window.TRANSCRIPTS = { "host.kernel": { "cmd": "uname -r; echo \"cgroup fs: $(stat -fc %T /sys/fs/cgroup/)\"", "out": "6.8.0-136-generic\ncgroup fs: cgroup2fs", "rc": 0 }, "host.docker": { "cmd": "docker version --format \"Client: {{.Client.Version}} Server: {{.Server.Version}}\"; containerd --version 2>/dev/null; runc --version 2>/dev/null | head -1", "out": "Client: 29.4.0 Server: 29.4.0\ncontainerd containerd.io v2.2.2 301b2dac98f15c27117da5c8af12118a041a31d9\nrunc version 1.3.4", "rc": 0 }, "ns.hostview": { "cmd": "ps -o pid,ppid,user,args -p 644210", "out": " PID PPID USER COMMAND\n 644210 644183 root sleep 600", "rc": 0 }, "ns.inside": { "cmd": "docker exec nsdemo ps -ef", "out": "PID USER TIME COMMAND\n 1 root 0:00 sleep 600\n 7 root 0:00 ps -ef", "rc": 0 }, "ns.list": { "cmd": "ls -l /proc/644210/ns/", "out": "total 0\nlrwxrwxrwx 1 root root 0 Jul 25 20:16 cgroup -> cgroup:[4026534736]\nlrwxrwxrwx 1 root root 0 Jul 25 20:16 ipc -> ipc:[4026534734]\nlrwxrwxrwx 1 root root 0 Jul 25 20:16 mnt -> mnt:[4026534732]\nlrwxrwxrwx 1 root root 0 Jul 25 20:16 net -> net:[4026534737]\nlrwxrwxrwx 1 root root 0 Jul 25 20:16 pid -> pid:[4026534735]\nlrwxrwxrwx 1 root root 0 Jul 25 20:16 pid_for_children -> pid:[4026534735]\nlrwxrwxrwx 1 root root 0 Jul 25 20:16 time -> time:[4026531834]\nlrwxrwxrwx 1 root root 0 Jul 25 20:16 time_for_children -> time:[4026531834]\nlrwxrwxrwx 1 root root 0 Jul 25 20:16 user -> user:[4026531837]\nlrwxrwxrwx 1 root root 0 Jul 25 20:16 uts -> uts:[4026534733]", "rc": 0 }, "ns.compare": { "cmd": "echo 'HOST:'; ls -l /proc/1/ns/ | awk '{print $9, $11}'; echo; echo 'CONTAINER:'; ls -l /proc/644210/ns/ | awk '{print $9, $11}'", "out": "HOST:\n\ncgroup cgroup:[4026531835]\nipc ipc:[4026531839]\nmnt mnt:[4026531841]\nnet net:[4026531840]\npid pid:[4026531836]\npid_for_children pid:[4026531836]\ntime time:[4026531834]\ntime_for_children time:[4026531834]\nuser user:[4026531837]\nuts uts:[4026531838]\n\nCONTAINER:\n\ncgroup cgroup:[4026534736]\nipc ipc:[4026534734]\nmnt mnt:[4026534732]\nnet net:[4026534737]\npid pid:[4026534735]\npid_for_children pid:[4026534735]\ntime time:[4026531834]\ntime_for_children time:[4026531834]\nuser user:[4026531837]\nuts uts:[4026534733]", "rc": 0 }, "ns.unshare": { "cmd": "unshare --pid --fork --mount-proc sh -c \"echo \\\"I am PID \\$\\$\\\"; ps -ef\"", "out": "I am PID 1\nUID PID PPID C STIME TTY TIME CMD\nroot 1 0 0 20:16 ? 00:00:00 sh -c echo \"I am PID $$\"; ps -ef\nroot 2 1 0 20:16 ? 00:00:00 ps -ef", "rc": 0 }, "ns.uts": { "cmd": "echo \"host hostname: $(hostname)\"; unshare --uts sh -c \"hostname isolated-demo; echo \\\"inside: \\$(hostname)\\\"\"; echo \"host after: $(hostname)\"", "out": "host hostname: cafetele-server\ninside: isolated-demo\nhost after: cafetele-server", "rc": 0 }, "cg.path": { "cmd": "cat /proc/644210/cgroup", "out": "0::/system.slice/docker-f1b8ad4591c15147d4af003c2d8d1249d65532f87b4985fcaf7ac5476a46a2e0.scope", "rc": 0 }, "cg.limits": { "cmd": "for f in memory.max memory.high cpu.max pids.max; do printf '%-14s %s\\n' \"$f\" \"$(cat /sys/fs/cgroup/system.slice/docker-f1b8ad4591c15147d4af003c2d8d1249d65532f87b4985fcaf7ac5476a46a2e0.scope/$f 2>/dev/null || echo n/a)\"; done", "out": "memory.max 67108864\nmemory.high max\ncpu.max 50000 100000\npids.max 19144", "rc": 0 }, "cg.usage": { "cmd": "printf '%-22s %s\\n' memory.current \"$(cat /sys/fs/cgroup/system.slice/docker-f1b8ad4591c15147d4af003c2d8d1249d65532f87b4985fcaf7ac5476a46a2e0.scope/memory.current 2>/dev/null)\"; cat /sys/fs/cgroup/system.slice/docker-f1b8ad4591c15147d4af003c2d8d1249d65532f87b4985fcaf7ac5476a46a2e0.scope/memory.events 2>/dev/null; echo; cat /sys/fs/cgroup/system.slice/docker-f1b8ad4591c15147d4af003c2d8d1249d65532f87b4985fcaf7ac5476a46a2e0.scope/cpu.stat 2>/dev/null | head -6", "out": "memory.current 368640\nlow 0\nhigh 0\nmax 0\noom 0\noom_kill 0\noom_group_kill 0\n\nusage_usec 64147\nuser_usec 34852\nsystem_usec 29295\ncore_sched.force_idle_usec 0\nnr_periods 5\nnr_throttled 0", "rc": 0 }, "cg.oom": { "cmd": "docker rm -f oomdemo >/dev/null 2>&1; docker run --name oomdemo --memory 32m alpine:3.20 sh -c \"dd if=/dev/zero of=/dev/shm/fill bs=1M count=200\" 2>&1 | tail -3; echo \"exit code: $(docker inspect -f \"{{.State.ExitCode}}\" oomdemo)\"; echo \"OOMKilled: $(docker inspect -f \"{{.State.OOMKilled}}\" oomdemo)\"", "out": "exit code: 137\nOOMKilled: true", "rc": 0 }, "img.sizes": { "cmd": "docker images --format 'table {{.Repository}}:{{.Tag}}\\t{{.Size}}' | grep -E 'REPOSITORY|ct.io/' | sort", "out": "REPOSITORY:TAG SIZE\nct.io/catalog:fat 1.18GB\nct.io/catalog:v1 