OpenShift & K8S Cheat Sheet

1 Kubernetes

1.1 Daily

* https://kubernetes.io/de/docs/reference/kubectl/cheatsheet/

1.1.1 SHELL

• Authenticate Kubectl

export KUBECONFIG=<PATH-TO-M>-CONFIG>/kubeconfig-dev.yaml

1.1.2 Install Helm

V=3.5.4
wget https://get.helm.sh/helm-v$V-linux-amd64.tar.gz
tar vxfz helm-v$V-linux-amd64.tar.gz 
mv linux-amd64/helm bin/
rm -rf helm-v$V-linux-amd64.tar.gz linux-amd64
helm completion bash > /etc/profile.d/helm.sh

1.1.3 Use Helm

• https://artifacthub.io/
• https://hub.helm.sm/
• https://hub.kubeapps.com/

helm search hub wordpress --max-col-width 120
helm repo add bitnami https://charts.bitnami.com/bitnami
kubectl create namespace wordpress
kubectl config set-context --current --namespace=wordpress

1.1.4 Export current Namespace Objects

for n in $(kubectl get -o=name pvc,configmap,ingress,service,secret,deployment,statefulset,hpa,job,cronjob | grep -v 'secret/default-token')
do
   kubectl get -o=yaml --export $n > $(dirname $n)_$(basename $n).yaml
done

1.1.5 .bash_profile

• openshift project/user prompt

source <(kubectl completion bash)
export PS1='### \D{%d.%m.%Y_%H:%M} \u@\e[1;32m\h\e[m:\w \e[1;33m✯ $(kubectl config view -o jsonpath="{.contexts[].context.namespace}")\e[m \n# '

• password gen

genpasswd() {
   local l=$1
   [ "$l" == "" ] && l=16
   tr -dc A-Za-z0-9_=., < /dev/urandom | head -c ${l} | xargs 
}

1.2 Deploy

1.2.1 Create and change into Namespace

kubectl create namespace mynamespace
kubectl config set-context --current --namespace=mynamespace

1.2.2 Deploy Docker Container and Expose Service

kubectl create deployment xfce --image=christian773/xfce-vnc:latest --port=6901

1.2.3 Inject VARS into Deployment/Container

kubectl edit deployment nginx1

spec:
  containers:
  - name: nginx
    image: nginx:1.7.9
    env:
    - name: MY_VAT
      value: MY_VALUE

1.2.4 Get Environment VARS of Pod

kubectl exec pod-name -- printenv

1.2.5 Expose Container Port as Service

kubectl expose deployment nginx-app --port=8080 --name=nginx-service

1.2.6 Create Ingress Rule for Service

kubectl create ingress ingress-www --rule=www.domain.com/*=nginx-service:8080

1.3 Configure

1.3.1 Traefik Config

- https://levelup.gitconnected.com/a-guide-to-k3s-ingress-using-traefik-with-nodeport-6eb29add0b4b

kubectl edit deployments traefik -n kube-system
kubectl -n kube-system edit cm traefik

1.4 Debug

1.4.1 Run Container with custom Command

kubectl run -i --tty busybox --image=busybox -- sh

1.4.2 Attach Container in Pod

kubectl attach busybox -c busybox -i -t

1.4.3 Open Firewall for NodePort (non persistent)

kubectl describe svc | grep NodePort: | awk '{print $3}' | tr 'A-Z' 'a-z' | grep -v '^$' | while read PORT
do
  echo PORT=$PORT
  firewall-cmd --zone=public --add-port=$PORT
done

2 Helpers

2.1 .bash_profile

• openshift project/user prompt

function ps1(){
   export PS1='[\u@\h($(oc whoami -c 2>/dev/null|cut -d/ -f3,1)) \W]\$ '
}
function ps1e(){
   export PS1='# [\d \t \u@\h($(oc whoami -c 2>/dev/null|cut -d/ -f3,1)) \W]\n$ '
}

• password gen

genpasswd() {
        local l=$1
        [ "$l" == "" ] && l=16
        tr -dc A-Za-z0-9_=%.,: < /dev/urandom | head -c ${l} | xargs 
 }

