Welcome to the second part of my three-part guide on Kubernetes CLI! In this part, we will be exploring the use of Kubernetes secrets, ingress, and pod security policies to secure and scale your Kubernetes clusters. If you’ve read the first part of this guide, you’ll already have a solid foundation of knowledge on how to manage Kubernetes resources using the CLI.
Now, it’s time to take it a step further and learn how to secure your clusters and ensure scalability. In this part, we’ll cover everything from creating and managing secrets to configuring ingress for external traffic. We’ll also explore pod security policies and how they can help you ensure the security of your pods.
So, let’s get started and take your Kubernetes knowledge to the next level!
Secrets
Secrets in Kubernetes are used to store sensitive information such as passwords, API keys, and other confidential data. They are encrypted and can be accessed only by authorized parties, ensuring that sensitive information is kept secure.
Create a new Secret from literal values:
kubectl create secret generic my-secret --from-literal=username='myuser' --from-literal=password='mypassword'Create a new Secret from a file:
kubectl create secret generic my-secret --from-file=secrets.yamlDelete a Secret:
kubectl delete secret my-secretEdit a Secret:
kubectl edit secret my-secretAdd a key-value pair to an existing Secret:
kubectl patch secret my-secret -p '{"data": {"newkey": "newvalue"}}'Remove a key-value pair from an existing Secret:
kubectl patch secret my-secret -p '{"data": {"oldkey": null}}'View the data in a Secret:
kubectl get secret my-secret -o jsonpath='{.data}'Decode the data in a Secret:
kubectl get secret my-secret -o jsonpath='{.data.password}' | base64 --decodeCreate a new Secret with a specific type:
kubectl create secret generic my-secret --type=Opaque --from-literal=username='myuser' --from-literal=password='mypassword'View the metadata of a Secret:
kubectl describe secret my-secretAdd or update multiple key-value pairs to an existing Secret:
kubectl create secret generic my-secret --from-literal=newkey=newvalue --dry-run=client -o yaml | kubectl apply -f -Export a Secret to a file:
kubectl get secret my-secret -o yaml > secrets.yamlImport a Secret from a file:
kubectl apply -f secrets.yamlCreate a Secret using a Kubernetes manifest file:
kubectl apply -f my-secret.yamlCreate a Secret with a custom name:
kubectl create secret generic my-secret --from-literal=username='myuser' --from-literal=password='mypassword' --namespace=my-namespaceCreate a Secret with labels:
kubectl create secret generic my-secret --from-literal=username='myuser' --from-literal=password='mypassword' --labels=app=myapp,env=devUpdate a Secret by merging data:
kubectl patch secret my-secret --type='json' -p='[{"op": "add", "path": "/data/newkey", "value": "newvalue"}]'Update a Secret by replacing data:
kubectl create secret generic my-secret --from-literal=newkey=newvalue --dry-run=client -o yaml | kubectl replace -f -Create a Secret with a TLS certificate:
kubectl create secret tls my-secret --cert=cert.pem --key=key.pemView the content of a TLS Secret:
kubectl get secret my-secret -o jsonpath='{.data.tls\.crt}' | base64 --decodeNote: The above commands assume that you have already authenticated with your Kubernetes cluster and have the appropriate permissions to work with Secrets.
The above commands are just examples and may need to be modified to fit your specific use case. Also, keep in mind that Secrets are a sensitive resource and should be handled with care to avoid leaking sensitive data.
These examples assume that you have the necessary files (e.g., cert.pem, key.pem) or information (e.g., myuser, mypassword) to create Secrets. You should always take appropriate security measures when working with sensitive information.
Persistent Volume
Persistent Volumes are a way to store data in Kubernetes clusters. They are network-attached storage resources that can be accessed by Pods. They are useful for storing data that needs to persist even if the Pod is deleted.
