first commit

Necronomicon/Cloud/Kubernetes/General.md

@@ -0,0 +1,32 @@
+- Increase number of containers currently deployed
+	- `kubectl scale --replicas=3 deployment/nginx`
+- Update application version of running containers
+	- `kubectl set image deployment/nginx-deployment\nginx=nginx:1.9.1 --record`
+- Get a shell on a particular container
+	- `kubectl exec sparcflow/nginx-<container_number> bash`
+- Deploy a pod according to YAML manifest file
+	- `kubectl apply -f <manifest_file>`
+- Get a list of running pods
+	- `kubectl get pods`
+	- Clean output
+		- `kubectl get pods -n prod -o="custom-columns=NODE:.spec.nodeName,POD:.metadata.name"`
+- Destroy pod
+	- `kubectl delete -f <manifest_file>`
+- Check for service account secrets
+	1. `mount |grep -i secrets`
+	2. `cat /run/secrets/kubernetes.io/serviceaccount/token`
+- Decode JWT secret
+	- `cat /run/secrets/kubernetes.io/serviceaccount/token | cut -d "." -f 2 | base64 -d`
+- Interact with API with pilfered secret:
+	1. `export TOKEN=$(cat /run/secrets/kubernetes.io/serviceaccount/token)`
+	2. `env` - Determine location of API
+	3. `curl -Lk https://10.100.0.1/api --header "Authorization: Bearer $TOKEN"`
+- Check authorization to perform various actions
+	- `kubectl version auth can-i <action>`
+	- `kubectl version auth can-i get nodes`
+	- `kubectl version auth can-i get pods`
+	- Make sure you specify namespace with -n if the above succeeds, but the actual action fails. Use namespace specified in the JWT
+- Extract manifest of all pods
+	- `kubectl get pods -n prod -o yaml > output.yaml`
+	- Get nicely formatted output:
+		- ` kubectl get pods -o="custom-columns=NODE:.spec.nodeName,POD:.metadata.name,PODIP:.status.podIP,SERVICE:.spec.serviceAccount,ENV:.spec.containers[*].env[*].valueFrom.secretKeyRef,FILESECRET:.spec.volumes[*].secret.secretName"`