119MB\nct.io/catalog:v2 119MB\nct.io/orders:fat 352MB\nct.io/orders:v1 5.59MB\nct.io/orders:v2 5.59MB", "rc": 0 }, "img.history": { "cmd": "docker history ct.io/catalog:v1 --no-trunc --format \"table {{.CreatedBy}}\\t{{.Size}}\" | cut -c1-110", "out": "CREATED BY\nENTRYPOINT [\"python\" \"/app/app.py\"]\nHEALTHCHECK &{[\"CMD\" \"python\" \"-c\" \"import urllib.request;urllib.request.urlopen('http://127.0.0.1:8080/health\nEXPOSE [8080/tcp]\nUSER 65532:65532\nRUN /bin/sh -c useradd --uid 65532 --create-home --shell /usr/sbin/nologin app # buildkit\nCOPY app.py ./ # buildkit\nWORKDIR /app\nENV PYTHONUNBUFFERED=1 PYTHONDONTWRITEBYTECODE=1 APP_VERSION=v1\nCMD [\"python3\"]\nRUN /bin/sh -c set -eux; for src in idle3 pip3 pydoc3 python3 python3-config; do dst=\"$(echo \"$src\" | tr -d\nRUN /bin/sh -c set -eux; savedAptMark=\"$(apt-mark showmanual)\"; apt-get update; apt-get install -y --no-in\nENV PYTHON_SHA256=c08bc65a81971c1dd5783182826503369466c7e67374d1646519adf05207b684\nENV PYTHON_VERSION=3.12.13\nENV GPG_KEY=7169605F62C751356D054A26A821E680E5FA6305\nRUN /bin/sh -c set -eux; apt-get update; apt-get install -y --no-install-recommends ca-certificates netb\nENV LANG=C.UTF-8\nENV PATH=/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\n# debian.sh --arch 'amd64' out/ 'trixie' '@1783900800'", "rc": 0 }, "img.scratch": { "cmd": "docker image inspect ct.io/orders:v1 --format \"layers: {{len .RootFS.Layers}}{{println}}user: {{.Config.User}}{{println}}entry: {{.Config.Entrypoint}}{{println}}size: {{.Size}} bytes\"", "out": "layers: 1\nuser: 65532:65532\nentry: [/orders]\nsize: 5591224 bytes", "rc": 0 }, "img.overlay": { "cmd": "docker image inspect ct.io/catalog:v1 --format \"{{json .GraphDriver}}\" | python3 -m json.tool | head -20", "out": "{\n \"Data\": {\n \"LowerDir\": \"/var/lib/docker/overlay2/irt5s1g2flt52lm5itfpp4dj5/diff:/var/lib/docker/overlay2/z75em73puiku43pdujurb2jha/diff:/var/lib/docker/overlay2/f9647a2b127de85f71d6c3d023bb44b5d00f4395164a0f558d933cf0f57c5e1d/diff:/var/lib/docker/overlay2/d8fb22a8973deea08635d526b0b064b36bf987f7e21f2b8cef07325bc5dad8c2/diff:/var/lib/docker/overlay2/8475f14494296e1ec252d73cf19dcaec156b3bd037c1ccadedfe1fc74f2cef54/diff:/var/lib/docker/overlay2/1d95f332c09bdd226297ed193f1d1f19e22a1430db60df8d0fd189195726373e/diff\",\n \"MergedDir\": \"/var/lib/docker/overlay2/rgwpok6iapq2lt2ze540dwj4i/merged\",\n \"UpperDir\": \"/var/lib/docker/overlay2/rgwpok6iapq2lt2ze540dwj4i/diff\",\n \"WorkDir\": \"/var/lib/docker/overlay2/rgwpok6iapq2lt2ze540dwj4i/work\"\n },\n \"Name\": \"overlay2\"\n}", "rc": 0 }, "img.digest": { "cmd": "docker image inspect ct.io/catalog:v1 --format \"Id: {{.Id}}\"; echo \"RepoTags: $(docker image inspect ct.io/catalog:v1 --format \"{{.RepoTags}}\")\"", "out": "Id: sha256:57f4b2a7da2bb0d3fedee8aa1f29ebdb3b69e16e691034ef9acf33cb04a44ac5\nRepoTags: [ct.io/catalog:v1 ct.io/catalog:v2]", "rc": 0 }, "img.cow": { "cmd": "docker rm -f cowdemo >/dev/null 2>&1; docker run -d --name cowdemo ct.io/catalog:v1 >/dev/null; sleep 1; docker exec cowdemo sh -c \"echo hello > /tmp/new.txt\" 2>/dev/null; docker diff cowdemo | head -12; echo \"---\"; docker ps -s --filter name=cowdemo --format \"{{.Names}} {{.Size}}\"", "out": "C /tmp\nA /tmp/new.txt\n---\ncowdemo 6B (virtual 119MB)", "rc": 0 }, "rt.chain": { "cmd": "ps -eo pid,ppid,comm --forest | grep -E \"dockerd|containerd|shim|sleep\" | head -14", "out": " 1262 1 containerd\n 1944 1 dockerd\n 3132 1 containerd-shim\n 3133 1 containerd-shim\n 4091 3267 \\_ containerd\n 5694 3267 \\_ containerd-shim\n 5739 3267 \\_ containerd-shim\n 6030 3267 \\_ containerd-shim\n 6128 3267 \\_ containerd-shim\n 3144 1 containerd-shim\n 4096 3260 \\_ containerd\n 6197 3260 \\_ containerd-shim\n 6235 3260 \\_ containerd-shim\n 6429 3260 \\_ containerd-shim", "rc": 0 }, "rt.crictl": { "cmd": "docker exec ct-dk8s-control-plane crictl ps --no-trunc 2>/dev/null | head -8", "out": "CONTAINER IMAGE CREATED STATE NAME ATTEMPT POD ID POD NAMESPACE\nf7f742a538b5d3d412e4b3299a8fc4dac88cfedf21551c3d47db4b56f643ffbe sha256:bbb6209cc873b9b4095bd014b4687512eea2bd7b246f9ec06f4f6f0be14d9fb6 7 minutes ago Running local-path-provisioner 0 228defe9e63bfe69791c6b051c443819c27e35e7b55828093445a75e28899def local-path-provisioner-7dc846544d-fp9qn local-path-storage\nf0855e3d30cfb972f3c91c2013a8f77e58717a1da7e1b8d66fe44c7b61466108 sha256:1cf5f116067c67da67f97bff78c4bbc76913f59057c18627b96facaced73ea0b 7 minutes ago Running coredns 0 283cd5a9d25c524bb01ad17d876f543af331c3922029c6ff8f090edb2c4eefa3 coredns-674b8bbfcf-rcz67 