Create a Persistent Volume:
kubectl create pv my-pv --capacity=1Gi --access-mode=ReadWriteOnce --hostPath=path/to/my/dataDelete a Persistent Volume:
kubectl delete pv my-pvUpdate a Persistent Volume:
kubectl patch pv my-pv --patch '{"spec": {"accessModes":["ReadWriteMany"]}}'Get details about a Persistent Volume:
kubectl describe pv my-pvList all Persistent Volumes:
kubectl get pvEdit a Persistent Volume:
kubectl edit pv my-pvSet a Persistent Volume’s reclaim policy:
kubectl patch pv my-pv --patch '{"spec": {"persistentVolumeReclaimPolicy":"Recycle"}}'Mark a Persistent Volume as “Released”:
kubectl patch pv my-pv --patch '{"spec": {"claimRef": null}}'Mark a Persistent Volume as “Bound”:
kubectl patch pv my-pv --patch '{"spec": {"claimRef": {"namespace": "mynamespace", "name": "my-pvc"}}}'List Persistent Volumes with a specific label:
kubectl get pv -l app=my-appFilter Persistent Volumes by storage class:
kubectl get pv --field-selector spec.storageClassName=ssdSet a Persistent Volume’s storage class:
kubectl patch pv my-pv --patch '{"spec": {"storageClassName":"fast"}}'Mark a Persistent Volume for deletion:
kubectl delete pv my-pv --grace-period=0 --forceList Persistent Volumes sorted by creation time:
kubectl get pv --sort-by=.metadata.creationTimestampList Persistent Volumes sorted by capacity:
kubectl get pv --sort-by=.spec.capacity.storageSet a Persistent Volume’s access mode:
kubectl patch pv my-pv --patch '{"spec": {"accessModes":["ReadWriteMany"]}}'Set a Persistent Volume’s storage capacity:
kubectl patch pv my-pv --patch '{"spec": {"capacity":{"storage":"2Gi"}}}'Set a Persistent Volume’s mount options:
kubectl patch pv my-pv --patch '{"spec": {"mountOptions":["ro"]}}'Set a Persistent Volume’s NFS mount options:
kubectl patch pv my-pv --type json -p '[{"op": "add", "path": "/spec/nfs", "value": {"server":"192.168.0.100", "path":"/exports/myvol", "readOnly":true}}]'Set a Persistent Volume’s owner reference:
kubectl patch pv my-pv --type merge -p '{"metadata": {"ownerReferences": [{"apiVersion": "v1", "kind": "Namespace", "name": "mynamespace", "uid": "1234", "controller": true}]}}'Persistent Volume Claims
A Persistent Volume Claim is a request for storage made by a Pod. It allows the Pod to use a specific Persistent Volume, which ensures that the Pod has access to the required storage capacity.
Create a new Persistent Volume Claim with default settings:
kubectl create pvc my-pvc --claim-size=1Gi --access-mode=ReadWriteOnce --storage-class=standardUpdate the storage class of an existing Persistent Volume Claim:
kubectl patch pvc my-pvc --patch '{"spec": {"storageClassName": "new-storage-class"}}'Scale up the size of an existing Persistent Volume Claim:
kubectl patch pvc my-pvc --patch '{"spec": {"resources": {"requests": {"storage": "2Gi"}}}}'Delete an existing Persistent Volume Claim:
kubectl delete pvc my-pvcSet a label on an existing Persistent Volume Claim:
kubectl label pvc my-pvc environment=productionRemove a label from an existing Persistent Volume Claim:
kubectl label pvc my-pvc environment-View the status of all Persistent Volume Claims in the current namespace:
kubectl get pvcView detailed information about a specific Persistent Volume Claim:
kubectl describe pvc my-pvcView the YAML configuration for an existing Persistent Volume Claim:
kubectl get pvc my-pvc -o yamlCreate a new Persistent Volume Claim using a YAML configuration file:
kubectl apply -f my-pvc.yamlUpdate an existing Persistent Volume Claim using a YAML configuration file:
kubectl apply -f my-updated-pvc.yamlView the logs for a container in a Pod that is using a Persistent Volume Claim:
kubectl logs my-pod my-containerIngress
Ingress is a way to route traffic into a Kubernetes cluster. It acts as a gateway for incoming traffic and directs it to the correct Service or Pod. It can also be used to configure SSL/TLS encryption for incoming traffic.
