Table: kubernetes_replication_controller - Query Kubernetes Replication Controllers using SQL
Kubernetes Replication Controllers are a core component of Kubernetes that ensure a specified number of pod replicas are running at any given time. They are particularly useful for stateless applications where more instances can be easily created or destroyed. Replication Controllers supersede the functionality of Kubernetes Pods by adding life-cycle control, system introspection, and self-healing mechanisms.
Table Usage Guide
The kubernetes_replication_controller
table provides insights into Replication Controllers within Kubernetes. As a DevOps engineer, you can explore controller-specific details through this table, including its status, configuration, and specifications. Utilize it to manage and monitor the state of your Kubernetes environment, ensuring the desired number of pod replicas are always running.
Examples
Basic Info
Explore the status of your Kubernetes replication controllers to understand the current state of your system. This can help you assess the number of desired, current, and ready replicas, and determine the age and selector details of each controller.
select name, namespace, replicas as desired, status_replicas as current, ready_replicas as ready, age(current_timestamp, creation_timestamp), selectorfrom kubernetes_replication_controller;
select name, namespace, replicas as desired, status_replicas as current, ready_replicas as ready, (julianday('now') - julianday(creation_timestamp)) as age, selectorfrom kubernetes_replication_controller;
Get details of containers and image
Explore the intricacies of your Kubernetes replication controllers by identifying the associated containers and images. This enables you to better understand the structure of your deployment, facilitating more effective management and troubleshooting.
select name, namespace, jsonb_agg(container.value -> 'name') as containers, jsonb_agg(container.value -> 'image') as imagesfrom kubernetes_replication_controller, jsonb_array_elements(template -> 'spec' -> 'containers') as containergroup by name, namespace;
select name, namespace, json_group_array(json_extract(container.value, '$.name')) as containers, json_group_array(json_extract(container.value, '$.image')) as imagesfrom kubernetes_replication_controller, json_each(json_extract(template, '$.spec.containers')) as containergroup by name, namespace;
List manifest resources
Explore the Kubernetes replication controllers with a specified path to understand their names, namespaces, and desired replicas. This can help in managing and monitoring the distribution and replication of workloads in a Kubernetes environment.
select name, namespace, replicas as desired, selector, pathfrom kubernetes_replication_controllerwhere path is not null;
select name, namespace, replicas as desired, selector, pathfrom kubernetes_replication_controllerwhere path is not null;
Control examples
- All Controls > ReplicationController > Replication Controller containers --service-account-key-file argument should be set as appropriate
- All Controls > ReplicationController > Replication Controller containers admission control plugin should be set to 'always pull images'
- All Controls > ReplicationController > Replication Controller containers admission control plugin should not be set to 'always admit'
- All Controls > ReplicationController > Replication Controller containers argument --streaming-connection-idle-timeout should not be set to 0
- All Controls > ReplicationController > Replication Controller containers argument admission control plugin NamespaceLifecycle should be enabled
- All Controls > ReplicationController > Replication Controller containers argument admission control plugin NodeRestriction should be enabled
- All Controls > ReplicationController > Replication Controller containers argument admission control plugin PodSecurityPolicy should be enabled
- All Controls > ReplicationController > Replication Controller containers argument admission control plugin ServiceAccount should be enabled
- All Controls > ReplicationController > Replication Controller containers argument admission control plugin where either PodSecurityPolicy or SecurityContextDeny should be enabled
- All Controls > ReplicationController > Replication Controller containers argument anonymous auth should be disabled
- All Controls > ReplicationController > Replication Controller containers argument apiserver etcd certfile and keyfile should be configured
- All Controls > ReplicationController > Replication Controller containers argument authorization mode should have node
- All Controls > ReplicationController > Replication Controller containers argument authorization mode should have RBAC
- All Controls > ReplicationController > Replication Controller containers argument authorization mode should not be set to 'always allow'
- All Controls > ReplicationController > Replication Controller containers argument basic auth file should not be set
- All Controls > ReplicationController > Replication Controller containers argument etcd auto TLS should be disabled
- All Controls > ReplicationController > Replication Controller containers argument etcd cafile should be set
- All Controls > ReplicationController > Replication Controller containers argument etcd client cert auth should be enabled
- All Controls > ReplicationController > Replication Controller containers argument event qps should be less than 5
- All Controls > ReplicationController > Replication Controller containers argument hostname override should not be configured
- All Controls > ReplicationController > Replication Controller containers argument insecure bind address should not be set
