Published: Sep 14, 2023 by Isaac Johnson

I had a list of solid Open-Source Kubernetes CLI tools I wanted to checkout filling my backlog. I decided it would be a good blog post to fire through the lot of them to see how they did looking at various Kubernetes clusters and resources.

I’ll do a walkthrough on KDash, KTop and K1s which is also the order I would give them on features and size. I’ll also setup and run Popeye which can dig into Cluster health, security and waste details (it bills itself as a “A Kubernetes Cluster Sanitizer”).

KDash

I noted KDash a while back as a tool I really wanted to try out. How might it compare to k9s which I already use on the regular.

Installation

We just need to add the Kdash tap and brew install on WSL/Linux

builder@LuiGi17:~/Workspaces/jekyll-blog$ brew tap kdash-rs/kdash
Running `brew update --auto-update`...
==> Tapping kdash-rs/kdash
Cloning into '/home/linuxbrew/.linuxbrew/Homebrew/Library/Taps/kdash-rs/homebrew-kdash'...
remote: Enumerating objects: 165, done.
remote: Counting objects: 100% (165/165), done.
remote: Compressing objects: 100% (85/85), done.
remote: Total 165 (delta 42), reused 162 (delta 39), pack-reused 0
Receiving objects: 100% (165/165), 19.57 KiB | 3.91 MiB/s, done.
Resolving deltas: 100% (42/42), done.
Tapped 1 formula (14 files, 100.2KB).
builder@LuiGi17:~/Workspaces/jekyll-blog$ brew install kdash
==> Fetching kdash-rs/kdash/kdash
==> Downloading https://github.com/kdash-rs/kdash/releases/download/v0.4.2/kdash-linux-musl.tar.gz
==> Downloading from https://objects.githubusercontent.com/github-production-release-asset-2e65be/357436262/e96fb562-4155-4f4d-91ed-1a8e6351bda9?X-Amz-Algorithm=AWS4-HM
################################################################################################################################################################# 100.0%
==> Installing kdash from kdash-rs/kdash
==> You're done!  Run with "kdash"
==> For runtime flags, see "kdash --help"
🍺  /home/linuxbrew/.linuxbrew/Cellar/kdash/v0.4.2: 3 files, 9.9MB, built in 1 second
==> Running `brew cleanup kdash`...
Disable this behaviour by setting HOMEBREW_NO_INSTALL_CLEANUP.
Hide these hints with HOMEBREW_NO_ENV_HINTS (see `man brew`).

I’m external to my network presently so I can hit it on the current IP provided I skip TLS checks

builder@LuiGi17:~/Workspaces/jekyll-blog$ kubectl get nodes --insecure-skip-tls-verify
NAME                          STATUS   ROLES                  AGE    VERSION
isaac-macbookair              Ready    control-plane,master   413d   v1.23.9+k3s1
builder-hp-elitebook-850-g1   Ready    <none>                 413d   v1.23.9+k3s1
hp-hp-elitebook-850-g2        Ready    <none>                 413d   v1.23.9+k3s1
builder-hp-elitebook-850-g2   Ready    <none>                 405d   v1.23.9+k3s1

Usage

Luckily that didn’t seem to annoy Kdash in the slightest

One of the nice views is Resource Utilization which gives you a lot of breakdowns. At its most, we can see specs by pods in namespaces on nodes

We can see that in action

One of the features I really like is it’s quick to navigate between objects, then one can select an object

and use “d” for describe to get at the details

For secrets we can go between describe (d) and decode (x)

I was able to pull up custom resources as well. This took time, though I was in an indoor natatorium with limited cell signal on a hotspot, so it might not be k-dash’s fault.

That said, it’s worth noting how it appeared initially there were no resources but after 30s they suddenly appeared:

There are just two themes, a light and dark. Here is the light theme

I kept feeling I’ve seen a similar tool but was stuck until I recalled BTop++ which I covered back in June

I think BTop++ spoiled me on all the settings and themes

KTop

This led me to find another tool, ktop

Installation

This too can be installed with homebrew

builder@LuiGi17:~/Workspaces/jekyll-blog$ brew tap vladimirvivien/oss-tools
==> Tapping vladimirvivien/oss-tools
Cloning into '/home/linuxbrew/.linuxbrew/Homebrew/Library/Taps/vladimirvivien/homebrew-oss-tools'...
remote: Enumerating objects: 10, done.
remote: Counting objects: 100% (10/10), done.
remote: Compressing objects: 100% (10/10), done.
remote: Total 10 (delta 3), reused 0 (delta 0), pack-reused 0
Receiving objects: 100% (10/10), done.
Resolving deltas: 100% (3/3), done.
Tapped 1 formula (14 files, 67.9KB).
builder@LuiGi17:~/Workspaces/jekyll-blog$ brew install ktop
Running `brew update --auto-update`...
==> Fetching vladimirvivien/oss-tools/ktop
==> Downloading https://github.com/vladimirvivien/ktop/releases/download/v0.3.5/ktop_v0.3.5_linux_amd64.tar.gz
==> Downloading from https://objects.githubusercontent.com/github-production-release-asset-2e65be/77647025/e89a6897-2fb1-47f1-a64d-20591068a513?X-Amz-Algorithm=AWS4-HMA
################################################################################################################################################################# 100.0%
==> Installing ktop from vladimirvivien/oss-tools
🍺  /home/linuxbrew/.linuxbrew/Cellar/ktop/0.3.5: 4 files, 36.9MB, built in 1 second
==> Running `brew cleanup ktop`...
Disable this behaviour by setting HOMEBREW_NO_INSTALL_CLEANUP.
Hide these hints with HOMEBREW_NO_ENV_HINTS (see `man brew`).

Launching KTop has a similar interface

I won’t spend much time. Much of this hasn’t been updated in a year. I found you could basically run in all namespaces or just a given one by passing that in as a parameter

builder@LuiGi17:~/Workspaces/jekyll-blog$ ktop
Connected to: https://75.73.224.240:123

 _    _
| | _| |_ ___  _ __
| |/ / __/ _ \| '_ \
|   <| || (_) | |_) |
|_|\_\\__\___/| .__/
              |_|
Version v0.3.5
ktop finished
builder@LuiGi17:~/Workspaces/jekyll-blog$ ktop --namespace default
Connected to: https://75.73.224.240:123

 _    _
| | _| |_ ___  _ __
| |/ / __/ _ \| '_ \
|   <| || (_) | |_) |
|_|\_\\__\___/| .__/
              |_|
Version v0.3.5

A bit of basic usage ; just arrow keys, tab and g, j and l do anything

Popeye

I found Popeye from a dev.to article a while ago.