Create a new Ingress:
kubectl create ingress my-ingress --rule="host:example.com,path:/foo,backend:serviceName:servicePort"Update the backend service and port of an existing Ingress:
kubectl patch ingress my-ingress --patch '{"spec": {"rules": [{"host": "example.com","http": {"paths": [{"path": "/foo","backend": {"serviceName": "new-service","servicePort": 8080}}]}}]}}'Scale up the number of replicas for the backend service of an Ingress:
kubectl scale deployment my-deployment --replicas=3Delete an existing Ingress:
kubectl delete ingress my-ingressSet a label on an existing Ingress:
kubectl label ingress my-ingress environment=productionRemove a label from an existing Ingress:
kubectl label ingress my-ingress environment-View the status of all Ingresses in the current namespace:
kubectl get ingressView detailed information about a specific Ingress:
kubectl describe ingress my-ingressView the YAML configuration for an existing Ingress:
kubectl get ingress my-ingress -o yamlCreate a new Ingress using a YAML configuration file:
kubectl apply -f my-ingress.yamlUpdate an existing Ingress using a YAML configuration file:
kubectl apply -f my-updated-ingress.yamlView the logs for a Pod that is serving traffic for an Ingress:
kubectl logs my-podUpdate the TLS configuration of an existing Ingress:
kubectl patch ingress my-ingress --type=json -p='[{"op": "add", "path": "/spec/tls/0", "value": {"hosts": ["example.com"], "secretName": "tls-secret"}}]'Set a new annotation on an existing Ingress:
kubectl annotate ingress my-ingress my-annotation=my-valueRemove an annotation from an existing Ingress:
kubectl annotate ingress my-ingress my-annotation-Scale up the number of replicas for all backend services of an Ingress:
kubectl scale deployment --all --replicas=3Rollback an Ingress to a previous revision:
kubectl rollout undo ingress my-ingressPause an Ingress rollout:
kubectl rollout pause ingress my-ingressResume an Ingress rollout:
kubectl rollout resume ingress my-ingressView the status of an Ingress rollout:
kubectl rollout status ingress my-ingressForcefully update the configuration of an existing Ingress:
kubectl apply -f my-updated-ingress.yaml --forceConclusion: These are just a few examples of imperative commands for working with Kubernetes Ingress resources. The exact commands and parameters you use will depend on your specific use case and configuration.
These are just a few more examples of imperative commands for working with Kubernetes Ingress resources. The exact commands and parameters you use will depend on your specific use case and configuration.
Daemon Sets
Daemon Sets ensure that a specific Pod runs on every node in a Kubernetes cluster. This is useful for running system-level daemons or other background processes that need to be present on every node.
Create a DaemonSet:
kubectl create daemonset my-daemonset --image=my-imageUpdate the image of a DaemonSet:
kubectl set image daemonset my-daemonset my-container=my-new-imageScale a DaemonSet to 5 replicas:
kubectl scale daemonset my-daemonset --replicas=5Rollout a new version of a DaemonSet:
kubectl rollout daemonset my-daemonset --image=my-new-imagePause a DaemonSet:
kubectl rollout pause daemonset my-daemonsetResume a paused DaemonSet:
kubectl rollout resume daemonset my-daemonsetCheck the rollout history of a DaemonSet:
kubectl rollout history daemonset my-daemonsetUndo the last rollout of a DaemonSet:
kubectl rollout undo daemonset my-daemonsetRollback to a specific revision of a DaemonSet:
kubectl rollout undo daemonset my-daemonset --to-revision=2Restart all pods of a DaemonSet:
kubectl rollout restart daemonset my-daemonsetDelete a DaemonSet:
kubectl delete daemonset my-daemonsetGet the logs of a container in a DaemonSet:
kubectl logs daemonset/my-daemonset -c my-containerGet the status of a DaemonSet:
kubectl get daemonset my-daemonsetGet detailed information about a DaemonSet:
kubectl describe daemonset my-daemonsetUpdate the resource limits of a DaemonSet:
kubectl set resources daemonset my-daemonset -c my-container --limits=cpu=200m,memory=512MiUpdate the resource requests of a DaemonSet:
kubectl set resources daemonset my-daemonset -c my-container --requests=cpu=100m,memory=256MiHorizontal Pod Autoscaling
Horizontal Pod Autoscaling automatically scales the number of Pods based on CPU utilization or other metrics. This helps ensure that the cluster can handle increased traffic or workload demands.
