Popeye — A Kubernetes Cluster Sanitizer

The Rising Pain for Enterprise Businesses

https://www.collabnix.com

Introducing Popeye

How is Popeye different from other existing tools?

Installation

$ brew install derailed/popeye/popeye
replace (
github.com/derailed/popeye => MY_POPEYE_CLONED_GIT_REPO
)
go run main.go
git clone https://github.com/derailed/popeye
cd popeye
# Build and install
go install
# Run
popeye

Checking the version:

$ popeye version
___ ___ _____ _____ K .-'-.
| _ \___| _ \ __\ \ / / __| 8 __| `\
| _/ _ \ _/ _| \ V /| _| s `-,-`--._ `\
|_| \___/_| |___| |_| |___| [] .->' a `|-'
Biffs`em and Buffs`em! `=/ (__/_ /
\_, ` _)
`----; |
Version: 0.9.7
Commit: 4f12a172495e2acb7a621b29cffa924f1cd72580
Date: 2021-07-20T14:57:08Z
Logs: /var/folders/7k/2jz4csrs4ss65_x0slwbl1540000gn/T/popeye.log

Popeye a cluster

$ popeyeGENERAL [DOCKER-DESKTOP]
┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅
· Connectivity...................................................✅
· MetricServer...................................................💥
CLUSTER (1 SCANNED) 💥 0 😱 0 🔊 0 ✅ 1 100٪
┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅
· Version.........................................................✅
✅ [POP-406] K8s version OK.
CLUSTERROLES (60 SCANNE. 💥 0 😱 0 🔊 15 ✅ 45 100٪
┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅
· admin...........................................................🔊
🔊 [POP-400] Used? Unable to locate resource reference.
· cluster-admin............................................... ....✅
· edit.............................................................🔊
🔊 [POP-400] Used? Unable to locate resource reference.
· kubeadm:getnodes.................................................✅
· system:aggregate-to-admin.......................................................🔊
🔊 [POP-400] Used? Unable to locate resource reference.
· system:aggregate-to-edit........................................................🔊
🔊 [POP-400] Used? Unable to locate resource reference.
· system:aggregate-to-view...............................🔊
🔊 [POP-400] Used? Unable to locate resource reference.
· system:auth-delegator..................................🔊
🔊 [POP-400] Used? Unable to locate resource reference.
· system:basic-user.......................................✅

Sample Popeye RBAC Rules:

---
# Popeye ServiceAccount.
apiVersion: v1
kind: ServiceAccount
metadata:
name: popeye
namespace: popeye
---
# Popeye needs get/list access on the following Kubernetes resources.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: popeye
rules:
- apiGroups: [""]
resources:
- configmaps
- deployments
- endpoints
- horizontalpodautoscalers
- namespaces
- nodes
- persistentvolumes
- persistentvolumeclaims
- pods
- secrets
- serviceaccounts
- services
- statefulsets
verbs: ["get", "list"]
- apiGroups: ["rbac.authorization.k8s.io"]
resources:
- clusterroles
- clusterrolebindings
- roles
- rolebindings
verbs: ["get", "list"]
- apiGroups: ["metrics.k8s.io"]
resources:
- pods
- nodes
verbs: ["get", "list"]
---
# Binds Popeye to this ClusterRole.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: popeye
subjects:
- kind: ServiceAccount
name: popeye
namespace: popeye
roleRef:
kind: ClusterRole
name: popeye
apiGroup: rbac.authorization.k8s.io

References:

--

--

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store