Table: kubernetes_replicaset - Query Kubernetes ReplicaSets using SQL
A ReplicaSet in Kubernetes is a resource that ensures that a specified number of pod replicas are running at any given time. It is often used to guarantee the availability of a specified number of identical pods. A ReplicaSet creates new pods when needed and removes old pods when too many are running.
Table Usage Guide
The kubernetes_replicaset
table provides insights into the ReplicaSets within a Kubernetes cluster. As a DevOps engineer or Kubernetes administrator, you can use this table to monitor the status and health of your ReplicaSets, including the current and desired number of replicas, as well as the labels and selectors used to identify its pods. This can be particularly useful for maintaining high availability and for troubleshooting issues with your applications running on Kubernetes.
Examples
Basic Info
Explore the status and configuration of your Kubernetes replica sets to understand their readiness, availability, and age. This can be useful to assess the health and stability of your application deployments.
select name, namespace, replicas as desired, ready_replicas as ready, available_replicas as available, selector, fully_labeled_replicas, age(current_timestamp, creation_timestamp)from kubernetes_replicaset;
select name, namespace, replicas as desired, ready_replicas as ready, available_replicas as available, selector, fully_labeled_replicas, strftime('%s', 'now') - strftime('%s', creation_timestamp) as agefrom kubernetes_replicaset;
Get container and image used in the replicaset
Gain insights into the relationship between containers and their corresponding images within a replicaset, helping to manage and track the utilization of resources in a Kubernetes environment. This query is particularly useful for administrators looking to optimize their deployments.
select name, namespace, c ->> 'name' as container_name, c ->> 'image' as imagefrom kubernetes_replicaset, jsonb_array_elements(template -> 'spec' -> 'containers') as corder by namespace, name;
select name, namespace, json_extract(c.value, '$.name') as container_name, json_extract(c.value, '$.image') as imagefrom kubernetes_replicaset, json_each(json_extract(template, '$.spec.containers')) as corder by namespace, name;
List pods for a replicaset (by name)
Discover the details of pods associated with a specific replicaset in a Kubernetes environment. This is useful in monitoring and managing the pods that belong to a particular replicaset, ensuring the replicaset is functioning as expected.
select pod.namespace, rs.name as replicaset_name, pod.name as pod_name, pod.phase, age(current_timestamp, pod.creation_timestamp), pod.pod_ip, pod.node_namefrom kubernetes_pod as pod, jsonb_array_elements(pod.owner_references) as pod_owner, kubernetes_replicaset as rswhere pod_owner ->> 'kind' = 'ReplicaSet' and rs.uid = pod_owner ->> 'uid' and rs.name = 'frontend-56fc5b6b47'order by pod.namespace, rs.name, pod.name;
select pod.namespace, rs.name as replicaset_name, pod.name as pod_name, pod.phase, strftime('%s', 'now') - strftime('%s', pod.creation_timestamp) as age, pod.pod_ip, pod.node_namefrom kubernetes_pod as pod, json_each(pod.owner_references) as pod_owner, kubernetes_replicaset as rswhere json_extract(pod_owner.value, '$.kind') = 'ReplicaSet' and rs.uid = json_extract(pod_owner.value, '$.uid') and rs.name = 'frontend-56fc5b6b47'order by pod.namespace, rs.name, pod.name;
List manifest resources
Analyze the status of replica sets in your Kubernetes environment to understand their readiness and availability. This can help in assessing the health and performance of your applications running on Kubernetes.