Create an autoscaler for a deployment:
kubectl autoscale deployment my-deployment --cpu-percent=80 --min=2 --max=10Update the min and max replicas of an autoscaler:
kubectl scale --current-replicas=2 --min=1 --max=5 deployment/my-deploymentUpdate the CPU target of an autoscaler:
kubectl patch hpa my-hpa -p '{"spec":{"targetCPUUtilizationPercentage": "50"}}'Delete an autoscaler:
kubectl delete hpa my-hpaGet the status of an autoscaler:
kubectl get hpa my-hpaGet detailed information about an autoscaler:
kubectl describe hpa my-hpaUpdate the max replicas of an autoscaler:
kubectl patch hpa my-hpa -p '{"spec":{"maxReplicas": "10"}}'Update the min replicas of an autoscaler:
kubectl patch hpa my-hpa -p '{"spec":{"minReplicas": "3"}}'Update the CPU and memory targets of an autoscaler:
kubectl autoscale deployment my-deployment --cpu-percent=50 --min=2 --max=10 --memory-percent=80Update the metrics of an autoscaler:
kubectl patch hpa my-hpa -p '{"spec":{"metrics":[{"type":"Resource","resource":{"name":"cpu","target":{"type":"Utilization","averageUtilization":50}}},{"type":"Resource","resource":{"name":"memory","target":{"type":"Utilization","averageUtilization":80}}}]}}'Update the scaling behavior of an autoscaler:
kubectl patch hpa my-hpa -p '{"spec":{"behavior":{"scaleUp":{"stabilizationWindowSeconds":120,"policies":[{"type":"Pods","value":3,"periodSeconds":10}]},"scaleDown":{"stabilizationWindowSeconds":120,"policies":[{"type":"Percent","value":50,"periodSeconds":10}]}}}}'Get the events related to an autoscaler:
kubectl get events --field-selector involvedObject.kind=HorizontalPodAutoscaler --all-namespacesUpdate the behavior of an autoscaler to use the CPU and memory targets:
kubectl patch hpa my-hpa -p '{"spec":{"behavior":"predictable"}}'Update the behavior of an autoscaler to use the default behavior:
kubectl patch hpa my-hpa -p '{"spec":{"behavior":"default"}}'Update the behavior of an autoscaler to use the custom behavior:
kubectl patch hpa my-hpa -p '{"spec":{"behavior":"custom"}}'Get the metrics of an autoscaler:
kubectl get --raw "/apis/metrics.k8s.io/v1beta1/namespaces/my-namespace/pods" | jq '.items[] | select(.metadata.name | contains("my-deployment")) | .containers[].usage.cpu' | paste -sd+ - | bcGet the recommended configuration for an autoscaler:
kubectl autoscale --dry-run --cpu-percent=50 --min=2 --max=10 deployment/my-deploymentVertical Pod Autoscaling
Vertical Pod Autoscaling automatically adjusts the CPU and memory resources allocated to a Pod based on its usage patterns. This ensures that the Pod has the necessary resources to run efficiently.