Installation

Like the others, we can brew install this one as well

builder@LuiGi17:~/Workspaces/jekyll-blog$ brew install derailed/popeye/popeye
Running `brew update --auto-update`...
==> Tapping derailed/popeye
Cloning into '/home/linuxbrew/.linuxbrew/Homebrew/Library/Taps/derailed/homebrew-popeye'...
remote: Enumerating objects: 249, done.
remote: Counting objects: 100% (120/120), done.
remote: Compressing objects: 100% (60/60), done.
remote: Total 249 (delta 28), reused 0 (delta 0), pack-reused 129
Receiving objects: 100% (249/249), 27.30 KiB | 443.00 KiB/s, done.
Resolving deltas: 100% (60/60), done.
Tapped 1 formula (12 files, 101.8KB).
==> Fetching derailed/popeye/popeye
==> Downloading https://github.com/derailed/popeye/releases/download/v0.11.1/popeye_Linux_x86_64.tar.gz
==> Downloading from https://objects.githubusercontent.com/github-production-release-asset-2e65be/176379662/c11b09e6-b180-49de-9d49-15a97753d5f5?X-Amz-Algorithm=AWS4-HM
################################################################################################################################################################# 100.0%
==> Installing popeye from derailed/popeye
🍺  /home/linuxbrew/.linuxbrew/Cellar/popeye/0.11.1: 5 files, 42.9MB, built in 1 second
==> Running `brew cleanup popeye`...
Disable this behaviour by setting HOMEBREW_NO_INSTALL_CLEANUP.
Hide these hints with HOMEBREW_NO_ENV_HINTS (see `man brew`).

sadly, my primary cluster seems to have a v1beta external metrics api not routable (Oh, it is there, it just sends everything to a Datadog cluster agent instead).

Even moving locally, it showed the same.

That said, moving to my “test” cluster worked:

Now this page is huge. As much as I want to find some way to screencap the whole thing, I cannot imagine it would display well.

Here was the report:

builder@DESKTOP-QADGF36:~/Workspaces/jekyll-blog$ popeye

 ___     ___ _____   _____                                                      K          .-'-.
| _ \___| _ \ __\ \ / / __|                                                      8     __|      `\
|  _/ _ \  _/ _| \ V /| _|                                                        s   `-,-`--._   `\
|_| \___/_| |___| |_| |___|                                                      []  .->'  a     `|-'
  Biffs`em and Buffs`em!                                                          `=/ (__/_       /
                                                                                    \_,    `    _)
                                                                                       `----;  |


GENERAL [MAC81]
┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅
  · Connectivity...................................................................................✅
  · MetricServer...................................................................................✅


CLUSTER (1 SCANNED)                                                          💥 0 😱 0 🔊 0 ✅ 1 100٪
┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅
  · Version........................................................................................✅
    ✅ [POP-406] K8s version OK.


CLUSTERROLES (70 SCANNED)                                                  💥 0 😱 0 🔊 18 ✅ 52 100٪
┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅
  · admin..........................................................................................🔊
    🔊 [POP-400] Used? Unable to locate resource reference.
  · cluster-admin..................................................................................✅
  · clustercidrs-node..............................................................................✅
  · edit...........................................................................................🔊
    🔊 [POP-400] Used? Unable to locate resource reference.
  · k3s-cloud-controller-manager...................................................................✅
  · local-path-provisioner-role....................................................................✅
  · nfs-subdir-external-provisioner-runner.........................................................✅
  · system:aggregate-to-admin......................................................................🔊
    🔊 [POP-400] Used? Unable to locate resource reference.
  · system:aggregate-to-edit.......................................................................🔊
    🔊 [POP-400] Used? Unable to locate resource reference.
  · system:aggregate-to-view.......................................................................🔊
    🔊 [POP-400] Used? Unable to locate resource reference.
  · system:aggregated-metrics-reader...............................................................🔊
    🔊 [POP-400] Used? Unable to locate resource reference.
  · system:auth-delegator..........................................................................✅
  · system:basic-user..............................................................................✅
  · system:certificates.k8s.io:certificatesigningrequests:nodeclient...............................🔊
    🔊 [POP-400] Used? Unable to locate resource reference.
  · system:certificates.k8s.io:certificatesigningrequests:selfnodeclient...........................🔊
    🔊 [POP-400] Used? Unable to locate resource reference.
  · system:certificates.k8s.io:kube-apiserver-client-approver......................................🔊
    🔊 [POP-400] Used? Unable to locate resource reference.
  · system:certificates.k8s.io:kube-apiserver-client-kubelet-approver..............................🔊
    🔊 [POP-400] Used? Unable to locate resource reference.
  · system:certificates.k8s.io:kubelet-serving-approver............................................🔊
    🔊 [POP-400] Used? Unable to locate resource reference.
  · system:certificates.k8s.io:legacy-unknown-approver.............................................🔊
    🔊 [POP-400] Used? Unable to locate resource reference.
  · system:controller:attachdetach-controller......................................................✅
  · system:controller:certificate-controller.......................................................✅
  · system:controller:clusterrole-aggregation-controller...........................................✅
  · system:controller:cronjob-controller...........................................................✅
  · system:controller:daemon-set-controller........................................................✅
  · system:controller:deployment-controller........................................................✅
  · system:controller:disruption-controller........................................................✅
  · system:controller:endpoint-controller..........................................................✅
  · system:controller:endpointslice-controller.....................................................✅
  · system:controller:endpointslicemirroring-controller............................................✅
  · system:controller:ephemeral-volume-controller..................................................✅
  · system:controller:expand-controller............................................................✅
  · system:controller:generic-garbage-collector....................................................✅
  · system:controller:horizontal-pod-autoscaler....................................................✅
  · system:controller:job-controller...............................................................✅
  · system:controller:namespace-controller.........................................................✅
  · system:controller:node-controller..............................................................✅
  · system:controller:persistent-volume-binder.....................................................✅
  · system:controller:pod-garbage-collector........................................................✅
  · system:controller:pv-protection-controller.....................................................✅
  · system:controller:pvc-protection-controller....................................................✅
  · system:controller:replicaset-controller........................................................✅
  · system:controller:replication-controller.......................................................✅
  · system:controller:resourcequota-controller.....................................................✅
  · system:controller:root-ca-cert-publisher.......................................................✅
  · system:controller:route-controller.............................................................✅
  · system:controller:service-account-controller...................................................✅
  · system:controller:service-controller...........................................................✅
  · system:controller:statefulset-controller.......................................................✅
  · system:controller:ttl-after-finished-controller................................................✅
  · system:controller:ttl-controller...............................................................✅
  · system:coredns.................................................................................✅
  · system:discovery...............................................................................✅
  · system:heapster................................................................................🔊
    🔊 [POP-400] Used? Unable to locate resource reference.
  · system:k3s-controller..........................................................................✅
  · system:kube-aggregator.........................................................................🔊
    🔊 [POP-400] Used? Unable to locate resource reference.
  · system:kube-controller-manager.................................................................✅
  · system:kube-dns................................................................................✅
  · system:kube-scheduler..........................................................................✅
  · system:kubelet-api-admin.......................................................................✅
  · system:metrics-server..........................................................................✅
  · system:monitoring..............................................................................✅
  · system:node....................................................................................✅
  · system:node-bootstrapper.......................................................................🔊
    🔊 [POP-400] Used? Unable to locate resource reference.
  · system:node-problem-detector...................................................................🔊
    🔊 [POP-400] Used? Unable to locate resource reference.
  · system:node-proxier............................................................................✅
  · system:persistent-volume-provisioner...........................................................🔊
    🔊 [POP-400] Used? Unable to locate resource reference.
  · system:public-info-viewer......................................................................✅
  · system:service-account-issuer-discovery........................................................✅
  · system:volume-scheduler........................................................................✅
  · view...........................................................................................🔊
    🔊 [POP-400] Used? Unable to locate resource reference.


