turbot/kubernetes
steampipe plugin install kubernetes

Table: kubernetes_pod - Query Kubernetes Pods using SQL

Kubernetes Pods are the smallest and simplest unit in the Kubernetes object model that you create or deploy. A Pod represents a running process on your cluster and encapsulates an application's container (or a group of tightly-coupled containers), storage resources, a unique network IP, and options that govern how the container(s) should run. Pods are designed to support co-located (co-scheduled), co-managed helper programs, such as content management systems, file and data loaders, local cache managers, etc.

Table Usage Guide

The kubernetes_pod table provides insights into the Pods within a Kubernetes cluster. As a DevOps engineer, explore Pod-specific details through this table, including status, configuration, and usage. Utilize it to uncover information about Pods, such as their current state, the containers running within them, and the resources they are consuming.

Examples

Basic Info

Analyze the settings to understand the distribution and status of your Kubernetes pods. This query helps you identify the number of each type of container within each pod, as well as their age, phase, and the node they're running on, providing a comprehensive view of your Kubernetes environment.

select
namespace,
name,
phase,
age(current_timestamp, creation_timestamp),
pod_ip,
node_name,
jsonb_array_length(containers) as container_count,
jsonb_array_length(init_containers) as init_container_count,
jsonb_array_length(ephemeral_containers) as ephemeral_container_count
from
kubernetes_pod
order by
namespace,
name;
select
namespace,
name,
phase,
(
julianday('now') - julianday(datetime(creation_timestamp, 'unixepoch'))
) as age,
pod_ip,
node_name,
json_array_length(containers) as container_count,
json_array_length(init_containers) as init_container_count,
json_array_length(ephemeral_containers) as ephemeral_container_count
from
kubernetes_pod
order by
namespace,
name;

List Unowned (Naked) Pods

Discover the segments that consist of unassigned pods within your Kubernetes system. This query is useful for identifying potential resource inefficiencies or orphaned pods that could impact system performance.

select
name,
namespace,
phase,
pod_ip,
node_name
from
kubernetes_pod
where
owner_references is null;
select
name,
namespace,
phase,
pod_ip,
node_name
from
kubernetes_pod
where
owner_references is null;

List Privileged Containers

Discover the segments that are running privileged containers within your Kubernetes pods. This can help in identifying potential security risks and ensuring that your pods are following best practices for security configurations.

select
name as pod_name,
namespace,
phase,
jsonb_pretty(owner_references) as owners,
c ->> 'name' as container_name,
c ->> 'image' as container_image
from
kubernetes_pod,
jsonb_array_elements(containers) as c
where
c -> 'securityContext' ->> 'privileged' = 'true';
select
name as pod_name,
namespace,
phase,
owner_references as owners,
json_extract(c.value, '$.name') as container_name,
json_extract(c.value, '$.image') as container_image
from
kubernetes_pod,
json_each(containers) as c
where
json_extract(c.value, '$.securityContext.privileged') = 'true';

List Pods with access to the host process ID, IPC, or network namespace

Explore which Kubernetes pods have access to critical host resources such as the process ID, IPC, or network namespace. This is useful for identifying potential security risks and ensuring proper resource isolation.

select
name,
namespace,
phase,
host_pid,
host_ipc,
host_network,
jsonb_pretty(owner_references) as owners
from
kubernetes_pod
where
host_pid
or host_ipc
or host_network;
select
name,
namespace,
phase,
host_pid,
host_ipc,
host_network,
owner_references as owners
from
kubernetes_pod
where
host_pid
or host_ipc
or host_network;

Container Statuses

Explore the status of various containers within a Kubernetes pod, including their readiness and restart count. This query can be used to monitor and manage the health and performance of your Kubernetes environment.