3 Administration

3.1 daily cmds

oc get nodes -o wide
oc get all -o wide --all-namespaces
oc get ep -o wide
oc get events --sort-by='.lastTimestamp'
oc get rolebindings --all-namespaces
oc get pv
oc get pvc
oc get projects
oc get users
oc get groups

3.2 inspect user/group permissions

oc get rolebinding -o wide -n gitea
oc get rolebinding -o wide --all-namespaces

3.3 inspect imagestreams

oc get is -n openshift
oc describe is php -n openshift
oc export -n openshift isimage php@42c4a9072f

3.4 backup all openshift objects in all projects

oc get all --all-namespaces --no-headers=true | awk '{print $1","$2}' | while read obj
do
  NS=$(echo $obj | cut -d, -f1)
  OBJ=$(echo $obj | cut -d, -f2)
  FILE=$(echo $obj | sed 's/\//-/g;s/,/-/g')
  echo $NS $OBJ $FILE; oc export -n $NS $OBJ -o yaml > $FILE.yml
done

3.5 backup all kubernets objects in current namespace

oc get projects
oc project my-namespace
kubectl get all --no-headers=true | awk '{print $1}' | while read obj
do
  OBJ=$(echo $obj | cut -d, -f2)
  FILE=$(echo $obj | sed 's/\//-/g;s/,/-/g')
  echo " ------------- $NS $OBJ $FILE"
  kubectl get $OBJ -o yaml > $FILE.yml
done

4 snippets

4.1 run as root (anyuid)

oc create serviceaccount sa-anyuid
oc adm policy add-scc-to-user anyuid -z sa-anyuid
# create new-app before to get a dc
oc patch dc/deployment-config-name --patch '{"spec":{"template":{"spec":{"serviceAccountName": "sa-anyuid"}}}}'

4.2 run as root (anyuid) for every pod in project

oc adm policy add-scc-to-user anyuid -z default

4.3 imagestream demo (build service)

• get all the imagestreams

oc get is -n openshift

• inspect nginx imagestream

oc describe is nginx -n openshift

• setup new project

oc new-project is-demo

• setup the dev environment

oc new-app --name=html-dev  nginx:1.10~https://github.com/joe-speedboat/openshift.html.devops.git#master
oc get all
oc logs -f builds/html-dev-1

oc get svc
oc expose svc/html-dev --hostname=html-dev.app.domain.com
oc get route

curl http://html-dev.app.domain.com

• show this app to the qa team

oc get is
oc tag docker-registry.default.svc:5000/is-demo/html-dev:latest is-demo/html-qa:1.0
oc get is
oc new-app --name=html-qa --image-stream="is-demo/html-qa:1.0"
oc expose svc/html-qa --hostname=html-qa.app.domain.com
curl html-qa.app.domain.com

• now go and make some changes to the git repo, then push it to github

now lets build the latest dev release

oc start-build html-dev
oc status
oc get pods

• check dev application for latest changes

curl http://html-dev.app.domain.com

• check if qa application remains in desired state

curl html-qa.app.domain.com

• now commit the new dev branch to qa branch

oc get is
oc tag docker-registry.default.svc:5000/is-demo/html-dev html-qa:1.1

• change the imagestream to newer release

oc edit dc/html-qa
oc get dc
oc get pods

• check if qa application is reflecting latest changes from v1.1

curl html-qa.app.domain.com

• now we rollback the qa release to v1.0

oc edit dc/html-qa
oc get dc
oc get pods

• check if qa application is reflecting the rollbacked version v1.0

curl html-qa.app.domain.com

5 database backup

5.1 mariadb (os v3.9)

• install global backup template

oc create -f https://raw.githubusercontent.com/joe-speedboat/mariadb-backup-cronjob/master/mariadb-backup-template.yaml

• more information can be found on git repo mariadb-backup-cronjob

6 Maintenance

6.1 CleanUp old docker images on nodes

Keeping up to three tag revisions 1, and keeping resources (images, image streams and pods) younger than sixty minutes:

oc adm prune images --keep-tag-revisions=3 --keep-younger-than=60m

Pruning every image that exceeds defined limits:

oc adm prune images --prune-over-size-limit

CopyPaste example

oc adm prune images --keep-tag-revisions=3 --keep-younger-than=60m --confirm
oc adm prune images --prune-over-size-limit --confirm