Popeye — A Kubernetes Cluster Sanitizer

The Rising Pain for Enterprise Businesses

https://www.collabnix.com

Introducing Popeye

How is Popeye different from other existing tools?

Installation

$ brew install derailed/popeye/popeye
replace (
github.com/derailed/popeye => MY_POPEYE_CLONED_GIT_REPO
)
go run main.go
git clone https://github.com/derailed/popeye
cd popeye
# Build and install
go install
# Run
popeye

Checking the version:

$ popeye version
___ ___ _____ _____ K .-'-.
| _ \___| _ \ __\ \ / / __| 8 __| `\
| _/ _ \ _/ _| \ V /| _| s `-,-`--._ `\
|_| \___/_| |___| |_| |___| [] .->' a `|-'
Biffs`em and Buffs`em! `=/ (__/_ /
\_, ` _)
`----; |
Version: 0.9.7
Commit: 4f12a172495e2acb7a621b29cffa924f1cd72580
Date: 2021-07-20T14:57:08Z
Logs: /var/folders/7k/2jz4csrs4ss65_x0slwbl1540000gn/T/popeye.log

Popeye a cluster

$ popeyeGENERAL [DOCKER-DESKTOP]
┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅
· Connectivity...................................................✅
· MetricServer...................................................💥
CLUSTER (1 SCANNED) 💥 0 😱 0 🔊 0 ✅ 1 100٪
┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅
· Version.........................................................✅
✅ [POP-406] K8s version OK.
CLUSTERROLES (60 SCANNE. 💥 0 😱 0 🔊 15 ✅ 45 100٪
┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅
· admin...........................................................🔊
🔊 [POP-400] Used? Unable to locate resource reference.
· cluster-admin............................................... ....✅
· edit.............................................................🔊
🔊 [POP-400] Used? Unable to locate resource reference.
· kubeadm:getnodes.................................................✅
· system:aggregate-to-admin.......................................................🔊
🔊 [POP-400] Used? Unable to locate resource reference.
· system:aggregate-to-edit........................................................🔊
🔊 [POP-400] Used? Unable to locate resource reference.
· system:aggregate-to-view...............................🔊
🔊 [POP-400] Used? Unable to locate resource reference.
· system:auth-delegator..................................🔊
🔊 [POP-400] Used? Unable to locate resource reference.
· system:basic-user.......................................✅

Sample Popeye RBAC Rules:

---
# Popeye ServiceAccount.
apiVersion: v1
kind: ServiceAccount
metadata:
name: popeye
namespace: popeye
---
# Popeye needs get/list access on the following Kubernetes resources.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: popeye
rules:
- apiGroups: [""]
resources:
- configmaps
- deployments
- endpoints
- horizontalpodautoscalers
- namespaces
- nodes
- persistentvolumes
- persistentvolumeclaims
- pods
- secrets
- serviceaccounts
- services
- statefulsets
verbs: ["get", "list"]
- apiGroups: ["rbac.authorization.k8s.io"]
resources:
- clusterroles
- clusterrolebindings
- roles
- rolebindings
verbs: ["get", "list"]
- apiGroups: ["metrics.k8s.io"]
resources:
- pods
- nodes
verbs: ["get", "list"]
---
# Binds Popeye to this ClusterRole.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: popeye
subjects:
- kind: ServiceAccount
name: popeye
namespace: popeye
roleRef:
kind: ClusterRole
name: popeye
apiGroup: rbac.authorization.k8s.io

References:

--

--

--

Docker Captain, Docker Community Leader, Tip of the Captain’s Hat Award Winner, Docker Meetup India Regional Lead, Founder of DockerLabs

Love podcasts or audiobooks? Learn on the go with our new app.

Recommended from Medium

IDM: Zero Downtime upgrade strategy using a blue/green deployment

HackTheBox — Haystack

We wrote our own logger — here’s why

Logs

Kubeflow Pipelines up and running in 5 minutes

Rocker — rocksdb driver for Erlang

“OVER” clause in SQL Server

Make a grid-based game with Unity: dev-log day 1.

You Can’t Prompt a File Download With the Content Disposition Header Using Axios (XHR). Sorry.

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
Ajeet Singh Raina

Ajeet Singh Raina

Docker Captain, Docker Community Leader, Tip of the Captain’s Hat Award Winner, Docker Meetup India Regional Lead, Founder of DockerLabs

More from Medium

How to Model Your Gitops Environments and Promote Releases between Them

Will That Kubernetes v1.22 Upgrade Break My Application?

Kubernetes Choosing Right Node Size

Creating your own Template in Monokle