CLUSTERROLEBINDINGS (54 SCANNED)                                            💥 0 😱 0 🔊 0 ✅ 54 100٪
┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅
  · cluster-admin..................................................................................✅
  · clustercidrs-node..............................................................................✅
  · helm-default-nfs...............................................................................✅
  · k3s-cloud-controller-manager...................................................................✅
  · k3s-cloud-controller-manager-auth-delegator....................................................✅
  · kube-apiserver-kubelet-admin...................................................................✅
  · local-path-provisioner-bind....................................................................✅
  · metrics-server:system:auth-delegator...........................................................✅
  · run-nfs-subdir-external-provisioner............................................................✅
  · system:basic-user..............................................................................✅
  · system:controller:attachdetach-controller......................................................✅
  · system:controller:certificate-controller.......................................................✅
  · system:controller:clusterrole-aggregation-controller...........................................✅
  · system:controller:cronjob-controller...........................................................✅
  · system:controller:daemon-set-controller........................................................✅
  · system:controller:deployment-controller........................................................✅
  · system:controller:disruption-controller........................................................✅
  · system:controller:endpoint-controller..........................................................✅
  · system:controller:endpointslice-controller.....................................................✅
  · system:controller:endpointslicemirroring-controller............................................✅
  · system:controller:ephemeral-volume-controller..................................................✅
  · system:controller:expand-controller............................................................✅
  · system:controller:generic-garbage-collector....................................................✅
  · system:controller:horizontal-pod-autoscaler....................................................✅
  · system:controller:job-controller...............................................................✅
  · system:controller:namespace-controller.........................................................✅
  · system:controller:node-controller..............................................................✅
  · system:controller:persistent-volume-binder.....................................................✅
  · system:controller:pod-garbage-collector........................................................✅
  · system:controller:pv-protection-controller.....................................................✅
  · system:controller:pvc-protection-controller....................................................✅
  · system:controller:replicaset-controller........................................................✅
  · system:controller:replication-controller.......................................................✅
  · system:controller:resourcequota-controller.....................................................✅
  · system:controller:root-ca-cert-publisher.......................................................✅
  · system:controller:route-controller.............................................................✅
  · system:controller:service-account-controller...................................................✅
  · system:controller:service-controller...........................................................✅
  · system:controller:statefulset-controller.......................................................✅
  · system:controller:ttl-after-finished-controller................................................✅
  · system:controller:ttl-controller...............................................................✅
  · system:coredns.................................................................................✅
  · system:discovery...............................................................................✅
  · system:k3s-controller..........................................................................✅
  · system:kube-controller-manager.................................................................✅
  · system:kube-dns................................................................................✅
  · system:kube-scheduler..........................................................................✅
  · system:metrics-server..........................................................................✅
  · system:monitoring..............................................................................✅
  · system:node....................................................................................✅
  · system:node-proxier............................................................................✅
  · system:public-info-viewer......................................................................✅
  · system:service-account-issuer-discovery........................................................✅
  · system:volume-scheduler........................................................................✅


CONFIGMAPS (11 SCANNED)                                                      💥 0 😱 0 🔊 8 ✅ 3 100٪
┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅
  · default/chart-content-nfs......................................................................🔊
    🔊 [POP-400] Used? Unable to locate resource reference.
  · default/chart-values-nfs.......................................................................🔊
    🔊 [POP-400] Used? Unable to locate resource reference.
  · default/kube-root-ca.crt.......................................................................🔊
    🔊 [POP-400] Used? Unable to locate resource reference.
  · default/my-opentelemetry-collector.............................................................✅
  · kube-node-lease/kube-root-ca.crt...............................................................🔊
    🔊 [POP-400] Used? Unable to locate resource reference.
  · kube-public/kube-root-ca.crt...................................................................🔊
    🔊 [POP-400] Used? Unable to locate resource reference.
  · kube-system/cluster-dns........................................................................🔊
    🔊 [POP-400] Used? Unable to locate resource reference.
  · kube-system/coredns............................................................................✅
  · kube-system/extension-apiserver-authentication.................................................🔊
    🔊 [POP-400] Used? Unable to locate resource reference.
  · kube-system/kube-root-ca.crt...................................................................🔊
    🔊 [POP-400] Used? Unable to locate resource reference.
  · kube-system/local-path-config..................................................................✅


DAEMONSETS (1 SCANNED)                                                         💥 0 😱 1 🔊 0 ✅ 0 0٪
┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅
  · kube-system/svclb-azure-vote-front-81a34e62....................................................😱
    🐳 lb-tcp-80
      😱 [POP-106] No resources requests/limits defined.


DEPLOYMENTS (15 SCANNED)                                                     💥 2 😱 10 🔊 1 ✅ 2 20٪
┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅
  · default/act-runner.............................................................................😱
    🐳 daemon
      😱 [POP-106] No resources requests/limits defined.
    🐳 runner
      😱 [POP-106] No resources requests/limits defined.
  · default/fbnext-deployment......................................................................😱
    🐳 fbnext-container
      😱 [POP-106] No resources requests/limits defined.
      🔊 [POP-108] Unnamed port 3000.
  · default/fbnextgh-deployment....................................................................😱
    🐳 fbnext-container
      😱 [POP-106] No resources requests/limits defined.
      🔊 [POP-108] Unnamed port 3000.
  · default/gitea-memcached........................................................................😱
    🐳 memcached
      😱 [POP-107] No resource limits defined.
  · default/homarr-deployment......................................................................😱
    🐳 homarr-container
      😱 [POP-101] Image tagged "latest" in use.
      😱 [POP-106] No resources requests/limits defined.
      🔊 [POP-108] Unnamed port 7575.
  · default/my-opentelemetry-collector.............................................................😱
    🐳 opentelemetry-collector
      😱 [POP-106] No resources requests/limits defined.
  · default/nfs-subdir-external-provisioner........................................................😱
    🐳 nfs-subdir-external-provisioner
      😱 [POP-106] No resources requests/limits defined.
  · default/nginx..................................................................................💥
    🐳 nginx
      💥 [POP-100] Untagged docker image in use.
      😱 [POP-106] No resources requests/limits defined.
      🔊 [POP-108] Unnamed port 80.
  · default/ngrok..................................................................................😱
    🐳 ngrok
      😱 [POP-106] No resources requests/limits defined.
      🔊 [POP-108] Unnamed port 4040.
  · default/vote-back-azure-vote-1688994153........................................................💥
    🐳 vote-back-azure-vote-1688994153
      💥 [POP-100] Untagged docker image in use.
      😱 [POP-106] No resources requests/limits defined.
  · default/vote-front-azure-vote-1688994153.......................................................🔊
    🐳 azure-vote-front
      🔊 [POP-108] Unnamed port 80.
  · default/zipkin.................................................................................✅
  · kube-system/coredns............................................................................✅
  · kube-system/local-path-provisioner.............................................................😱
    🐳 local-path-provisioner
      😱 [POP-106] No resources requests/limits defined.
  · kube-system/metrics-server.....................................................................😱
    🐳 metrics-server
      😱 [POP-107] No resource limits defined.