select
namespace,
name as pod_name,
phase,
cs ->> 'name' as container_name,
cs ->> 'image' as image,
cs ->> 'ready' as ready,
cs_state as state,
cs ->> 'started' as started,
cs ->> 'restartCount' as restarts
from
kubernetes_pod,
jsonb_array_elements(container_statuses) as cs,
jsonb_object_keys(cs -> 'state') as cs_state
order by
namespace,
name,
container_name;
select
namespace,
name as pod_name,
phase,
json_extract(cs.value, '$.name') as container_name,
json_extract(cs.value, '$.image') as image,
json_extract(cs.value, '$.ready') as ready,
json_each.key as state,
json_extract(cs.value, '$.started') as started,
json_extract(cs.value, '$.restartCount') as restarts
from
kubernetes_pod,
json_each(container_statuses) as cs,
json_each(json_extract(cs.value, '$.state'))
order by
namespace,
name,
container_name;

kubectl get pods columns

This example allows you to monitor the status and performance of your Kubernetes pods. It provides insights into various aspects such as the number of running containers, total restarts, and the age of each pod, helping you to maintain the health and efficiency of your Kubernetes environment.

select
namespace,
name,
phase,
count(cs) filter (
where
cs -> 'state' -> 'running' is not null
) as running_container_count,
jsonb_array_length(containers) as container_count,
age(current_timestamp, creation_timestamp),
COALESCE(sum((cs ->> 'restartCount') :: int), 0) as restarts,
pod_ip,
node_name
from
kubernetes_pod
left join jsonb_array_elements(container_statuses) as cs on true
group by
namespace,
name,
phase,
containers,
creation_timestamp,
pod_ip,
node_name
order by
namespace,
name;
select
namespace,
name,
phase,
(
select
count(*)
from
json_each(container_statuses) as cs
where
json_extract(cs.value, '$.state.running') is not null
) as running_container_count,
(
select
count(*)
from
json_each(containers)
) as container_count,
julianday('now') - julianday(creation_timestamp) as age,
COALESCE(
(
select
sum(json_extract(cs.value, '$.restartCount'))
from
json_each(container_statuses) as cs
),
0
) as restarts,
pod_ip,
node_name
from
kubernetes_pod
group by
namespace,
name,
phase,
containers,
creation_timestamp,
pod_ip,
node_name
order by
namespace,
name;

List manifest resources

Explore which Kubernetes pods contain manifest resources, including the number of different container types. This can help you understand the distribution and configuration of resources within your Kubernetes environment.

select
namespace,
name,
phase,
pod_ip,
node_name,
jsonb_array_length(containers) as container_count,
jsonb_array_length(init_containers) as init_container_count,
jsonb_array_length(ephemeral_containers) as ephemeral_container_count,
path
from
kubernetes_pod
where
path is not null
order by
namespace,
name;
select
namespace,
name,
phase,
pod_ip,
node_name,
json_array_length(containers) as container_count,
json_array_length(init_containers) as init_container_count,
json_array_length(ephemeral_containers) as ephemeral_container_count,
path
from
kubernetes_pod
where
path is not null
order by
namespace,
name;