select name, namespace, replicas as desired, ready_replicas as ready, available_replicas as available, selector, fully_labeled_replicas, pathfrom kubernetes_replicasetwhere path is not null;
select name, namespace, replicas as desired, ready_replicas as ready, available_replicas as available, selector, fully_labeled_replicas, pathfrom kubernetes_replicasetwhere path is not null;
Query examples
- cluster_repliasets_count
- containers_for_deployment
- deployment_pods_detail
- deployment_replicasets_detail
- deployment_tree
- deployments_for_pod
- deployments_for_replicaset
- deployments_for_service
- namespace_replicaset_count
- namespace_replicaset_table
- nodes_for_deployment
- pods_for_deployment
- replicaset_1_year_count
- replicaset_24_hours_count
- replicaset_30_90_days_count
- replicaset_30_days_count
- replicaset_90_365_days_count
- replicaset_age_table
- replicaset_annotations
- replicaset_by_context
- replicaset_by_context_name
- replicaset_by_creation_month
- replicaset_by_namespace
- replicaset_container_host_ipc
- replicaset_container_host_ipc_count
- replicaset_container_host_network
- replicaset_container_host_network_count
- replicaset_container_host_pid
- replicaset_container_host_pid_count
- replicaset_count
- replicaset_default_namespace
- replicaset_default_namespace_count
- replicaset_host_table
- replicaset_input
- replicaset_labels
- replicaset_overview
- replicaset_tree
- replicasets_for_deployment
- replicasets_for_namespace
- services_for_deployment
Control examples
- All Controls > ReplicaSet > ReplicaSet containers --service-account-key-file argument should be set as appropriate
- All Controls > ReplicaSet > ReplicaSet containers admission control plugin should be set to 'always pull images'
- All Controls > ReplicaSet > ReplicaSet containers admission control plugin should not be set to 'always admit'
- All Controls > ReplicaSet > ReplicaSet containers argument --streaming-connection-idle-timeout should not be set to 0
- All Controls > ReplicaSet > ReplicaSet containers argument admission control plugin NamespaceLifecycle should be enabled
- All Controls > ReplicaSet > ReplicaSet containers argument admission control plugin NodeRestriction should be enabled
- All Controls > ReplicaSet > ReplicaSet containers argument admission control plugin PodSecurityPolicy should be enabled
- All Controls > ReplicaSet > ReplicaSet containers argument admission control plugin ServiceAccount should be enabled
- All Controls > ReplicaSet > ReplicaSet containers argument admission control plugin where either PodSecurityPolicy or SecurityContextDeny should be enabled
- All Controls > ReplicaSet > ReplicaSet containers argument anonymous auth should be disabled
- All Controls > ReplicaSet > ReplicaSet containers argument apiserver etcd certfile and keyfile should be configured
- All Controls > ReplicaSet > ReplicaSet containers argument authorization mode should have node
- All Controls > ReplicaSet > ReplicaSet containers argument authorization mode should have RBAC
- All Controls > ReplicaSet > ReplicaSet containers argument authorization mode should not be set to 'always allow'
- All Controls > ReplicaSet > ReplicaSet containers argument basic auth file should not be set
- All Controls > ReplicaSet > ReplicaSet containers argument etcd auto TLS should be disabled
- All Controls > ReplicaSet > ReplicaSet containers argument etcd cafile should be set
- All Controls > ReplicaSet > ReplicaSet containers argument etcd client cert auth should be enabled
- All Controls > ReplicaSet > ReplicaSet containers argument event qps should be less than 5
- All Controls > ReplicaSet > ReplicaSet containers argument hostname override should not be configured
- All Controls > ReplicaSet > ReplicaSet containers argument insecure bind address should not be set
- All Controls > ReplicaSet > ReplicaSet containers argument insecure port should be set to 0
- All Controls > ReplicaSet > ReplicaSet containers argument kube controller manager service account credentials should be enabled
- All Controls > ReplicaSet > ReplicaSet containers argument kube-controller-manager bind address should be set to 127.0.0.1
- All Controls > ReplicaSet > ReplicaSet containers argument kube-scheduler bind address should be set to 127.0.0.1
- All Controls > ReplicaSet > ReplicaSet containers argument kubelet authorization mode should not be set to 'always allow'
- All Controls > ReplicaSet > ReplicaSet containers argument kubelet client certificate and key should be configured
- All Controls > ReplicaSet > ReplicaSet containers argument kubelet HTTPS should be enabled