kube-system\n9662ce627689793243bbe90abc33ed6d0b49877725804a82c78fe98ca50637b7 sha256:1cf5f116067c67da67f97bff78c4bbc76913f59057c18627b96facaced73ea0b 7 minutes ago Running coredns 0 0b49cfc94aef359df479806910d295ef2cffd8155442b884bee4f56c66fecd18 coredns-674b8bbfcf-dr4pc kube-system\naedd98f40354a16e211d777160bdd37556b020eb5a171d9ee1bc91569ffa6b06 sha256:409467f978b4a30fe717012736557d637f66371452c3b279c02b943b367a141c 8 minutes ago Running kindnet-cni 0 aee951fbaa419f4c7ad9ef7c13984b9dea687c8a86255e126f5bc7922edab17a kindnet-hdjqb kube-system\nceb03eb8fba9e24a7aee552a4d3cdf6fa67eac3e280a7638b5b33b43e1cc4c65 sha256:b79c189b052cdbe0e837d0caa6faf1d9fd696d8664fcc462f67d9ea51f26fef2 8 minutes ago Running kube-proxy 0 d61c97af113e87fa0395d5576e979f0a8023c952d8490c7dfd4e07f0e41d5323 kube-proxy-vstgp kube-system\n4d101deb77227723e7ec8fce8da19e160583562f6ba10c34a420833785763df5 sha256:499038711c0816eda03a1ad96a8eb0440c005baa6949698223c6176b7f5077e1 8 minutes ago Running etcd 0 48c9965382ffb9dd09137c468c7512b922518ab4c44e8d943bae43285e393515 etcd-ct-dk8s-control-plane kube-system\ned930894fff9d4a1ebf87ca0fc6b298cb62873335ada883d3e0f97c944f82095 sha256:c6ab243b29f82a6ce269a5342bfd9ea3d0d4ef0f2bb7e98c6ac0bde1aeafab66 8 minutes ago Running kube-apiserver 0 6037bc030e5e1becb7cb278ce9b1628a00a9c09131789fbdcc70493f6ddc72ac kube-apiserver-ct-dk8s-control-plane kube-system", "rc": 0 }, "rt.ctr": { "cmd": "docker exec ct-dk8s-control-plane ctr namespaces list 2>/dev/null; echo; docker exec ct-dk8s-control-plane ctr -n k8s.io images list -q 2>/dev/null | head -8", "out": "NAME LABELS\nk8s.io\n\nct.io/catalog:v1\nct.io/catalog:v2\nct.io/orders:v1\nct.io/orders:v2\ndocker.io/kindest/kindnetd:v20250512-df8de77b\ndocker.io/kindest/local-path-helper:v20241212-8ac705d0\ndocker.io/kindest/local-path-provisioner:v20250214-acbabc1a\nregistry.k8s.io/coredns/coredns:v1.12.0", "rc": 0 }, "k.version": { "cmd": "kubectl --context kind-ct-dk8s version -o yaml | head -14", "out": "WARNING: version difference between client (1.30) and server (1.33) exceeds the supported minor version skew of +/-1\nclientVersion:\n buildDate: \"\"\n compiler: gc\n gitCommit: 7c48c2bd72b9bf5c44d21d7338cc7bea77d0ad2a\n gitTreeState: clean\n gitVersion: v1.30.0\n goVersion: go1.22.2\n major: \"1\"\n minor: \"30\"\n platform: linux/amd64\nkustomizeVersion: v5.0.4-0.20230601165947-6ce0bf390ce3\nserverVersion:\n buildDate: \"\"\n compiler: gc", "rc": 0 }, "k.info": { "cmd": "kubectl --context kind-ct-dk8s cluster-info", "out": "\u001b[0;32mKubernetes control plane\u001b[0m is running at \u001b[0;33mhttps://127.0.0.1:46073\u001b[0m\n\u001b[0;32mCoreDNS\u001b[0m is running at \u001b[0;33mhttps://127.0.0.1:46073/api/v1/namespaces/kube-system/services/kube-dns:dns/proxy\u001b[0m\n\nTo further debug and diagnose cluster problems, use 'kubectl cluster-info dump'.", "rc": 0 }, "k.nodes": { "cmd": "kubectl --context kind-ct-dk8s get nodes -o wide", "out": "NAME STATUS ROLES AGE VERSION INTERNAL-IP EXTERNAL-IP OS-IMAGE KERNEL-VERSION CONTAINER-RUNTIME\nct-dk8s-control-plane Ready control-plane 8m15s v1.33.1 172.20.0.5 Debian GNU/Linux 12 (bookworm) 6.8.0-136-generic containerd://2.1.1\nct-dk8s-worker Ready 8m2s v1.33.1 172.20.0.8 Debian GNU/Linux 12 (bookworm) 6.8.0-136-generic containerd://2.1.1\nct-dk8s-worker2 Ready 8m2s v1.33.1 172.20.0.6 Debian GNU/Linux 12 (bookworm) 6.8.0-136-generic containerd://2.1.1\nct-dk8s-worker3 Ready 8m3s v1.33.1 172.20.0.7 Debian GNU/Linux 12 (bookworm) 6.8.0-136-generic containerd://2.1.1", "rc": 0 }, "k.cp": { "cmd": "kubectl --context kind-ct-dk8s -n kube-system get pods -o wide --no-headers | sort", "out": "coredns-674b8bbfcf-dr4pc 1/1 Running 0 8m7s 10.244.0.4 ct-dk8s-control-plane \ncoredns-674b8bbfcf-rcz67 1/1 Running 0 8m7s 10.244.0.2 ct-dk8s-control-plane \netcd-ct-dk8s-control-plane 1/1 Running 0 8m12s 172.20.0.5 ct-dk8s-control-plane \nkindnet-59bmt 1/1 Running 0 8m3s 172.20.0.7 ct-dk8s-worker3 \nkindnet-dnxjp 1/1 Running 0 8m2s 172.20.0.6 ct-dk8s-worker2 \nkindnet-hdjqb 1/1 Running 0 8m8s 172.20.0.5 ct-dk8s-control-plane \nkindnet-j8krl 1/1 Running 0 8m2s 172.20.0.8 ct-dk8s-worker \nkube-apiserver-ct-dk8s-control-plane 1/1 Running 0 8m13s 172.20.0.5 ct-dk8s-control-plane \nkube-controller-manager-ct-dk8s-control-plane 1/1 Running 0 8m14s 172.20.0.5 ct-dk8s-control-plane \nkube-proxy-2cxj5 1/1 Running 0 8m2s 172.20.0.8 ct-dk8s-worker \nkube-proxy-fgfx5 1/1 Running 0 8m3s 172.20.0.7 ct-dk8s-worker3 \nkube-proxy-vstgp 1/1 Running 0 8m8s 172.20.0.5 ct-dk8s-control-plane \nkube-proxy-zqb59 1/1 Running 0 8m2s 172.20.0.6 ct-dk8s-worker2 \nkube-scheduler-ct-dk8s-control-plane 