All Controls > DaemonSet > DaemonSet containers argument etcd client cert auth should be enabled
- All Controls > DaemonSet > DaemonSet containers argument event qps should be less than 5
- All Controls > DaemonSet > DaemonSet containers argument hostname override should not be configured
- All Controls > DaemonSet > DaemonSet containers argument insecure bind address should not be set
- All Controls > DaemonSet > DaemonSet containers argument insecure port should be set to 0
- All Controls > DaemonSet > DaemonSet containers argument kube controller manager service account credentials should be enabled
- All Controls > DaemonSet > DaemonSet containers argument kube-controller-manager bind address should be set to 127.0.0.1
- All Controls > DaemonSet > DaemonSet containers argument kube-scheduler bind address should be set to 127.0.0.1
- All Controls > DaemonSet > DaemonSet containers argument kubelet authorization mode should not be set to 'always allow'
- All Controls > DaemonSet > DaemonSet containers argument kubelet client certificate and key should be configured
- All Controls > DaemonSet > DaemonSet containers argument kubelet HTTPS should be enabled
- All Controls > DaemonSet > DaemonSet containers argument kubelet read-only port should be set to 0
- All Controls > DaemonSet > DaemonSet containers argument make iptables util chains should be enabled
- All Controls > DaemonSet > DaemonSet containers argument protect kernel defaults should be enabled
- All Controls > DaemonSet > DaemonSet containers argument request timeout should be set as appropriate
- All Controls > DaemonSet > DaemonSet containers argument rotate kubelet server certificate should be enabled
- All Controls > DaemonSet > DaemonSet containers argument secure port should not be set to 0
- All Controls > DaemonSet > DaemonSet containers argument service account lookup should be enabled
- All Controls > DaemonSet > DaemonSet containers certificate rotation should be enabled
- All Controls > DaemonSet > DaemonSet containers has image pull policy set to Always
- All Controls > DaemonSet > DaemonSet containers have image tag specified which should be fixed not latest or blank
- All Controls > DaemonSet > DaemonSet containers kube controller manager profiling should be disabled
- All Controls > DaemonSet > DaemonSet containers kube scheduler profiling should be disabled
- All Controls > DaemonSet > DaemonSet containers kube-apiserver profiling should be disabled
- All Controls > DaemonSet > DaemonSet containers kube-apiserver should only make use of strong cryptographic ciphers
- All Controls > DaemonSet > DaemonSet containers kubelet should only make use of strong cryptographic ciphers
- All Controls > DaemonSet > DaemonSet containers Kubernetes dashboard should not be deployed
- All Controls > DaemonSet > DaemonSet containers peer client cert auth should be enabled
- All Controls > DaemonSet > DaemonSet containers ports should not have host port specified
- All Controls > DaemonSet > DaemonSet containers should has admission capability restricted
- All Controls > DaemonSet > DaemonSet containers should has encryption providers configured appropriately
- All Controls > DaemonSet > DaemonSet containers should has security context defined
- All Controls > DaemonSet > DaemonSet containers should have audit log max backup set to 10 or greater
- All Controls > DaemonSet > DaemonSet containers should have audit log max size set to 100 or greater
- All Controls > DaemonSet > DaemonSet containers should have audit log max-age set to 30 or greater
- All Controls > DaemonSet > DaemonSet containers should have audit log path configured appropriately
- All Controls > DaemonSet > DaemonSet containers should have etcd certfile and keyfile configured appropriately
- All Controls > DaemonSet > DaemonSet containers should have etcd peer certfile and peer keyfile configured appropriately
- All Controls > DaemonSet > DaemonSet containers should have kube controller manager root CA file configured appropriately
- All Controls > DaemonSet > DaemonSet containers should have kube controller manager service account private key file configured appropriately
- All Controls > DaemonSet > DaemonSet containers should have kube-apiserver TLS cert file and TLS private key file configured appropriately
- All Controls > DaemonSet > DaemonSet containers should have kubelet certificate authority configured appropriately
- All Controls > DaemonSet > DaemonSet containers should have kubelet client CA file configured appropriately
- All Controls > DaemonSet > DaemonSet containers should have kubelet terminated pod gc threshold configured appropriately
- All Controls > DaemonSet > DaemonSet containers should have kubelet TLS cert file and TLS private key file configured appropriately
- All Controls > DaemonSet > DaemonSet containers should have liveness probe
- All Controls > DaemonSet > DaemonSet containers should have readiness probe
- All Controls > DaemonSet > DaemonSet containers should have secrets defined as files
- All Controls > DaemonSet > DaemonSet containers should minimize its admission with capabilities assigned
- All Controls > DaemonSet > DaemonSet containers should minimize the admission of containers with added capability
- All Controls > DaemonSet > DaemonSet containers should not be mapped with privilege ports
- All Controls > DaemonSet > DaemonSet containers should not use CAP_SYS_ADMIN linux capability
- All Controls > DaemonSet > DaemonSet containers token auth file should not be configured
- DaemonSet containers should have a CPU limit
- DaemonSet containers should have a CPU request
- DaemonSet containers should have a memory limit