Query examples

Control examples

Schema for kubernetes_pod

NameTypeOperatorsDescription
_ctxjsonbSteampipe context in JSON form.
active_deadline_secondstextOptional duration in seconds the pod may be active on the node relative to StartTime before the system will actively try to mark it failed and kill associated containers.
affinityjsonbIf specified, the pod's scheduling constraints.
annotationsjsonbAnnotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata.
automount_service_account_tokenbooleanAutomountServiceAccountToken indicates whether a service account token should be automatically mounted.
conditionsjsonbCurrent service state of pod.
container_statusesjsonbThe list has one entry per container in the manifest. Each entry is currently the output of `docker inspect`.
containersjsonbList of containers belonging to the pod.
context_nametextKubectl config context name.
creation_timestamptimestamp with time zoneCreationTimestamp is a timestamp representing the server time when this object was created.
deletion_grace_period_secondsbigintNumber of seconds allowed for this object to gracefully terminate before it will be removed from the system. Only set when deletionTimestamp is also set.
deletion_timestamptimestamp with time zoneDeletionTimestamp is RFC 3339 date and time at which this resource will be deleted.
dns_configjsonbSpecifies the DNS parameters of a pod. Parameters specified here will be merged to the generated DNS configuration based on DNSPolicy.
dns_policytextDNS policy for pod. Valid values are 'ClusterFirstWithHostNet', 'ClusterFirst', 'Default' or 'None'.
enable_service_linksbooleanEnableServiceLinks indicates whether information about services should be injected into pod's environment variables, matching the syntax of Docker links.
end_linebigintThe path to the manifest file.
ephemeral_container_statusesjsonbStatus for any ephemeral containers that have run in this pod. This field is alpha-level and is only populated by servers that enable the EphemeralContainers feature.
ephemeral_containersjsonbList of ephemeral containers run in this pod. Ephemeral containers may be run in an existing pod to perform user-initiated actions such as debugging. This list cannot be specified when creating a pod, and it cannot be modified by updating the pod spec. In order to add an ephemeral container to an existing pod, use the pod's ephemeralcontainers subresource. This field is alpha-level and is only honored by servers that enable the EphemeralContainers feature.
finalizersjsonbMust be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed.
generate_nametextGenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided.
generationbigintA sequence number representing a specific generation of the desired state.
host_aliasesjsonbHostAliases is an optional list of hosts and IPs that will be injected into the pod's hosts file if specified. This is only valid for non-hostNetwork pods.
host_ipinetIP address of the host to which the pod is assigned. Empty if not yet scheduled.
host_ipcbooleanUse the host's ipc namespace.
host_networkbooleanHost networking requested for this pod. Use the host's network namespace. If this option is set, the ports that will be used must be specified.
host_pidbooleanUse the host's pid namespace.
hostnametextSpecifies the hostname of the Pod. If not specified, the pod's hostname will be set to a system-defined value.
image_pull_secretsjsonbImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec.
init_container_statusesjsonbThe list has one entry per init container in the manifest. The most recent successful init container will have ready = true, the most recently started container will have startTime set.
init_containersjsonbList of initialization containers belonging to the pod. Init containers are executed in order prior to containers being started. If any init container fails, the pod is considered to have failed and is handled according to its restartPolicy. The name for an init container or normal container must be unique among all containers.
labelsjsonbMap of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services.
nametextName of the object. Name must be unique within a namespace.
namespacetextNamespace defines the space within which each name must be unique.
node_nametextNodeName is a request to schedule this pod onto a specific node. If it is non-empty, the scheduler simply schedules this pod onto that node, assuming that it fits resource requirements.
node_selectorjsonbNodeSelector is a selector which must be true for the pod to fit on a node.
nominated_node_nametextnominatedNodeName is set only when this pod preempts other pods on the node, but it cannot be scheduled right away as preemption victims receive their graceful termination periods. This field does not guarantee that the pod will be scheduled on this node. Scheduler may decide to place the pod elsewhere if other nodes become available sooner. Scheduler may also decide to give the resources on this node to a higher priority pod that is created after preemption. As a result, this field may be different than PodSpec.nodeName when the pod is scheduled.
overheadjsonbOverhead represents the resource overhead associated with running a pod for a given RuntimeClass.
owner_referencesjsonbList of objects depended by this object. If ALL objects in the list have been deleted, this object will be garbage collected. If this object is managed by a controller, then an entry in this list will point to this controller, with the controller field set to true. There cannot be more than one managing controller.
pathtextThe path to the manifest file.
phasetextThe phase of a Pod is a simple, high-level summary of where the Pod is in its lifecycle. The conditions array, the reason and message fields, and the individual container status arrays contain more detail about the pod's status. There are five possible phase values: Pending, Running, Succeeded, Failed, Unknown