Enable VPA for a deployment:
kubectl create vpa my-vpa --namespace=my-namespace --target=my-deployment --update-policy=autoUpdate the VPA resource:
kubectl patch vpa my-vpa --namespace=my-namespace --patch '{"spec":{"updatePolicy":{"updateMode":"Off"}}}'Disable VPA for a deployment:
kubectl delete vpa my-vpa --namespace=my-namespaceGet the status of a VPA:
kubectl get vpa my-vpa --namespace=my-namespaceGet detailed information about a VPA:
kubectl describe vpa my-vpa --namespace=my-namespaceGet the recommended configuration for a VPA:
kubectl get pods --namespace=my-namespace --selector=app=my-app --output=json | vpa-admission-controllerGet the logs of the VPA controller:
kubectl logs -f vpa-recommender-6cf5c6d5b6-ltf8w --namespace=my-namespace -c vpa-recommenderGet the metrics of a VPA:
kubectl get --raw "/apis/metrics.k8s.io/v1beta1/namespaces/my-namespace/pods" | jq '.items[] | select(.metadata.name | contains("my-deployment")) | .containers[].usage.cpu' | paste -sd+ - | bcCheck if VPA is supported on the cluster:
kubectl api-versions | grep "autoscaling.k8s.io/v1beta2" && kubectl api-versions | grep "vpa.k8s.io/v1"Update the target reference of a VPA:
kubectl patch vpa my-vpa --namespace=my-namespace --type=json -p='[{"op": "replace", "path": "/spec/targetRef", "value": {"kind": "Deployment", "name": "my-deployment"}}]'Update the update policy of a VPA:
kubectl patch vpa my-vpa --namespace=my-namespace --type=json -p='[{"op": "replace", "path": "/spec/updatePolicy", "value": {"updateMode": "Auto", "updateBudget": {"maxSurge": "25%", "maxUnavailable": "25%"}}}]'Update the resource policy of a VPA:
kubectl patch vpa my-vpa --namespace=my-namespace --type=json -p='[{"op": "replace", "path": "/spec/resourcePolicy", "value": {"containerPolicies": [{"containerName": "my-container", "mode": "Auto", "minAllowed": {"cpu": "100m", "memory": "256Mi"}, "maxAllowed": {"cpu": "200m", "memory": "512Mi"}}]}}]'Update the update policy and resource policy of a VPA:
kubectl patch vpa my-vpa --namespace=my-namespace --type=json -p='[{"op": "replace", "path": "/spec/updatePolicy", "value": {"updateMode": "Auto", "updateBudget": {"maxSurge": "25%", "maxUnavailable": "25%"}}, "resourcePolicy": {"containerPolicies": [{"containerName": "my-container", "mode": "Auto", "minAllowed": {"cpu": "100m", "memory": "256Mi"}, "maxAllowed": {"cpu": "200m", "memory": "512Mi"}}]}}]'Update the annotation of a deployment to use a VPA:
kubectl annotate deployment my-deployment --namespace=my-namespace vertical-pod-autoscaler=my-vpaRemove the annotation of a deployment to disable VPA:
kubectl annotate deployment my-deployment --namespace=my-namespace vertical-pod-autoscaler-Pod Disruption Budget:
Pod Disruption Budgets ensure that a minimum number of Pods are always available in a deployment. This helps prevent service disruptions during upgrades or maintenance periods.
Create a Pod Disruption Budget:
kubectl create pdb my-pdb --namespace=my-namespace --selector=app=my-app --min-available=2Update a Pod Disruption Budget:
kubectl patch pdb my-pdb --namespace=my-namespace --type=json -p='[{"op": "replace", "path": "/spec/minAvailable", "value": 3}]'Delete a Pod Disruption Budget:
kubectl delete pdb my-pdb --namespace=my-namespaceList all Pod Disruption Budgets:
kubectl get pdb --all-namespacesDescribe a Pod Disruption Budget:
kubectl describe pdb my-pdb --namespace=my-namespaceSet a Pod Disruption Budget on a Deployment:
kubectl patch deployment my-deployment --namespace=my-namespace -p '{"spec": {"minAvailable": 2, "strategy": {"type": "RollingUpdate", "rollingUpdate": {"maxUnavailable": 1}}}}'Remove a Pod Disruption Budget from a Deployment:
kubectl patch deployment my-deployment --namespace=my-namespace -p '{"spec": {"minAvailable": null}}'Check the status of a Pod Disruption Budget:
kubectl describe pdb my-pdb --namespace=my-namespace | grep StatusCheck the status of a Pod with respect to a Pod Disruption Budget:
kubectl describe pod my-pod --namespace=my-namespace | grep PodScheduledSimulate the eviction of a Pod in a Pod Disruption Budget:
kubectl drain my-node --ignore-daemonsets --delete-local-data --force --grace-period=30 --pod-selector=app=my-appResource Quota
Resource Quotas limit the amount of CPU, memory, and storage resources that a user or group can use in a Kubernetes cluster. This helps ensure that resources are distributed fairly and prevents any one user or group from consuming too many resources.