- All Controls > ReplicationController > Replication Controller containers argument insecure port should be set to 0
- All Controls > ReplicationController > Replication Controller containers argument kube controller manager service account credentials should be enabled
- All Controls > ReplicationController > Replication Controller containers argument kube-controller-manager bind address should be set to 127.0.0.1
- All Controls > ReplicationController > Replication Controller containers argument kube-scheduler bind address should be set to 127.0.0.1
- All Controls > ReplicationController > Replication Controller containers argument kubelet authorization mode should not be set to 'always allow'
- All Controls > ReplicationController > Replication Controller containers argument kubelet client certificate and key should be configured
- All Controls > ReplicationController > Replication Controller containers argument kubelet HTTPS should be enabled
- All Controls > ReplicationController > Replication Controller containers argument kubelet read-only port should be set to 0
- All Controls > ReplicationController > Replication Controller containers argument make iptables util chains should be enabled
- All Controls > ReplicationController > Replication Controller containers argument protect kernel defaults should be enabled
- All Controls > ReplicationController > Replication Controller containers argument request timeout should be set as appropriate
- All Controls > ReplicationController > Replication Controller containers argument rotate kubelet server certificate should be enabled
- All Controls > ReplicationController > Replication Controller containers argument secure port should not be set to 0
- All Controls > ReplicationController > Replication Controller containers argument service account lookup should be enabled
- All Controls > ReplicationController > Replication Controller containers certificate rotation should be enabled
- All Controls > ReplicationController > Replication Controller containers has image pull policy set to Always
- All Controls > ReplicationController > Replication Controller containers have image tag specified which should be fixed not latest or blank
- All Controls > ReplicationController > Replication Controller containers kube controller manager profiling should be disabled
- All Controls > ReplicationController > Replication Controller containers kube scheduler profiling should be disabled
- All Controls > ReplicationController > Replication Controller containers kube-apiserver profiling should be disabled
- All Controls > ReplicationController > Replication Controller containers kube-apiserver should only make use of strong cryptographic ciphers
- All Controls > ReplicationController > Replication Controller containers kubelet should only make use of strong cryptographic ciphers
- All Controls > ReplicationController > Replication Controller containers Kubernetes dashboard should not be deployed
- All Controls > ReplicationController > Replication Controller containers peer client cert auth should be enabled
- All Controls > ReplicationController > Replication Controller containers ports should not have host port specified
- All Controls > ReplicationController > Replication Controller containers should has admission capability restricted
- All Controls > ReplicationController > Replication Controller containers should has encryption providers configured appropriately
- All Controls > ReplicationController > Replication Controller containers should have audit log max backup set to 10 or greater
- All Controls > ReplicationController > Replication Controller containers should have audit log max size set to 100 or greater
- All Controls > ReplicationController > Replication Controller containers should have audit log max-age set to 30 or greater
- All Controls > ReplicationController > Replication Controller containers should have audit log path configured appropriately
- All Controls > ReplicationController > Replication Controller containers should have etcd certfile and keyfile configured appropriately
- All Controls > ReplicationController > Replication Controller containers should have etcd peer certfile and peer keyfile configured appropriately
- All Controls > ReplicationController > Replication Controller containers should have kube controller manager root CA file configured appropriately
- All Controls > ReplicationController > Replication Controller containers should have kube controller manager service account private key file configured appropriately
- All Controls > ReplicationController > Replication Controller containers should have kube-apiserver TLS cert file and TLS private key file configured appropriately
- All Controls > ReplicationController > Replication Controller containers should have kubelet certificate authority configured appropriately
- All Controls > ReplicationController > Replication Controller containers should have kubelet client CA file configured appropriately
- All Controls > ReplicationController > Replication Controller containers should have kubelet terminated pod gc threshold configured appropriately
- All Controls > ReplicationController > Replication Controller containers should have kubelet TLS cert file and TLS private key file configured appropriately
- All Controls > ReplicationController > Replication Controller containers should have secrets defined as files
- All Controls > ReplicationController > Replication Controller containers should have securityContext defined
- All Controls > ReplicationController > Replication Controller containers should minimize its admission with capabilities assigned