HORIZONTALPODAUTOSCALERS (0 SCANNED)                                         💥 0 😱 0 🔊 0 ✅ 0 100٪
┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅
  · Nothing to report.


INGRESSES (0 SCANNED)                                                        💥 0 😱 0 🔊 0 ✅ 0 100٪
┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅
  · Nothing to report.


NAMESPACES (4 SCANNED)                                                       💥 0 😱 0 🔊 2 ✅ 2 100٪
┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅
  · default........................................................................................✅
  · kube-node-lease................................................................................🔊
    🔊 [POP-400] Used? Unable to locate resource reference.
  · kube-public....................................................................................🔊
    🔊 [POP-400] Used? Unable to locate resource reference.
  · kube-system....................................................................................✅


NETWORKPOLICIES (0 SCANNED)                                                  💥 0 😱 0 🔊 0 ✅ 0 100٪
┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅
  · Nothing to report.


NODES (3 SCANNED)                                                            💥 0 😱 0 🔊 1 ✅ 2 100٪
┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅
  · anna-macbookair................................................................................🔊
    🔊 [POP-712] Found only one master node.
  · builder-macbookpro2............................................................................✅
  · isaac-macbookpro...............................................................................✅


PERSISTENTVOLUMES (6 SCANNED)                                                💥 0 😱 0 🔊 0 ✅ 6 100٪
┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅
  · pvc-1c317391-7d2c-405d-a505-d8fe42c44f03.......................................................✅
  · pvc-4fd445e3-0fc3-42a5-a604-d3f9855d8736.......................................................✅
  · pvc-63a24130-ae57-41d6-a158-3f96fa2df2d0.......................................................✅
  · pvc-a5b7daa8-03e2-40b5-b626-79f8b4b0652c.......................................................✅
  · pvc-b15a377c-8d9f-427f-9e52-d9b6cf457dc0.......................................................✅
  · pvc-bffada16-6a38-4968-be79-604ede967b13.......................................................✅


PERSISTENTVOLUMECLAIMS (6 SCANNED)                                           💥 0 😱 0 🔊 1 ✅ 5 100٪
┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅
  · default/act-runner-vol.........................................................................✅
  · default/configs-pvc............................................................................✅
  · default/data-gitea-0...........................................................................✅
  · default/data-gitea-postgresql-0................................................................✅
  · default/icons-pvc..............................................................................✅
  · default/nfsclaim...............................................................................🔊
    🔊 [POP-400] Used? Unable to locate resource reference.