1/1 Running 0 8m12s 172.20.0.5 ct-dk8s-control-plane ", "rc": 0 }, "k.static": { "cmd": "docker exec ct-dk8s-control-plane ls -l /etc/kubernetes/manifests/", "out": "total 16\n-rw------- 1 root root 2553 Jul 25 20:08 etcd.yaml\n-rw------- 1 root root 3896 Jul 25 20:08 kube-apiserver.yaml\n-rw------- 1 root root 3431 Jul 25 20:08 kube-controller-manager.yaml\n-rw------- 1 root root 1656 Jul 25 20:08 kube-scheduler.yaml", "rc": 0 }, "k.apiresources": { "cmd": "kubectl --context kind-ct-dk8s api-resources --no-headers | wc -l; echo 'API groups:'; kubectl --context kind-ct-dk8s api-versions | wc -l; kubectl --context kind-ct-dk8s api-resources --no-headers | head -12", "out": "60\nAPI groups:\n21\nbindings v1 true Binding\ncomponentstatuses cs v1 false ComponentStatus\nconfigmaps cm v1 true ConfigMap\nendpoints ep v1 true Endpoints\nevents ev v1 true Event\nlimitranges limits v1 true LimitRange\nnamespaces ns v1 false Namespace\nnodes no v1 false Node\npersistentvolumeclaims pvc v1 true PersistentVolumeClaim\npersistentvolumes pv v1 false PersistentVolume\npods po v1 true Pod\npodtemplates v1 true PodTemplate", "rc": 141 }, "k.explain": { "cmd": "kubectl --context kind-ct-dk8s explain pod.spec.containers.resources --recursive | head -14", "out": "KIND: Pod\nVERSION: v1\n\nFIELD: resources \n\n\nDESCRIPTION:\n Compute Resources required by this container. Cannot be updated. More info:\n https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/\n ResourceRequirements describes the compute resource requirements.\n\nFIELDS:\n claims\t<[]ResourceClaim>\n name\t -required-", "rc": 0 }, "k.trace": { "cmd": "kubectl --context kind-ct-dk8s get pods -n shopline -v=6 2>&1 | grep -E 'GET|round_trippers' | head -6", "out": "I0725 20:16:38.412762 644943 round_trippers.go:553] GET https://127.0.0.1:46073/api/v1/namespaces/shopline/pods?limit=500 200 OK in 13 milliseconds", "rc": 0 }, "etcd.members": { "cmd": "kubectl --context kind-ct-dk8s -n kube-system exec etcd-ct-dk8s-control-plane -- sh -c 'ETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/server.crt --key=/etc/kubernetes/pki/etcd/server.key member list -w table'", "out": "+------------------+---------+-----------------------+-------------------------+-------------------------+------------+\n| ID | STATUS | NAME | PEER ADDRS | CLIENT ADDRS | IS LEARNER |\n+------------------+---------+-----------------------+-------------------------+-------------------------+------------+\n| b440e45667b0f9da | started | ct-dk8s-control-plane | https://172.20.0.5:2380 | https://172.20.0.5:2379 | false |\n+------------------+---------+-----------------------+-------------------------+-------------------------+------------+", "rc": 0 }, "etcd.keys": { "cmd": "echo -n 'total keys in /registry: '; kubectl --context kind-ct-dk8s -n kube-system exec etcd-ct-dk8s-control-plane -- sh -c 'ETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/server.crt --key=/etc/kubernetes/pki/etcd/server.key get /registry --prefix --keys-only' | grep -c .; echo; echo '--- the shapes of those keys ---'; kubectl --context kind-ct-dk8s -n kube-system exec etcd-ct-dk8s-control-plane -- sh -c 'ETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/server.crt --key=/etc/kubernetes/pki/etcd/server.key get /registry --prefix --keys-only' | grep . | awk -F/ '{print $3}' | sort | uniq -c | sort -rn | head -12", "out": "total keys in /registry: 664\n\n--- the shapes of those keys ---\n 284 events\n 70 clusterroles\n 56 clusterrolebindings\n 45 serviceaccounts\n 27 pods\n 20 apiregistration.k8s.io\n 17 configmaps\n 14 services\n 14 roles\n 14 rolebindings\n 13 flowschemas\n 8 prioritylevelconfigurations", "rc": 0 }, "etcd.secret": { "cmd": "kubectl --context kind-ct-dk8s -n kube-system exec etcd-ct-dk8s-control-plane -- sh -c 'ETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/server.crt --key=/etc/kubernetes/pki/etcd/server.key get /registry/secrets/shopline/catalog-secret' | strings | grep -iE 's3cr3t|password|catalog|k8s' | head -8", "out": "/registry/secrets/shopline/catalog-secret\ncatalog-secret\n{\"apiVersion\":\"v1\",\"kind\":\"Secret\",\"metadata\":{\"annotations\":{},\"name\":\"catalog-secret\",\"namespace\":\"shopline\"},\"stringData\":{\"password\":\"s3cr3t-lab-password\",\"username\":\"catalog\"},\"type\":\"Opaque\"}\n{\"f:data\":{\".\":{},\"f:password\":{},\"f:username\":{}},\"f:metadata\":{\"f:annotations\":{\".