- All Controls > ReplicationController > Replication Controller containers should minimize the admission of containers with added capability
- All Controls > ReplicationController > Replication Controller containers should not use CAP_SYS_ADMIN linux capability
- All Controls > ReplicationController > Replication Controller containers token auth file should not be configured
- All Controls > ReplicationController > ReplicationController containers should have liveness probe
- All Controls > ReplicationController > ReplicationController containers should have readiness probe
- All Controls > ReplicationController > ReplicationController containers should not be mapped with privilege ports
- ReplicationController containers should have a CPU limit
- ReplicationController containers should have a CPU request
- ReplicationController containers should have a memory limit
- ReplicationController containers should have a memory request
- ReplicationController containers should not allow privilege escalation
- ReplicationController containers should not have privileged access
- ReplicationController containers should not run with host network access
- ReplicationController containers should not run with root privileges
- ReplicationController containers should not share the host process namespace
- ReplicationController containers should run with a read only root file system
- ReplicationController definition should not use default namespace
- Seccomp profile is set to docker/default in your Replication Controller definition
Schema for kubernetes_replication_controller
Name | Type | Operators | Description |
---|---|---|---|
_ctx | jsonb | Steampipe context in JSON form. | |
annotations | jsonb | Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. | |
available_replicas | bigint | The number of available replicas (ready for at least minReadySeconds) for this replica set. | |
conditions | jsonb | Represents the latest available observations of a replication controller's current state. | |
context_name | text | Kubectl config context name. | |
creation_timestamp | timestamp with time zone | CreationTimestamp is a timestamp representing the server time when this object was created. | |
deletion_grace_period_seconds | bigint | Number of seconds allowed for this object to gracefully terminate before it will be removed from the system. Only set when deletionTimestamp is also set. | |
deletion_timestamp | timestamp with time zone | DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. | |
end_line | bigint | The path to the manifest file. | |
finalizers | jsonb | Must be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed. | |
fully_labeled_replicas | bigint | The number of pods that have labels matching the labels of the pod template of the replicaset. | |
generate_name | text | GenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided. | |
generation | bigint | A sequence number representing a specific generation of the desired state. | |
labels | jsonb | Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. | |
min_ready_seconds | bigint | Minimum number of seconds for which a newly created pod should be ready without any of its container crashing, for it to be considered available. Defaults to 0 | |
name | text | Name of the object. Name must be unique within a namespace. | |
namespace | text | Namespace defines the space within which each name must be unique. | |
observed_generation | bigint | Reflects the generation of the most recently observed replication controller. | |
owner_references | jsonb | List of objects depended by this object. If ALL objects in the list have been deleted, this object will be garbage collected. If this object is managed by a controller, then an entry in this list will point to this controller, with the controller field set to true. There cannot be more than one managing controller. | |
path | text | The path to the manifest file. | |
ready_replicas | bigint | The number of ready replicas for this replica set. | |
replicas | bigint | Replicas is the number of desired replicas. Defaults to 1. | |
resource_version | text | An opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed. | |
selector | jsonb | Selector is a label query over pods that should match the replica count. Label keys and values that must match in order to be controlled by this replica set. | |
selector_query | text | A query string representation of the selector. | |
source_type | text | The source of the resource. Possible values are: deployed and manifest. If the resource is fetched from the spec file the value will be manifest. | |
sp_connection_name | text | Steampipe connection name. | |
sp_ctx | jsonb | Steampipe context in JSON form. | |
start_line | bigint | The path to the manifest file. | |
status_replicas | bigint | The most recently oberved number of replicas. | |
tags | jsonb | A map of tags for the resource. This includes both labels and annotations. | |
template | jsonb | Template is the object that describes the pod that will be created if insufficient replicas are detected. | |
title | text | Title of the resource. | |
uid | text | UID is the unique in time and space value for this object. |
Export
This table is available as a standalone Exporter CLI. Steampipe exporters are stand-alone binaries that allow you to extract data using Steampipe plugins without a database.
You can download the tarball for your platform from the Releases page, but it is simplest to install them with the steampipe_export_installer.sh
script:
/bin/sh -c "$(curl -fsSL https://steampipe.io/install/export.sh)" -- kubernetes
You can pass the configuration to the command with the --config
argument:
steampipe_export_kubernetes --config '<your_config>' kubernetes_replication_controller