PODS (27 SCANNED)                                                             💥 2 😱 25 🔊 0 ✅ 0 0٪
┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅
  · default/act-runner-84f56cb5c4-jj4dd............................................................😱
    🔊 [POP-206] No PodDisruptionBudget defined.
    😱 [POP-300] Using "default" ServiceAccount.
    😱 [POP-301] Connects to API Server? ServiceAccount token is mounted.
    😱 [POP-302] Pod could be running as root user. Check SecurityContext/Image.
    🐳 daemon
      😱 [POP-106] No resources requests/limits defined.
      😱 [POP-102] No probes defined.
      😱 [POP-306] Container could be running as root user. Check SecurityContext/Image.
    🐳 runner
      😱 [POP-106] No resources requests/limits defined.
      😱 [POP-102] No probes defined.
      😱 [POP-306] Container could be running as root user. Check SecurityContext/Image.
  · default/act-runner-84f56cb5c4-mqpd2............................................................😱
    🔊 [POP-206] No PodDisruptionBudget defined.
    😱 [POP-300] Using "default" ServiceAccount.
    😱 [POP-301] Connects to API Server? ServiceAccount token is mounted.
    😱 [POP-302] Pod could be running as root user. Check SecurityContext/Image.
    🐳 daemon
      😱 [POP-106] No resources requests/limits defined.
      😱 [POP-102] No probes defined.
      😱 [POP-306] Container could be running as root user. Check SecurityContext/Image.
    🐳 runner
      😱 [POP-106] No resources requests/limits defined.
      😱 [POP-102] No probes defined.
      😱 [POP-306] Container could be running as root user. Check SecurityContext/Image.
  · default/fbnext-deployment-84df6c94c6-hqch6.....................................................😱
    🔊 [POP-206] No PodDisruptionBudget defined.
    😱 [POP-300] Using "default" ServiceAccount.
    😱 [POP-301] Connects to API Server? ServiceAccount token is mounted.
    😱 [POP-302] Pod could be running as root user. Check SecurityContext/Image.
    🐳 fbnext-container
      😱 [POP-106] No resources requests/limits defined.
      😱 [POP-102] No probes defined.
      🔊 [POP-108] Unnamed port 3000.
      😱 [POP-306] Container could be running as root user. Check SecurityContext/Image.
  · default/fbnext-deployment-84df6c94c6-ntfqp.....................................................😱
    🔊 [POP-206] No PodDisruptionBudget defined.
    😱 [POP-300] Using "default" ServiceAccount.
    😱 [POP-301] Connects to API Server? ServiceAccount token is mounted.
    😱 [POP-302] Pod could be running as root user. Check SecurityContext/Image.
    🐳 fbnext-container
      😱 [POP-106] No resources requests/limits defined.
      😱 [POP-102] No probes defined.
      🔊 [POP-108] Unnamed port 3000.
      😱 [POP-306] Container could be running as root user. Check SecurityContext/Image.
  · default/fbnext-deployment-84df6c94c6-szlz4.....................................................😱
    🔊 [POP-206] No PodDisruptionBudget defined.
    😱 [POP-300] Using "default" ServiceAccount.
    😱 [POP-301] Connects to API Server? ServiceAccount token is mounted.
    😱 [POP-302] Pod could be running as root user. Check SecurityContext/Image.
    🐳 fbnext-container
      😱 [POP-106] No resources requests/limits defined.
      😱 [POP-102] No probes defined.
      🔊 [POP-108] Unnamed port 3000.
      😱 [POP-306] Container could be running as root user. Check SecurityContext/Image.
  · default/fbnextgh-deployment-5d7564f6c9-8h9hz...................................................😱
    🔊 [POP-206] No PodDisruptionBudget defined.
    😱 [POP-300] Using "default" ServiceAccount.
    😱 [POP-301] Connects to API Server? ServiceAccount token is mounted.
    😱 [POP-302] Pod could be running as root user. Check SecurityContext/Image.
    🐳 fbnext-container
      😱 [POP-106] No resources requests/limits defined.
      😱 [POP-102] No probes defined.
      🔊 [POP-108] Unnamed port 3000.
      😱 [POP-306] Container could be running as root user. Check SecurityContext/Image.
  · default/fbnextgh-deployment-5d7564f6c9-bljht...................................................😱
    🔊 [POP-206] No PodDisruptionBudget defined.
    😱 [POP-300] Using "default" ServiceAccount.
    😱 [POP-301] Connects to API Server? ServiceAccount token is mounted.
    😱 [POP-302] Pod could be running as root user. Check SecurityContext/Image.
    🐳 fbnext-container
      😱 [POP-106] No resources requests/limits defined.
      😱 [POP-102] No probes defined.
      🔊 [POP-108] Unnamed port 3000.
      😱 [POP-306] Container could be running as root user. Check SecurityContext/Image.
  · default/fbnextgh-deployment-5d7564f6c9-jnq7p...................................................😱
    🔊 [POP-206] No PodDisruptionBudget defined.
    😱 [POP-300] Using "default" ServiceAccount.
    😱 [POP-301] Connects to API Server? ServiceAccount token is mounted.
    😱 [POP-302] Pod could be running as root user. Check SecurityContext/Image.
    🐳 fbnext-container
      😱 [POP-106] No resources requests/limits defined.
      😱 [POP-102] No probes defined.
      🔊 [POP-108] Unnamed port 3000.
      😱 [POP-306] Container could be running as root user. Check SecurityContext/Image.
  · default/gitea-0................................................................................😱
    🔊 [POP-206] No PodDisruptionBudget defined.
    😱 [POP-300] Using "default" ServiceAccount.
    😱 [POP-301] Connects to API Server? ServiceAccount token is mounted.
    😱 [POP-302] Pod could be running as root user. Check SecurityContext/Image.
    🐳 configure-gitea
      😱 [POP-205] Pod was restarted (139) times.
      😱 [POP-107] No resource limits defined.
    🐳 gitea
      😱 [POP-106] No resources requests/limits defined.
      😱 [POP-306] Container could be running as root user. Check SecurityContext/Image.
    🐳 init-app-ini
      😱 [POP-107] No resource limits defined.
      😱 [POP-306] Container could be running as root user. Check SecurityContext/Image.
    🐳 init-directories
      😱 [POP-107] No resource limits defined.
      😱 [POP-306] Container could be running as root user. Check SecurityContext/Image.
  · default/gitea-memcached-8666cf9db5-54cgm.......................................................😱
    🔊 [POP-206] No PodDisruptionBudget defined.
    😱 [POP-300] Using "default" ServiceAccount.
    😱 [POP-301] Connects to API Server? ServiceAccount token is mounted.
    🐳 memcached
      😱 [POP-107] No resource limits defined.
  · default/gitea-postgresql-0.....................................................................😱
    🔊 [POP-206] No PodDisruptionBudget defined.
    😱 [POP-300] Using "default" ServiceAccount.
    😱 [POP-301] Connects to API Server? ServiceAccount token is mounted.
    🐳 postgresql
      😱 [POP-107] No resource limits defined.
  · default/homarr-deployment-5b6cf788d9-dwb6x.....................................................😱
    🔊 [POP-206] No PodDisruptionBudget defined.
    😱 [POP-300] Using "default" ServiceAccount.
    😱 [POP-301] Connects to API Server? ServiceAccount token is mounted.
    😱 [POP-302] Pod could be running as root user. Check SecurityContext/Image.
    🐳 homarr-container
      😱 [POP-101] Image tagged "latest" in use.
      😱 [POP-106] No resources requests/limits defined.
      😱 [POP-102] No probes defined.
      🔊 [POP-108] Unnamed port 7575.
      😱 [POP-306] Container could be running as root user. Check SecurityContext/Image.
  · default/my-opentelemetry-collector-76dbb7d64b-wbhqg............................................😱
    🔊 [POP-206] No PodDisruptionBudget defined.
    😱 [POP-301] Connects to API Server? ServiceAccount token is mounted.
    😱 [POP-302] Pod could be running as root user. Check SecurityContext/Image.
    🐳 opentelemetry-collector
      😱 [POP-106] No resources requests/limits defined.
      🔊 [POP-105] Liveness probe uses a port#, prefer a named port.
      🔊 [POP-105] Readiness probe uses a port#, prefer a named port.
      😱 [POP-306] Container could be running as root user. Check SecurityContext/Image.
  · default/nfs-subdir-external-provisioner-5f88bc9b6c-gzvsd.......................................😱
    🔊 [POP-206] No PodDisruptionBudget defined.
    😱 [POP-301] Connects to API Server? ServiceAccount token is mounted.
    😱 [POP-302] Pod could be running as root user. Check SecurityContext/Image.
    🐳 nfs-subdir-external-provisioner
      😱 [POP-205] Pod was restarted (408) times.
      😱 [POP-106] No resources requests/limits defined.
      😱 [POP-102] No probes defined.
      😱 [POP-306] Container could be running as root user. Check SecurityContext/Image.
  · default/nginx-78cc4c645b-lxpbc.................................................................💥
    🔊 [POP-206] No PodDisruptionBudget defined.
    😱 [POP-300] Using "default" ServiceAccount.
    😱 [POP-301] Connects to API Server? ServiceAccount token is mounted.
    😱 [POP-302] Pod could be running as root user. Check SecurityContext/Image.
    🐳 nginx
      💥 [POP-100] Untagged docker image in use.
      😱 [POP-106] No resources requests/limits defined.
      😱 [POP-102] No probes defined.
      🔊 [POP-108] Unnamed port 80.
      😱 [POP-306] Container could be running as root user. Check SecurityContext/Image.
  · default/ngrok-669dd5fdd8-lxdkg.................................................................😱
    🔊 [POP-206] No PodDisruptionBudget defined.
    😱 [POP-300] Using "default" ServiceAccount.
    😱 [POP-301] Connects to API Server? ServiceAccount token is mounted.
    😱 [POP-302] Pod could be running as root user. Check SecurityContext/Image.
    🐳 ngrok
      😱 [POP-106] No resources requests/limits defined.
      😱 [POP-102] No probes defined.
      🔊 [POP-108] Unnamed port 4040.
      😱 [POP-306] Container could be running as root user. Check SecurityContext/Image.
  · default/rubysample.............................................................................😱
    😱 [POP-208] Unmanaged pod detected. Best to use a controller.
    🔊 [POP-206] No PodDisruptionBudget defined.
    😱 [POP-300] Using "default" ServiceAccount.
    😱 [POP-301] Connects to API Server? ServiceAccount token is mounted.
    😱 [POP-302] Pod could be running as root user. Check SecurityContext/Image.
    🐳 rubysample
      😱 [POP-106] No resources requests/limits defined.
      😱 [POP-102] No probes defined.
      😱 [POP-306] Container could be running as root user. Check SecurityContext/Image.
  · default/rubysampleotel.........................................................................😱
    😱 [POP-208] Unmanaged pod detected. Best to use a controller.
    🔊 [POP-206] No PodDisruptionBudget defined.
    😱 [POP-300] Using "default" ServiceAccount.
    😱 [POP-301] Connects to API Server? ServiceAccount token is mounted.
    😱 [POP-302] Pod could be running as root user. Check SecurityContext/Image.
    🐳 rubysampleotel
      😱 [POP-106] No resources requests/limits defined.
      😱 [POP-102] No probes defined.
      😱 [POP-306] Container could be running as root user. Check SecurityContext/Image.
  · default/vote-back-azure-vote-1688994153-7b76fb69b9-xxzgc.......................................💥
    🔊 [POP-206] No PodDisruptionBudget defined.
    😱 [POP-300] Using "default" ServiceAccount.
    😱 [POP-301] Connects to API Server? ServiceAccount token is mounted.
    😱 [POP-302] Pod could be running as root user. Check SecurityContext/Image.
    🐳 vote-back-azure-vote-1688994153
      💥 [POP-100] Untagged docker image in use.
      😱 [POP-106] No resources requests/limits defined.
      😱 [POP-102] No probes defined.
      😱 [POP-306] Container could be running as root user. Check SecurityContext/Image.
  · default/vote-front-azure-vote-1688994153-6fdc76bdd9-vk92z......................................😱
    🔊 [POP-206] No PodDisruptionBudget defined.
    😱 [POP-300] Using "default" ServiceAccount.
    😱 [POP-301] Connects to API Server? ServiceAccount token is mounted.
    😱 [POP-302] Pod could be running as root user. Check SecurityContext/Image.
    🐳 azure-vote-front
      😱 [POP-102] No probes defined.
      🔊 [POP-108] Unnamed port 80.
      😱 [POP-306] Container could be running as root user. Check SecurityContext/Image.
  · default/zipkin-6db857b95b-tmcjh................................................................😱
      😱 [POP-110] Memory Current/Request (148Mi/128Mi) reached user 80% threshold (115%).
    🔊 [POP-206] No PodDisruptionBudget defined.
    🐳 zipkin
      😱 [POP-103] No liveness probe.
      🔊 [POP-105] Readiness probe uses a port#, prefer a named port.
  · kube-system/coredns-59b4f5bbd5-h25sv...........................................................😱
    🔊 [POP-206] No PodDisruptionBudget defined.
    😱 [POP-301] Connects to API Server? ServiceAccount token is mounted.
    😱 [POP-302] Pod could be running as root user. Check SecurityContext/Image.
    🐳 coredns
      🔊 [POP-105] Liveness probe uses a port#, prefer a named port.
      🔊 [POP-105] Readiness probe uses a port#, prefer a named port.
      😱 [POP-306] Container could be running as root user. Check SecurityContext/Image.
  · kube-system/local-path-provisioner-76d776f6f9-hzk6l............................................😱
    🔊 [POP-206] No PodDisruptionBudget defined.
    😱 [POP-301] Connects to API Server? ServiceAccount token is mounted.
    😱 [POP-302] Pod could be running as root user. Check SecurityContext/Image.
    🐳 local-path-provisioner
      😱 [POP-106] No resources requests/limits defined.
      😱 [POP-102] No probes defined.
      😱 [POP-306] Container could be running as root user. Check SecurityContext/Image.
  · kube-system/metrics-server-7b67f64457-n2x64....................................................😱
    🔊 [POP-206] No PodDisruptionBudget defined.
    😱 [POP-301] Connects to API Server? ServiceAccount token is mounted.
    🐳 metrics-server
      😱 [POP-107] No resource limits defined.
  · kube-system/svclb-azure-vote-front-81a34e62-6zl8w..............................................😱
    😱 [POP-302] Pod could be running as root user. Check SecurityContext/Image.
    🐳 lb-tcp-80
      😱 [POP-106] No resources requests/limits defined.
      😱 [POP-102] No probes defined.
      😱 [POP-306] Container could be running as root user. Check SecurityContext/Image.
  · kube-system/svclb-azure-vote-front-81a34e62-kn2kg..............................................😱
    😱 [POP-302] Pod could be running as root user. Check SecurityContext/Image.
    🐳 lb-tcp-80
      😱 [POP-106] No resources requests/limits defined.
      😱 [POP-102] No probes defined.
      😱 [POP-306] Container could be running as root user. Check SecurityContext/Image.
  · kube-system/svclb-azure-vote-front-81a34e62-t6svq..............................................😱
    😱 [POP-302] Pod could be running as root user. Check SecurityContext/Image.
    🐳 lb-tcp-80
      😱 [POP-106] No resources requests/limits defined.
      😱 [POP-102] No probes defined.
      😱 [POP-306] Container could be running as root user. Check SecurityContext/Image.