\":{},\"f:kubectl.kubernetes.io/last-applied-configuration\":{}}},\"f:type\":{}}B\npassword\ns3cr3t-lab-password\ncatalog", "rc": 0 }, "w.pods": { "cmd": "kubectl --context kind-ct-dk8s get pods -n shopline -o wide", "out": "NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES\ncatalog-676d8988d8-4cvsh 1/1 Running 0 4m5s 10.244.3.2 ct-dk8s-worker \ncatalog-676d8988d8-s7ccg 1/1 Running 0 4m5s 10.244.2.3 ct-dk8s-worker2 \ncatalog-676d8988d8-tdnkd 1/1 Running 0 4m5s 10.244.1.3 ct-dk8s-worker3 \ngateway-7d57f855df-m9r75 1/1 Running 0 3m22s 10.244.3.4 ct-dk8s-worker \ngateway-7d57f855df-tkpd7 1/1 Running 0 3m22s 10.244.1.5 ct-dk8s-worker3 \nnightly-reindex-29750175-25fqb 0/1 Completed 0 98s 10.244.1.6 ct-dk8s-worker3 \norders-9648fc664-6thkf 1/1 Running 0 4m4s 10.244.2.4 ct-dk8s-worker2 \norders-9648fc664-zwqsj 1/1 Running 0 4m4s 10.244.3.3 ct-dk8s-worker \npostgres-0 1/1 Running 0 4m5s 10.244.1.4 ct-dk8s-worker3 \nredis-64cc6586cf-27j9h 1/1 Running 0 4m5s 10.244.2.2 ct-dk8s-worker2 ", "rc": 0 }, "w.all": { "cmd": "kubectl --context kind-ct-dk8s get all -n shopline", "out": "NAME READY STATUS RESTARTS AGE\npod/catalog-676d8988d8-4cvsh 1/1 Running 0 4m5s\npod/catalog-676d8988d8-s7ccg 1/1 Running 0 4m5s\npod/catalog-676d8988d8-tdnkd 1/1 Running 0 4m5s\npod/gateway-7d57f855df-m9r75 1/1 Running 0 3m22s\npod/gateway-7d57f855df-tkpd7 1/1 Running 0 3m22s\npod/nightly-reindex-29750175-25fqb 0/1 Completed 0 98s\npod/orders-9648fc664-6thkf 1/1 Running 0 4m4s\npod/orders-9648fc664-zwqsj 1/1 Running 0 4m4s\npod/postgres-0 1/1 Running 0 4m5s\npod/redis-64cc6586cf-27j9h 1/1 Running 0 4m5s\n\nNAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE\nservice/catalog ClusterIP 10.100.245.13 8080/TCP 4m5s\nservice/gateway NodePort 10.98.7.205 80:30080/TCP 3m22s\nservice/orders ClusterIP 10.103.110.60 8080/TCP 4m4s\nservice/postgres ClusterIP None 5432/TCP 4m5s\nservice/redis ClusterIP 10.111.39.226 6379/TCP 4m5s\n\nNAME READY UP-TO-DATE AVAILABLE AGE\ndeployment.apps/catalog 3/3 3 3 4m5s\ndeployment.apps/gateway 2/2 2 2 3m22s\ndeployment.apps/orders 2/2 2 2 4m4s\ndeployment.apps/redis 1/1 1 1 4m5s\n\nNAME DESIRED CURRENT READY AGE\nreplicaset.apps/catalog-676d8988d8 3 3 3 4m5s\nreplicaset.apps/gateway-7d57f855df 2 2 2 3m22s\nreplicaset.apps/orders-9648fc664 2 2 2 4m4s\nreplicaset.apps/redis-64cc6586cf 1 1 1 4m5s\n\nNAME READY AGE\nstatefulset.apps/postgres 1/1 4m6s\n\nNAME REFERENCE TARGETS MINPODS MAXPODS REPLICAS AGE\nhorizontalpodautoscaler.autoscaling/orders Deployment/orders cpu: /60% 2 8 2 3m23s\n\nNAME SCHEDULE TIMEZONE SUSPEND ACTIVE LAST SCHEDULE AGE\ncronjob.batch/nightly-reindex */5 * * * * False 0 99s 3m23s\n\nNAME STATUS COMPLETIONS DURATION AGE\njob.batch/nightly-reindex-29750175 Complete 1/1 11s 99s", "rc": 0 }, "w.describe": { "cmd": "kubectl --context kind-ct-dk8s describe pod -n shopline -l app=catalog | head -46", "out": "Name: catalog-676d8988d8-4cvsh\nNamespace: shopline\nPriority: 0\nService Account: default\nNode: ct-dk8s-worker/172.20.0.8\nStart Time: Sat, 25 Jul 2026 20:12:33 +0000\nLabels: app=catalog\n pod-template-hash=676d8988d8\n tier=backend\nAnnotations: ct.io/config-revision: 1\n kubernetes.io/limit-ranger: LimitRanger plugin set: cpu limit for container catalog\nStatus: Running\nSeccompProfile: RuntimeDefault\nIP: 10.244.3.2\nIPs:\n IP: 10.244.3.2\nControlled By: ReplicaSet/catalog-676d8988d8\nContainers:\n catalog:\n Container ID: containerd://e5f92eb2937085bfe74e6372889854dfc10bd99fdf825d5a2e22625bd2c24aa9\n Image: ct.io/catalog:v1\n Image ID: sha256:57f4b2a7da2bb0d3fedee8aa1f29ebdb3b69e16e691034ef9acf33cb04a44ac5\n Port: 8080/TCP\n Host Port: 0/TCP\n State: Running\n Started: Sat, 25 Jul 2026 20:12:35 +0000\n Ready: True\n Restart Count: 0\n Limits:\n cpu: 200m\n memory: 128Mi\n Requests:\n cpu: 25m\n memory: 48Mi\n Liveness: http-get http://:http/healthz delay=0s timeout=2s period=10s #success=1 #failure=3\n Readiness: http-get http://:http/readyz delay=0s timeout=2s period=5s #success=1 #failure=2\n Startup: http-get http://:http/healthz delay=0s timeout=1s period=2s #success=1 #failure=30\n Environment:\n APP_VERSION: v1\n POD_IP: (v1:status.podIP)\n NODE_NAME: (v1:spec.nodeName)\n CONFIG_FILE: /etc/catalog/catalog.conf\n DB_PASSWORD_FILE: /etc/catalog-secret/password\n Mounts:\n /etc/catalog from config (ro)\n /etc/catalog-secret from secret (ro)", "rc": 141 }, "w.owner": { "cmd": "kubectl --context kind-ct-dk8s get deploy,rs,pods -n shopline -l app=catalog --no-headers; echo '--- ownerReferences ---'; kubectl --context kind-ct-dk8s get pod -n shopline -l app=catalog -o jsonpath='{range .items[0]}{.metadata.name}{\" owned by \"}{.metadata.ownerReferences[0].kind}/{.metadata.ownerReferences[0].name}{\"\\n\"}{end}'", "out": "deployment.apps/catalog 3/3 3 