- All Controls > ReplicaSet > ReplicaSet containers argument kubelet read-only port should be set to 0
- All Controls > ReplicaSet > ReplicaSet containers argument make iptables util chains should be enabled
- All Controls > ReplicaSet > ReplicaSet containers argument protect kernel defaults should be enabled
- All Controls > ReplicaSet > ReplicaSet containers argument request timeout should be set as appropriate
- All Controls > ReplicaSet > ReplicaSet containers argument rotate kubelet server certificate should be enabled
- All Controls > ReplicaSet > ReplicaSet containers argument secure port should not be set to 0
- All Controls > ReplicaSet > ReplicaSet containers argument service account lookup should be enabled
- All Controls > ReplicaSet > ReplicaSet containers certificate rotation should be enabled
- All Controls > ReplicaSet > ReplicaSet containers has image pull policy set to Always
- All Controls > ReplicaSet > ReplicaSet containers have image tag specified which should be fixed not latest or blank
- All Controls > ReplicaSet > ReplicaSet containers kube controller manager profiling should be disabled
- All Controls > ReplicaSet > ReplicaSet containers kube scheduler profiling should be disabled
- All Controls > ReplicaSet > ReplicaSet containers kube-apiserver profiling should be disabled
- All Controls > ReplicaSet > ReplicaSet containers kube-apiserver should only make use of strong cryptographic ciphers
- All Controls > ReplicaSet > ReplicaSet containers kubelet should only make use of strong cryptographic ciphers
- All Controls > ReplicaSet > ReplicaSet containers Kubernetes dashboard should not be deployed
- All Controls > ReplicaSet > ReplicaSet containers peer client cert auth should be enabled
- All Controls > ReplicaSet > ReplicaSet containers ports should not have host port specified
- All Controls > ReplicaSet > ReplicaSet containers should has admission capability restricted
- All Controls > ReplicaSet > ReplicaSet containers should has encryption providers configured appropriately
- All Controls > ReplicaSet > ReplicaSet containers should have audit log max backup set to 10 or greater
- All Controls > ReplicaSet > ReplicaSet containers should have audit log max size set to 100 or greater
- All Controls > ReplicaSet > ReplicaSet containers should have audit log max-age set to 30 or greater
- All Controls > ReplicaSet > ReplicaSet containers should have audit log path configured appropriately
- All Controls > ReplicaSet > ReplicaSet containers should have etcd certfile and keyfile configured appropriately
- All Controls > ReplicaSet > ReplicaSet containers should have etcd peer certfile and peer keyfile configured appropriately
- All Controls > ReplicaSet > ReplicaSet containers should have kube controller manager root CA file configured appropriately
- All Controls > ReplicaSet > ReplicaSet containers should have kube controller manager service account private key file configured appropriately
- All Controls > ReplicaSet > ReplicaSet containers should have kube-apiserver TLS cert file and TLS private key file configured appropriately
- All Controls > ReplicaSet > ReplicaSet containers should have kubelet certificate authority configured appropriately
- All Controls > ReplicaSet > ReplicaSet containers should have kubelet client CA file configured appropriately
- All Controls > ReplicaSet > ReplicaSet containers should have kubelet terminated pod gc threshold configured appropriately
- All Controls > ReplicaSet > ReplicaSet containers should have kubelet TLS cert file and TLS private key file configured appropriately
- All Controls > ReplicaSet > ReplicaSet containers should have liveness probe
- All Controls > ReplicaSet > ReplicaSet containers should have readiness probe
- All Controls > ReplicaSet > ReplicaSet containers should have secrets defined as files
- All Controls > ReplicaSet > ReplicaSet containers should have security context
- All Controls > ReplicaSet > ReplicaSet containers should minimize its admission with capabilities assigned
- All Controls > ReplicaSet > ReplicaSet containers should minimize the admission of containers with added capability
- All Controls > ReplicaSet > ReplicaSet containers should not be mapped with privilege ports
- All Controls > ReplicaSet > ReplicaSet containers should not use CAP_SYS_ADMIN linux capability
- All Controls > ReplicaSet > ReplicaSet containers token auth file should not be configured
- ReplicaSet containers should have a CPU limit
- ReplicaSet containers should have a CPU request
- ReplicaSet containers should have a memory limit
- ReplicaSet containers should have a memory request
- ReplicaSet containers should not allow privilege escalation