PODDISRUPTIONBUDGETS (0 SCANNED)                                             💥 0 😱 0 🔊 0 ✅ 0 100٪
┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅
  · Nothing to report.


REPLICASETS (23 SCANNED)                                                    💥 0 😱 0 🔊 0 ✅ 23 100٪
┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅
  · default/act-runner-5c67c8d5f5..................................................................✅
  · default/act-runner-84f56cb5c4..................................................................✅
  · default/fbnext-deployment-84df6c94c6...........................................................✅
  · default/fbnext-deployment-c6dcf67db............................................................✅
  · default/fbnextgh-deployment-5d7564f6c9.........................................................✅
  · default/gitea-memcached-8666cf9db5.............................................................✅
  · default/homarr-deployment-5b6cf788d9...........................................................✅
  · default/my-opentelemetry-collector-76dbb7d64b..................................................✅
  · default/nfs-subdir-external-provisioner-5f88bc9b6c.............................................✅
  · default/nfs-subdir-external-provisioner-65669ddf59.............................................✅
  · default/nginx-78cc4c645b.......................................................................✅
  · default/ngrok-5879d66d9c.......................................................................✅
  · default/ngrok-5df4cdcf59.......................................................................✅
  · default/ngrok-669dd5fdd8.......................................................................✅
  · default/ngrok-79f54b8567.......................................................................✅
  · default/ngrok-8595966d8d.......................................................................✅
  · default/ngrok-9cff47d5b........................................................................✅
  · default/vote-back-azure-vote-1688994153-7b76fb69b9.............................................✅
  · default/vote-front-azure-vote-1688994153-6fdc76bdd9............................................✅
  · default/zipkin-6db857b95b......................................................................✅
  · kube-system/coredns-59b4f5bbd5.................................................................✅
  · kube-system/local-path-provisioner-76d776f6f9..................................................✅
  · kube-system/metrics-server-7b67f64457..........................................................✅