3 4m6s\nreplicaset.apps/catalog-676d8988d8 3 3 3 4m6s\npod/catalog-676d8988d8-4cvsh 1/1 Running 0 4m6s\npod/catalog-676d8988d8-s7ccg 1/1 Running 0 4m6s\npod/catalog-676d8988d8-tdnkd 1/1 Running 0 4m6s\n--- ownerReferences ---\ncatalog-676d8988d8-4cvsh owned by ReplicaSet/catalog-676d8988d8", "rc": 0 }, "w.sts": { "cmd": "kubectl --context kind-ct-dk8s get sts,pods -n shopline -l app=postgres --no-headers; echo; kubectl --context kind-ct-dk8s get pvc -n shopline", "out": "pod/postgres-0 1/1 Running 0 4m6s\n\nNAME STATUS VOLUME CAPACITY ACCESS MODES STORAGECLASS VOLUMEATTRIBUTESCLASS AGE\ndata-postgres-0 Bound pvc-ee7a8d1c-c71c-4a55-b975-a0506153dfe2 1Gi RWO standard 4m6s", "rc": 0 }, "w.stsdns": { "cmd": "kubectl --context kind-ct-dk8s run dnsprobe -n shopline --rm -i --restart=Never --image=busybox:1.36 --quiet --overrides='{\"spec\":{\"securityContext\":{\"runAsNonRoot\":true,\"runAsUser\":65532,\"seccompProfile\":{\"type\":\"RuntimeDefault\"}},\"containers\":[{\"name\":\"dnsprobe\",\"image\":\"busybox:1.36\",\"command\":[\"nslookup\",\"postgres-0.postgres.shopline.svc.cluster.local\"],\"securityContext\":{\"allowPrivilegeEscalation\":false,\"capabilities\":{\"drop\":[\"ALL\"]}}}]}}' 2>&1 | head -12", "out": "Server:\t\t10.96.0.10\nAddress:\t10.96.0.10:53\n\n\nName:\tpostgres-0.postgres.shopline.svc.cluster.local\nAddress: 10.244.1.4", "rc": 0 }, "w.cron": { "cmd": "kubectl --context kind-ct-dk8s get cronjob,jobs -n shopline", "out": "NAME SCHEDULE TIMEZONE SUSPEND ACTIVE LAST SCHEDULE AGE\ncronjob.batch/nightly-reindex */5 * * * * False 0 106s 3m30s\n\nNAME STATUS COMPLETIONS DURATION AGE\njob.batch/nightly-reindex-29750175 Complete 1/1 11s 106s", "rc": 0 }, "sch.decision": { "cmd": "kubectl --context kind-ct-dk8s get events -n shopline --field-selector reason=Scheduled --sort-by=.lastTimestamp -o custom-columns='TIME:.lastTimestamp,OBJECT:.involvedObject.name,MESSAGE:.message' | tail -8", "out": " catalog-676d8988d8-tdnkd Successfully assigned shopline/catalog-676d8988d8-tdnkd to ct-dk8s-worker3\n orders-9648fc664-6thkf Successfully assigned shopline/orders-9648fc664-6thkf to ct-dk8s-worker2\n orders-9648fc664-zwqsj Successfully assigned shopline/orders-9648fc664-zwqsj to ct-dk8s-worker\n postgres-0 Successfully assigned shopline/postgres-0 to ct-dk8s-worker3\n gateway-7d57f855df-m9r75 Successfully assigned shopline/gateway-7d57f855df-m9r75 to ct-dk8s-worker\n gateway-7d57f855df-tkpd7 Successfully assigned shopline/gateway-7d57f855df-tkpd7 to ct-dk8s-worker3\n nightly-reindex-29750175-25fqb Successfully assigned shopline/nightly-reindex-29750175-25fqb to ct-dk8s-worker3\n dnsprobe Successfully assigned shopline/dnsprobe to ct-dk8s-worker", "rc": 0 }, "sch.spread": { "cmd": "kubectl --context kind-ct-dk8s get pods -n shopline -l app=catalog -o custom-columns='POD:.metadata.name,NODE:.spec.nodeName' ; echo; kubectl --context kind-ct-dk8s get nodes -L topology.kubernetes.io/zone", "out": "POD NODE\ncatalog-676d8988d8-4cvsh ct-dk8s-worker\ncatalog-676d8988d8-s7ccg ct-dk8s-worker2\ncatalog-676d8988d8-tdnkd ct-dk8s-worker3\n\nNAME STATUS ROLES AGE VERSION ZONE\nct-dk8s-control-plane Ready control-plane 8m25s v1.33.1\nct-dk8s-worker Ready 8m12s v1.33.1 zone-a\nct-dk8s-worker2 Ready 8m12s v1.33.1 zone-b\nct-dk8s-worker3 Ready 8m13s v1.33.1 zone-c", "rc": 0 }, "sch.pending": { "cmd": "kubectl --context kind-ct-dk8s apply -f /tmp/too-big.yaml >/dev/null; sleep 8;\n kubectl --context kind-ct-dk8s get pod too-big -n sched-demo;\n echo; echo '--- the scheduler explains itself, node by node ---';\n kubectl --context kind-ct-dk8s describe pod too-big -n sched-demo | sed -n '/Events:/,$p'", "out": "NAME READY STATUS RESTARTS AGE\ntoo-big 0/1 Pending 0 8s\n\n--- the scheduler explains itself, node by node ---\nEvents:\n Type Reason Age From Message\n ---- ------ ---- ---- -------\n Warning FailedScheduling 8s default-scheduler 0/4 nodes are available: 1 node(s) had untolerated taint {node-role.kubernetes.io/control-plane: }, 3 Insufficient cpu. preemption: 0/4 nodes are available: 1 Preemption is not helpful for scheduling, 3 No preemption victims found for incoming pod.", "rc": 0 }, "sch.taint": { "cmd": "kubectl --context kind-ct-dk8s get nodes -o custom-columns='NODE:.metadata.name,TAINTS:.spec.taints[*].key' ; echo; kubectl --context kind-ct-dk8s describe node ct-dk8s-control-plane | grep -A2 Taints", "out": "NODE TAINTS\nct-dk8s-control-plane node-role.kubernetes.io/control-plane\nct-dk8s-worker \nct-dk8s-worker2 \nct-dk8s-worker3 \n\nTaints: node-role.kubernetes.io/control-plane:NoSchedule\nUnschedulable: false\nLease:", "rc": 0 }, "res.qos": { "cmd": "kubectl --context kind-ct-dk8s get pods -n shopline -o custom-columns='POD:.metadata.name,QOS:.status.qosClass,CPU_REQ:.spec.containers[0].resources.requests.cpu,MEM_LIM:.spec.containers[0].resources.limits.memory' | sort", "out": "POD QOS CPU_REQ MEM_LIM\ncatalog-676d8988d8-4cvsh Burstable 25m 128Mi\ncatalog-676d8988d8-s7ccg Burstable 25m 128Mi\ncatalog-676d8988d8-tdnkd Burstable 25m 128Mi\ngateway-7d57f855df-m9r75 Burstable 20m 64Mi\ngateway-7d57f855df-tkpd7 Burstable 20m 64Mi\nnightly-reindex-29750175-25fqb Burstable 10m 32Mi\norders-9648fc664-6thkf Burstable 50m 64Mi\norders-9648fc664-zwqsj Burstable 50m 64Mi\npostgres-0 Burstable 50m 256Mi\nredis-64cc6586cf-27j9h Burstable 20m 96Mi", "rc": 0 }, "res.node": { "cmd": "kubectl --context kind-ct-dk8s describe node ct-dk8s-worker | sed -n '/Allocated resources/,/Events/p' | head -14", "out": "Allocated resources:\n (Total limits may be over 100 percent, i.e., overcommitted.)\n Resource Requests Limits\n -------- -------- ------\n cpu 195m (4%) 700m (17%)\n memory 154Mi (0%) 306Mi (1%)\n ephemeral-storage 0 (0%) 0 (0%)\n hugepages-1Gi 0 (0%) 0 (0%)\n hugepages-2Mi 0 (0%) 0 (0%)\nEvents:", "rc": 0 }, "res.quota": { "cmd": "kubectl --context kind-ct-dk8s get resourcequota -n shopline -o wide; echo; kubectl --context kind-ct-dk8s describe resourcequota shopline-quota -n shopline | head -14", "out": "NAME REQUEST LIMIT AGE\nshopline-quota count/deployments.apps: 4/10, persistentvolumeclaims: 1/6, requests.cpu: 285m/2, requests.memory: 416Mi/2Gi limits.cpu: 2100m/4, limits.memory: 992Mi/4Gi 4m22s\n\nName: shopline-quota\nNamespace: shopline\nResource Used Hard\n-------- ---- ----\ncount/deployments.apps 4 10\nlimits.cpu 2100m 4\nlimits.memory 992Mi 4Gi\npersistentvolumeclaims 1 6\nrequests.cpu 285m 2\nrequests.memory 416Mi 2Gi", "rc": 0 }, "res.throttle": { "cmd": "kubectl --context kind-ct-dk8s apply -f /tmp/burner.yaml >/dev/null 2>&1;\n kubectl --context kind-ct-dk8s wait --for=condition=Ready pod/throttled -n sched-demo --timeout=90s >/dev/null 2>&1;\n echo '# a container asking for 2 CPUs, limited to 100m'; echo;\n echo '$ kubectl exec throttled -- cat /sys/fs/cgroup/cpu.max';\n kubectl --context kind-ct-dk8s exec throttled -n sched-demo -- cat /sys/fs/cgroup/cpu.max 2>&1;\n echo ' (10000 us of every 100000 us = 0.1 CPU)'; echo;\n echo 'letting it run for 20 seconds…'; sleep 20;\n echo; echo '$ kubectl exec throttled -- cat /sys/fs/cgroup/cpu.stat';\n kubectl --context kind-ct-dk8s exec throttled -n sched-demo -- cat /sys/fs/cgroup/cpu.stat 2>&1", "out": "# a container asking for 2 CPUs, limited to 100m\n\n$ kubectl exec throttled -- cat /sys/fs/cgroup/cpu.max\n10000 100000\n (10000 us of every 100000 us = 0.1 CPU)\n\nletting it run for 20 seconds…\n\n$ kubectl exec throttled -- cat /sys/fs/cgroup/cpu.stat\nusage_usec 2362694\nuser_usec 2301881\nsystem_usec 60813\ncore_sched.force_idle_usec 0\nnr_periods 236\nnr_throttled 230\nthrottled_usec 34045109\nnr_bursts 0\nburst_usec 0", "rc": 0 }, "res.oom": { "cmd": "POD=$(kubectl --context kind-ct-dk8s get pod -n shopline -l app=orders -o jsonpath='{.items[0].metadata.name}');\n echo \"asking $POD to retain more than its 64Mi limit\";\n kubectl --context kind-ct-dk8s run leaker -n shopline --rm -i --restart=Never --image=busybox:1.36 --quiet --overrides='{\"spec\":{\"securityContext\":{\"runAsNonRoot\":true,\"runAsUser\":65532,\"seccompProfile\":{\"type\":\"RuntimeDefault\"}},\"containers\":[{\"name\":\"l\",\"image\":\"busybox:1.36\",\"command\":[\"sh\",\"-c\",\"wget -qO- \\\"http://orders:8080/leak?mb=120\\\" || echo \\\"connection died - pod was killed mid-request\\\"\"],\"securityContext\":{\"allowPrivilegeEscalation\":false,\"capabilities\":{\"drop\":[\"ALL\"]}}}]}}' 2>&1 | tail -3;\n sleep 8;\n kubectl --context kind-ct-dk8s get pods -n shopline -l app=orders;\n echo '--- last state ---';\n kubectl --context kind-ct-dk8s get pods -n shopline -l app=orders -o jsonpath='{range .items[*]}{.metadata.name}{\" restarts=\"}{.status.containerStatuses[0].restartCount}{\" lastState=\"}{.status.containerStatuses[0].lastState.terminated.reason}{\" exitCode=\"}{.status.containerStatuses[0].lastState.terminated.exitCode}{\"\\n\"}{end}'", "out": "asking orders-9648fc664-6thkf to retain more than its 64Mi limit\nconnection died - pod was killed mid-request\nwget: error getting response\nNAME READY STATUS RESTARTS AGE\norders-9648fc664-6thkf 1/1 Running 0 4m42s\norders-9648fc664-zwqsj 1/1 Running 1 (11s ago) 4m42s\n--- last state ---\norders-9648fc664-6thkf restarts=0 lastState= exitCode=\norders-9648fc664-zwqsj restarts=1 lastState=OOMKilled exitCode=137", "rc": 0 }, "ro.update": { "cmd": "kubectl --context kind-ct-dk8s set image deploy/orders orders=ct.io/orders:v2 -n shopline >/dev/null;\n kubectl --context kind-ct-dk8s rollout status deploy/orders -n shopline --timeout=120s;\n kubectl --context kind-ct-dk8s get rs -n shopline -l app=orders", "out": "Waiting for deployment \"orders\" rollout to finish: 1 out of 2 new replicas have been updated...