- DaemonSet containers should have a memory request
- DaemonSet containers should not allow privilege escalation
- DaemonSet containers should not have privileged access
- DaemonSet containers should not run with host network access
- DaemonSet containers should not run with root privileges
- DaemonSet containers should not share the host process namespace
- DaemonSet containers should run with a read only root file system
- DaemonSet definition should not use default namespace
- Seccomp profile is set to docker/default in DaemonSet definition
Schema for kubernetes_daemonset
Name | Type | Operators | Description |
---|---|---|---|
_ctx | jsonb | Steampipe context in JSON form. | |
annotations | jsonb | Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. | |
collision_count | bigint | Count of hash collisions for the DaemonSet. The DaemonSet controller uses this field as a collision avoidance mechanism when it needs to create the name for the newest ControllerRevision. | |
conditions | jsonb | Represents the latest available observations of a DaemonSet's current state. | |
context_name | text | Kubectl config context name. | |
creation_timestamp | timestamp with time zone | CreationTimestamp is a timestamp representing the server time when this object was created. | |
current_number_scheduled | bigint | The number of nodes that are running at least 1 daemon pod and are supposed to run the daemon pod. | |
deletion_grace_period_seconds | bigint | Number of seconds allowed for this object to gracefully terminate before it will be removed from the system. Only set when deletionTimestamp is also set. | |
deletion_timestamp | timestamp with time zone | DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. | |
desired_number_scheduled | bigint | The total number of nodes that should be running the daemon pod (including nodes correctly running the daemon pod). | |
end_line | bigint | The path to the manifest file. | |
finalizers | jsonb | Must be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed. | |
generate_name | text | GenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided. | |
generation | bigint | A sequence number representing a specific generation of the desired state. | |
labels | jsonb | Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. | |
min_ready_seconds | bigint | The minimum number of seconds for which a newly created DaemonSet pod should be ready without any of its container crashing, for it to be considered available. Defaults to 0 | |
name | text | Name of the object. Name must be unique within a namespace. | |
namespace | text | Namespace defines the space within which each name must be unique. | |
number_available | bigint | The number of nodes that should be running the daemon pod and have one or more of the daemon pod running and available (ready for at least spec.minReadySeconds). | |
number_misscheduled | bigint | The number of nodes that are running the daemon pod, but are not supposed to run the daemon pod. | |
number_ready | bigint | The number of nodes that should be running the daemon pod and have one or more of the daemon pod running and ready. | |
number_unavailable | bigint | The number of nodes that should be running the daemon pod and have none of the daemon pod running and available (ready for at least spec.minReadySeconds). | |
observed_generation | bigint | The most recent generation observed by the daemon set controller. | |
owner_references | jsonb | List of objects depended by this object. If ALL objects in the list have been deleted, this object will be garbage collected. If this object is managed by a controller, then an entry in this list will point to this controller, with the controller field set to true. There cannot be more than one managing controller. | |
path | text | The path to the manifest file. | |
resource_version | text | An opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed. | |
revision_history_limit | bigint | The number of old history to retain to allow rollback. This is a pointer to distinguish between explicit zero and not specified. Defaults to 10. | |
selector | jsonb | A label query over pods that are managed by the daemon set. | |
selector_query | text | A query string representation of the selector. | |
source_type | text | The source of the resource. Possible values are: deployed and manifest. If the resource is fetched from the spec file the value will be manifest. | |
sp_connection_name | text | Steampipe connection name. | |
sp_ctx | jsonb | Steampipe context in JSON form. | |
start_line | bigint | The path to the manifest file. | |
tags | jsonb | A map of tags for the resource. This includes both labels and annotations. | |
template | jsonb | An object that describes the pod that will be created. | |
title | text | Title of the resource. | |
uid | text | UID is the unique in time and space value for this object. | |
update_strategy | jsonb | An update strategy to replace existing DaemonSet pods with new pods. | |
updated_number_scheduled | bigint | The total number of nodes that are running updated daemon pod. |
Export
This table is available as a standalone Exporter CLI. Steampipe exporters are stand-alone binaries that allow you to extract data using Steampipe plugins without a database.
You can download the tarball for your platform from the Releases page, but it is simplest to install them with the steampipe_export_installer.sh
script:
/bin/sh -c "$(curl -fsSL https://steampipe.io/install/export.sh)" -- kubernetes
You can pass the configuration to the command with the --config
argument:
steampipe_export_kubernetes --config '<your_config>' kubernetes_daemonset