pod_ipinetIP address allocated to the pod. Routable at least within the cluster. Empty if not yet allocated.
pod_ipsjsonbpodIPs holds the IP addresses allocated to the pod. If this field is specified, the 0th entry must match the podIP field. Pods may be allocated at most 1 value for each of IPv4 and IPv6. This list is empty if no IPs have been allocated yet.
preemption_policytextPreemptionPolicy is the Policy for preempting pods with lower priority. One of Never, PreemptLowerPriority.
prioritybigintThe priority value. Various system components use this field to find the priority of the pod. When Priority Admission Controller is enabled, it prevents users from setting this field. The admission controller populates this field from PriorityClassName. The higher the value, the higher the priority.
priority_class_nametextIf specified, indicates the pod's priority. 'system-node-critical' and 'system-cluster-critical' are two special keywords which indicate the highest priorities with the former being the highest priority. Any other name must be defined by creating a PriorityClass object with that name.
qos_classtextThe Quality of Service (QOS) classification assigned to the pod based on resource requirements.
readiness_gatesjsonbIf specified, all readiness gates will be evaluated for pod readiness. A pod is ready when all its containers are ready AND all conditions specified in the readiness gates have status equal to 'True'
resource_versiontextAn opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed.
restart_policytextRestart policy for all containers within the pod. One of Always, OnFailure, Never.
runtime_class_nametextRuntimeClassName refers to a RuntimeClass object in the node.k8s.io group, which should be used to run this pod. If no RuntimeClass resource matches the named class, the pod will not be run. If unset or empty, the 'legacy' RuntimeClass will be used, which is an implicit class with an empty definition that uses the default runtime handler.
scheduler_nametextIf specified, the pod will be dispatched by specified scheduler.
security_contextjsonbSecurityContext holds pod-level security attributes and common container settings.
selector_searchtextA label selector string to restrict the list of returned objects by their labels.
service_account_nametextServiceAccountName is the name of the ServiceAccount to use to run this pod.
set_hostname_as_fqdnbooleanIf true the pod's hostname will be configured as the pod's FQDN, rather than the leaf name (the default). In Linux containers, this means setting the FQDN in the hostname field of the kernel (the nodename field of struct utsname). In Windows containers, this means setting the registry value of hostname for the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters to FQDN. If a pod does not have FQDN, this has no effect.
share_process_namespacebooleanShare a single process namespace between all of the containers in a pod. When this is set containers will be able to view and signal processes from other containers in the same pod, and the first process in each container will not be assigned PID 1. HostPID and ShareProcessNamespace cannot both be set.
source_typetextThe source of the resource. Possible values are: deployed and manifest. If the resource is fetched from the spec file the value will be manifest.
sp_connection_nametextSteampipe connection name.
sp_ctxjsonbSteampipe context in JSON form.
start_linebigintThe path to the manifest file.
start_timetimestamp with time zoneDate and time at which the object was acknowledged by the Kubelet. This is before the Kubelet pulled the container image(s) for the pod.
status_messagetextA human readable message indicating details about why the pod is in this condition.
status_reasontextA brief CamelCase message indicating details about why the pod is in this state. e.g. 'Evicted'
subdomaintextIf specified, the fully qualified Pod hostname will be '<hostname>.<subdomain>.<pod namespace>.svc.<cluster domain>'. If not specified, the pod will not have a domainname at all.
tagsjsonbA map of tags for the resource. This includes both labels and annotations.
termination_grace_period_secondsbigintOptional duration in seconds the pod needs to terminate gracefully. May be decreased in delete request. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period will be used instead. The grace period is the duration in seconds after the processes running in the pod are sent a termination signal and the time when the processes are forcibly halted with a kill signal. Set this value longer than the expected cleanup time for your process.
titletextTitle of the resource.
tolerationsjsonbIf specified, the pod's tolerations.
topology_spread_constraintsjsonbTopologySpreadConstraints describes how a group of pods ought to spread across topology domains. Scheduler will schedule pods in a way which abides by the constraints. All topologySpreadConstraints are ANDed.
uidtextUID is the unique in time and space value for this object.
volumesjsonbList of volumes that can be mounted by containers belonging to the pod.

Export

This table is available as a standalone Exporter CLI. Steampipe exporters are stand-alone binaries that allow you to extract data using Steampipe plugins without a database.

You can download the tarball for your platform from the Releases page, but it is simplest to install them with the steampipe_export_installer.sh script:

/bin/sh -c "$(curl -fsSL https://steampipe.io/install/export.sh)" -- kubernetes

You can pass the configuration to the command with the --config argument:

steampipe_export_kubernetes --config '<your_config>' kubernetes_pod