ROLES (8 SCANNED)                                                            💥 0 😱 0 🔊 0 ✅ 8 100٪
┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅
  · default/leader-locking-nfs-subdir-external-provisioner.........................................✅
  · kube-public/system:controller:bootstrap-signer.................................................✅
  · kube-system/extension-apiserver-authentication-reader..........................................✅
  · kube-system/system::leader-locking-kube-controller-manager.....................................✅
  · kube-system/system::leader-locking-kube-scheduler..............................................✅
  · kube-system/system:controller:bootstrap-signer.................................................✅
  · kube-system/system:controller:cloud-provider...................................................✅
  · kube-system/system:controller:token-cleaner....................................................✅


ROLEBINDINGS (10 SCANNED)                                                   💥 0 😱 0 🔊 0 ✅ 10 100٪
┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅
  · default/leader-locking-nfs-subdir-external-provisioner.........................................✅
  · kube-public/system:controller:bootstrap-signer.................................................✅
  · kube-system/k3s-cloud-controller-manager-authentication-reader.................................✅
  · kube-system/metrics-server-auth-reader.........................................................✅
  · kube-system/system::extension-apiserver-authentication-reader..................................✅
  · kube-system/system::leader-locking-kube-controller-manager.....................................✅
  · kube-system/system::leader-locking-kube-scheduler..............................................✅
  · kube-system/system:controller:bootstrap-signer.................................................✅
  · kube-system/system:controller:cloud-provider...................................................✅
  · kube-system/system:controller:token-cleaner....................................................✅


SECRETS (18 SCANNED)                                                        💥 0 😱 0 🔊 12 ✅ 6 100٪
┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅
  · default/gitea..................................................................................✅
  · default/gitea-init.............................................................................✅
  · default/gitea-inline-config....................................................................✅
  · default/gitea-postgresql.......................................................................✅
  · default/myharborreg............................................................................✅
  · default/runner-secret..........................................................................✅
  · default/sh.helm.release.v1.azure-vote-1688994153.v1............................................🔊
    🔊 [POP-400] Used? Unable to locate resource reference.
  · default/sh.helm.release.v1.gitea.v1............................................................🔊
    🔊 [POP-400] Used? Unable to locate resource reference.
  · default/sh.helm.release.v1.gitea.v2............................................................🔊
    🔊 [POP-400] Used? Unable to locate resource reference.
  · default/sh.helm.release.v1.my-opentelemetry-collector.v1.......................................🔊
    🔊 [POP-400] Used? Unable to locate resource reference.
  · default/sh.helm.release.v1.nfs-subdir-external-provisioner.v1..................................🔊
    🔊 [POP-400] Used? Unable to locate resource reference.
  · default/sh.helm.release.v1.nfs-subdir-external-provisioner.v2..................................🔊
    🔊 [POP-400] Used? Unable to locate resource reference.
  · default/sh.helm.release.v1.nfs-subdir-external-provisioner.v3..................................🔊
    🔊 [POP-400] Used? Unable to locate resource reference.
  · default/sh.helm.release.v1.zipkin.v1...........................................................🔊
    🔊 [POP-400] Used? Unable to locate resource reference.
  · kube-system/anna-macbookair.node-password.k3s..................................................🔊
    🔊 [POP-400] Used? Unable to locate resource reference.
  · kube-system/builder-macbookpro2.node-password.k3s..............................................🔊
    🔊 [POP-400] Used? Unable to locate resource reference.
  · kube-system/isaac-macbookpro.node-password.k3s.................................................🔊
    🔊 [POP-400] Used? Unable to locate resource reference.
  · kube-system/k3s-serving........................................................................🔊
    🔊 [POP-400] Used? Unable to locate resource reference.


SERVICES (16 SCANNED)                                                        💥 0 😱 13 🔊 2 ✅ 1 18٪
┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅
  · default/azure-vote-front.......................................................................😱
    🔊 [POP-1102] Use of target port #80 for service port TCP::80. Prefer named port.
    😱 [POP-1109] Only one Pod associated with this endpoint.
    🔊 [POP-1103] Type LoadBalancer detected. Could be expensive.
    🔊 [POP-1107] LoadBalancer detected but service sets externalTrafficPolicy to "Cluster".
  · default/fbnext-service.........................................................................🔊
    🔊 [POP-1102] Use of target port #3000 for service port TCP::80. Prefer named port.
  · default/fbnextgh-service.......................................................................🔊
    🔊 [POP-1102] Use of target port #3000 for service port TCP::80. Prefer named port.
  · default/gitea-http.............................................................................😱
    🔊 [POP-1102] Use of target port #3000 for service port TCP:http:3000. Prefer named port.
    😱 [POP-1109] Only one Pod associated with this endpoint.
  · default/gitea-memcached........................................................................😱
    😱 [POP-1109] Only one Pod associated with this endpoint.
  · default/gitea-postgresql.......................................................................😱
    😱 [POP-1109] Only one Pod associated with this endpoint.
  · default/gitea-postgresql-hl....................................................................😱
    😱 [POP-1109] Only one Pod associated with this endpoint.
  · default/gitea-ssh..............................................................................😱
    🔊 [POP-1102] Use of target port #22 for service port TCP:ssh:22. Prefer named port.
    😱 [POP-1109] Only one Pod associated with this endpoint.
  · default/homarsvc...............................................................................😱
    🔊 [POP-1102] Use of target port #7575 for service port TCP::7575. Prefer named port.
    😱 [POP-1109] Only one Pod associated with this endpoint.
    🔊 [POP-1104] Do you mean it? Type NodePort detected.
  · default/kubernetes.............................................................................✅
  · default/my-opentelemetry-collector.............................................................😱
    🔊 [POP-1102] Use of target port #6831 for service port UDP:jaeger-compact:6831. Prefer named
       port.
    🔊 [POP-1102] Use of target port #14250 for service port TCP:jaeger-grpc:14250. Prefer named
       port.
    🔊 [POP-1102] Use of target port #14268 for service port TCP:jaeger-thrift:14268. Prefer named
       port.
    🔊 [POP-1102] Use of target port #4317 for service port TCP:otlp:4317. Prefer named port.
    🔊 [POP-1102] Use of target port #4318 for service port TCP:otlp-http:4318. Prefer named port.
    🔊 [POP-1102] Use of target port #9411 for service port TCP:zipkin:9411. Prefer named port.
    😱 [POP-1109] Only one Pod associated with this endpoint.
  · default/nginx-service..........................................................................😱
    🔊 [POP-1102] Use of target port #80 for service port TCP::80. Prefer named port.
    😱 [POP-1109] Only one Pod associated with this endpoint.
  · default/vote-back-azure-vote-1688994153........................................................😱
    🔊 [POP-1102] Use of target port #6379 for service port TCP::6379. Prefer named port.
    😱 [POP-1109] Only one Pod associated with this endpoint.
  · default/zipkin.................................................................................😱
    🔊 [POP-1101] Skip ports check. No explicit ports detected on pod
       default/zipkin-6db857b95b-tmcjh.
    😱 [POP-1109] Only one Pod associated with this endpoint.
  · kube-system/kube-dns...........................................................................😱
    🔊 [POP-1102] Use of target port #53 for service port UDP:dns:53. Prefer named port.
    🔊 [POP-1102] Use of target port #53 for service port TCP:dns-tcp:53. Prefer named port.
    🔊 [POP-1102] Use of target port #9153 for service port TCP:metrics:9153. Prefer named port.
    😱 [POP-1109] Only one Pod associated with this endpoint.
  · kube-system/metrics-server.....................................................................😱
    😱 [POP-1109] Only one Pod associated with this endpoint.