Create a Resource Quota:
kubectl create quota my-quota --hard=pods=5,requests.cpu=1,requests.memory=1G,limits.cpu=2,limits.memory=2G --namespace=my-namespaceUpdate a Resource Quota:
kubectl patch quota my-quota --namespace=my-namespace --type='json' -p='[{"op": "replace", "path": "/spec/hard/limits.cpu", "value": "4"}]'Delete a Resource Quota:
kubectl delete quota my-quota --namespace=my-namespaceList all Resource Quotas:
kubectl get quota --all-namespacesDescribe a Resource Quota:
kubectl describe quota my-quota --namespace=my-namespaceCheck the usage of a Resource Quota:
kubectl describe quota my-quota --namespace=my-namespace | grep UsedCheck the usage of a Resource Quota by a specific Pod:
kubectl describe pod my-pod --namespace=my-namespace | grep -A 2 ResourceList all Pods and their resource usage in a namespace:
kubectl top pods --namespace=my-namespaceList all Nodes and their resource usage:
kubectl top nodesList all Pods using a specific resource:
kubectl describe pods --all-namespaces | grep -A 5 Resources.*<resource_name>List all Resource Quotas and their associated Pods:
kubectl describe quota --namespace=my-namespace | grep -A 5 UsedCheck if a Pod satisfies a Resource Quota:
kubectl auth can-i create pod --dry-run --namespace=my-namespace --resource=pods --subresource=podquotas --pod-template-file=my-pod.yamlService Accounts
Service Accounts are used to provide authentication and authorization for Pods running in a Kubernetes cluster. They allow Pods to access other resources, such as Secrets or Persistent Volumes, without having to manage credentials themselves.
Create a Service Account named “my-service-account” in the “my-namespace” namespace:
kubectl create serviceaccount my-service-account -n my-namespaceView the details of a Service Account named “my-service-account” in the “my-namespace” namespace:
kubectl get serviceaccount my-service-account -n my-namespaceDelete a Service Account named “my-service-account” in the “my-namespace” namespace:
kubectl delete serviceaccount my-service-account -n my-namespaceCreate a new Secret named “my-secret” in the “my-namespace” namespace containing a Service Account token for “my-service-account”:
kubectl create secret generic my-secret --from-literal=token="$(kubectl get serviceaccount my-service-account -n my-namespace -o jsonpath='{.secrets[0].data.token}' | base64 -d)" -n my-namespaceCreate a new Pod named “my-pod” in the “my-namespace” namespace with a specific Service Account:
kubectl run my-pod --image=my-image --serviceaccount=my-service-account -n my-namespaceUpdate the Service Account of a running Pod named “my-pod” in the “my-namespace” namespace:
kubectl patch pod my-pod -p '{"spec":{"serviceAccountName":"new-service-account"}}' -n my-namespaceCreate a new Role named “my-role” in the “my-namespace” namespace with permissions to access a specific Service Account:
kubectl create role my-role --verb=get --verb=list --resource=pods --namespace=my-namespace --serviceaccount=my-namespace:my-service-accountBind a Role named “my-role” to a RoleBinding named “my-role-binding” in the “my-namespace” namespace:
kubectl create rolebinding my-role-binding --role=my-role --serviceaccount=my-namespace:my-service-account --namespace=my-namespaceList all Service Accounts in the “my-namespace” namespace:
kubectl get serviceaccounts -n my-namespaceDescribe the Service Account named “my-service-account” in the “my-namespace” namespace:
kubectl describe serviceaccount my-service-account -n my-namespaceCreate a new Service Account named “my-service-account” in the “my-namespace” namespace:
kubectl create serviceaccount my-service-account -n my-namespaceDelete the Service Account named “my-service-account” in the “my-namespace” namespace:
kubectl delete serviceaccount my-service-account -n my-namespaceUpdate the image pull secret of a Service Account named “my-service-account” in the “my-namespace” namespace:
kubectl patch serviceaccount my-service-account -p '{"imagePullSecrets": [{"name": "my-secret"}]}' -n my-namespace