- ReplicaSet containers should not have privileged access
- ReplicaSet containers should not run with host network access
- ReplicaSet containers should not run with root privileges
- ReplicaSet containers should not share the host process namespace
- ReplicaSet containers should run with a read only root file system
- ReplicaSet definition should not use default namespace
- Seccomp profile is set to docker/default in your ReplicaSet definition
Schema for kubernetes_replicaset
Name | Type | Operators | Description |
---|---|---|---|
_ctx | jsonb | Steampipe context in JSON form. | |
annotations | jsonb | Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. | |
available_replicas | bigint | The number of available replicas (ready for at least minReadySeconds) for this replica set. | |
conditions | jsonb | Represents the latest available observations of a replica set's current state. | |
context_name | text | Kubectl config context name. | |
creation_timestamp | timestamp with time zone | CreationTimestamp is a timestamp representing the server time when this object was created. | |
deletion_grace_period_seconds | bigint | Number of seconds allowed for this object to gracefully terminate before it will be removed from the system. Only set when deletionTimestamp is also set. | |
deletion_timestamp | timestamp with time zone | DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. | |
end_line | bigint | The path to the manifest file. | |
finalizers | jsonb | Must be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed. | |
fully_labeled_replicas | bigint | The number of pods that have labels matching the labels of the pod template of the replicaset. | |
generate_name | text | GenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided. | |
generation | bigint | A sequence number representing a specific generation of the desired state. | |
labels | jsonb | Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. | |
min_ready_seconds | bigint | Minimum number of seconds for which a newly created pod should be ready without any of its container crashing, for it to be considered available. Defaults to 0 | |
name | text | Name of the object. Name must be unique within a namespace. | |
namespace | text | Namespace defines the space within which each name must be unique. | |
observed_generation | bigint | ObservedGeneration reflects the generation of the most recently observed ReplicaSet. | |
owner_references | jsonb | List of objects depended by this object. If ALL objects in the list have been deleted, this object will be garbage collected. If this object is managed by a controller, then an entry in this list will point to this controller, with the controller field set to true. There cannot be more than one managing controller. | |
path | text | The path to the manifest file. | |
ready_replicas | bigint | The number of ready replicas for this replica set. | |
replicas | bigint | Replicas is the number of desired replicas. Defaults to 1. | |
resource_version | text | An opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed. | |
selector | jsonb | Selector is a label query over pods that should match the replica count. Label keys and values that must match in order to be controlled by this replica set. | |
selector_query | text | A query string representation of the selector. | |
source_type | text | The source of the resource. Possible values are: deployed and manifest. If the resource is fetched from the spec file the value will be manifest. | |
sp_connection_name | text | Steampipe connection name. | |
sp_ctx | jsonb | Steampipe context in JSON form. | |
start_line | bigint | The path to the manifest file. | |
status_replicas | bigint | The most recently oberved number of replicas. | |
tags | jsonb | A map of tags for the resource. This includes both labels and annotations. | |
template | jsonb | Template is the object that describes the pod that will be created if insufficient replicas are detected. | |
title | text | Title of the resource. | |
uid | text | UID is the unique in time and space value for this object. |
Export
This table is available as a standalone Exporter CLI. Steampipe exporters are stand-alone binaries that allow you to extract data using Steampipe plugins without a database.
You can download the tarball for your platform from the Releases page, but it is simplest to install them with the steampipe_export_installer.sh
script:
/bin/sh -c "$(curl -fsSL https://steampipe.io/install/export.sh)" -- kubernetes
You can pass the configuration to the command with the --config
argument:
steampipe_export_kubernetes --config '<your_config>' kubernetes_replicaset