SERVICEACCOUNTS (42 SCANNED)                                                 💥 0 😱 1 🔊 3 ✅ 38 97٪
┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅
  · default/default................................................................................✅
  · default/helm-nfs...............................................................................😱
    😱 [POP-303] Do you mean it? ServiceAccount is automounting APIServer credentials.
  · default/my-opentelemetry-collector.............................................................✅
  · default/nfs-subdir-external-provisioner........................................................✅
  · default/zipkin.................................................................................✅
  · kube-node-lease/default........................................................................🔊
    🔊 [POP-400] Used? Unable to locate resource reference.
  · kube-public/default............................................................................🔊
    🔊 [POP-400] Used? Unable to locate resource reference.
  · kube-system/attachdetach-controller............................................................✅
  · kube-system/certificate-controller.............................................................✅
  · kube-system/clusterrole-aggregation-controller.................................................✅
  · kube-system/coredns............................................................................✅
  · kube-system/cronjob-controller.................................................................✅
  · kube-system/daemon-set-controller..............................................................✅
  · kube-system/default............................................................................🔊
    🔊 [POP-400] Used? Unable to locate resource reference.
  · kube-system/deployment-controller..............................................................✅
  · kube-system/disruption-controller..............................................................✅
  · kube-system/endpoint-controller................................................................✅
  · kube-system/endpointslice-controller...........................................................✅
  · kube-system/endpointslicemirroring-controller..................................................✅
  · kube-system/ephemeral-volume-controller........................................................✅
  · kube-system/expand-controller..................................................................✅
  · kube-system/generic-garbage-collector..........................................................✅
  · kube-system/horizontal-pod-autoscaler..........................................................✅
  · kube-system/job-controller.....................................................................✅
  · kube-system/local-path-provisioner-service-account.............................................✅
  · kube-system/metrics-server.....................................................................✅
  · kube-system/namespace-controller...............................................................✅
  · kube-system/node-controller....................................................................✅
  · kube-system/persistent-volume-binder...........................................................✅
  · kube-system/pod-garbage-collector..............................................................✅
  · kube-system/pv-protection-controller...........................................................✅
  · kube-system/pvc-protection-controller..........................................................✅
  · kube-system/replicaset-controller..............................................................✅
  · kube-system/replication-controller.............................................................✅
  · kube-system/resourcequota-controller...........................................................✅
  · kube-system/root-ca-cert-publisher.............................................................✅
  · kube-system/service-account-controller.........................................................✅
  · kube-system/statefulset-controller.............................................................✅
  · kube-system/svclb..............................................................................✅
  · kube-system/token-cleaner......................................................................✅
  · kube-system/ttl-after-finished-controller......................................................✅
  · kube-system/ttl-controller.....................................................................✅


STATEFULSETS (2 SCANNED)                                                       💥 0 😱 2 🔊 0 ✅ 0 0٪
┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅
  · default/gitea..................................................................................😱
    🐳 configure-gitea
      😱 [POP-107] No resource limits defined.
    🐳 gitea
      😱 [POP-106] No resources requests/limits defined.
    🐳 init-app-ini
      😱 [POP-107] No resource limits defined.
    🐳 init-directories
      😱 [POP-107] No resource limits defined.
  · default/gitea-postgresql.......................................................................😱
    🐳 postgresql
      😱 [POP-107] No resource limits defined.


SUMMARY
┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅┅
Your cluster score: 78 -- C
                                                                                o          .-'-.
                                                                                 o     __| C    `\
                                                                                  o   `-,-`--._   `\
                                                                                 []  .->'  a     `|-'
                                                                                  `=/ (__/_       /
                                                                                    \_,    `    _)
                                                                                       `----;  |

A lot of what it found I don’t care about. I don’t necessarily believe all pods need resource limits.

However, I do agree that named ports are preferred and if this was a dev cluster for work, I would likely push to name those ports (3000 and 4040). There were some leaky service accounts found and some likely deprecated workloads (around NFS).

If you wanted to share this, Popeye can kick out an HTML page

builder@DESKTOP-QADGF36:~/Workspaces/jekyll-blog$ popeye -o html > popeyereport.html
builder@DESKTOP-QADGF36:~/Workspaces/jekyll-blog$ wkhtmltopdf popeyereport.html popeyereport.pdf
Loading page (1/2)
Printing pages (2/2)
Done
builder@DESKTOP-QADGF36:~/Workspaces/jekyll-blog$ cp popeyereport.pdf /mnt/c/Users/isaac/Downloads/

K1s

Getting down to the absolute simplest, let’s look at k1s.

We can install with brew like the rest

$ brew install weibeld/tap/k1s

Though it’s so small, you can get away with just a local download as well

wget https://raw.githubusercontent.com/weibeld/k1s/master/k1s
chmod +x k1s
mv k1s /usr/local/bin

We can see it in action (skip to end)

the usage of K1s is pretty simple - it’s meant to watch a “resource type” in a “namespace”

Here I swing through a few. Perhaps you wanted to see when a cert is created on an ingress or pods in a namespace.

Summary

Today we checked out 3 command-line Kubernetes monitoring tools; KDash, KTop and k1s. We also looked at a nice open-source scanner, Popeye. While I like what KTop was trying to do, I probably won’t use that too often. Instead, I really liked KDash and k1s. I plan to put k1s on a few hosts for work as it really solves my quick checks.

I do plan to try Popeye on some actually workload bearing clusters. If anything, I love tools that can identify issues and waste in easy-to-read reports.