\nWaiting for deployment \"orders\" rollout to finish: 1 out of 2 new replicas have been updated...\nWaiting for deployment \"orders\" rollout to finish: 1 out of 2 new replicas have been updated...\nWaiting for deployment \"orders\" rollout to finish: 1 old replicas are pending termination...\nWaiting for deployment \"orders\" rollout to finish: 1 old replicas are pending termination...\ndeployment \"orders\" successfully rolled out\nNAME DESIRED CURRENT READY AGE\norders-74954989c9 2 2 2 15s\norders-9648fc664 0 0 0 4m57s", "rc": 0 }, "ro.history": { "cmd": "kubectl --context kind-ct-dk8s rollout history deploy/orders -n shopline", "out": "deployment.apps/orders\nREVISION CHANGE-CAUSE\n1 \n2 ", "rc": 0 }, "ro.undo": { "cmd": "kubectl --context kind-ct-dk8s rollout undo deploy/orders -n shopline; kubectl --context kind-ct-dk8s rollout status deploy/orders -n shopline --timeout=120s; kubectl --context kind-ct-dk8s get pods -n shopline -l app=orders", "out": "deployment.apps/orders rolled back\nWaiting for deployment \"orders\" rollout to finish: 0 out of 2 new replicas have been updated...\nWaiting for deployment \"orders\" rollout to finish: 1 out of 2 new replicas have been updated...\nWaiting for deployment \"orders\" rollout to finish: 1 out of 2 new replicas have been updated...\nWaiting for deployment \"orders\" rollout to finish: 1 out of 2 new replicas have been updated...\nWaiting for deployment \"orders\" rollout to finish: 1 old replicas are pending termination...\nWaiting for deployment \"orders\" rollout to finish: 1 old replicas are pending termination...\ndeployment \"orders\" successfully rolled out\nNAME READY STATUS RESTARTS AGE\norders-74954989c9-w82j8 1/1 Terminating 0 29s\norders-9648fc664-5hjrj 1/1 Running 0 7s\norders-9648fc664-z9xdh 1/1 Running 0 14s", "rc": 0 }, "ro.pdb": { "cmd": "kubectl --context kind-ct-dk8s get pdb -n shopline", "out": "NAME MIN AVAILABLE MAX UNAVAILABLE ALLOWED DISRUPTIONS AGE\ncatalog 2 N/A 1 5m12s\norders 1 N/A 1 5m11s", "rc": 0 }, "net.pods": { "cmd": "kubectl --context kind-ct-dk8s get pods -n shopline -o wide --no-headers | awk '{printf \"%-28s %-14s %s\\n\", $1, $6, $7}'", "out": "catalog-676d8988d8-4cvsh 10.244.3.2 ct-dk8s-worker\ncatalog-676d8988d8-s7ccg 10.244.2.3 ct-dk8s-worker2\ncatalog-676d8988d8-tdnkd 10.244.1.3 ct-dk8s-worker3\ngateway-7d57f855df-m9r75 10.244.3.4 ct-dk8s-worker\ngateway-7d57f855df-tkpd7 10.244.1.5 ct-dk8s-worker3\nnightly-reindex-29750175-25fqb 10.244.1.6 ct-dk8s-worker3\norders-74954989c9-w82j8 10.244.1.7 ct-dk8s-worker3\norders-9648fc664-5hjrj 10.244.2.5 ct-dk8s-worker2\norders-9648fc664-z9xdh 10.244.3.9 ct-dk8s-worker\npostgres-0 10.244.1.4 ct-dk8s-worker3\nredis-64cc6586cf-27j9h 10.244.2.2 ct-dk8s-worker2", "rc": 0 }, "net.svc": { "cmd": "kubectl --context kind-ct-dk8s get svc -n shopline", "out": "NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE\ncatalog ClusterIP 10.100.245.13 8080/TCP 5m13s\ngateway NodePort 10.98.7.205 80:30080/TCP 4m30s\norders ClusterIP 10.103.110.60 8080/TCP 5m12s\npostgres ClusterIP None 5432/TCP 5m13s\nredis ClusterIP 10.111.39.226 6379/TCP 5m13s", "rc": 0 }, "net.ep": { "cmd": "kubectl --context kind-ct-dk8s get endpointslices -n shopline -o custom-columns='NAME:.metadata.name,PORTS:.ports[*].port,ENDPOINTS:.endpoints[*].addresses' | head -10", "out": "NAME PORTS ENDPOINTS\ncatalog-5whxq 8080 [10.244.1.3],[10.244.2.3],[10.244.3.2]\ngateway-dlk9n 8080 [10.244.1.5],[10.244.3.4]\norders-9j48r 8080 [10.244.1.7],[10.244.3.9],[10.244.2.5]\npostgres-5w228 5432 [10.244.1.4]\nredis-422sw 6379 [10.244.2.2]", "rc": 0 }, "net.dns": { "cmd": "kubectl --context kind-ct-dk8s run dns2 -n shopline --rm -i --restart=Never --image=busybox:1.36 --quiet --overrides='{\"spec\":{\"securityContext\":{\"runAsNonRoot\":true,\"runAsUser\":65532,\"seccompProfile\":{\"type\":\"RuntimeDefault\"}},\"containers\":[{\"name\":\"d\",\"image\":\"busybox:1.36\",\"command\":[\"sh\",\"-c\",\"nslookup catalog; echo; cat /etc/resolv.conf\"],\"securityContext\":{\"allowPrivilegeEscalation\":false,\"capabilities\":{\"drop\":[\"ALL\"]}}}]}}' 2>&1 | head -22", "out": "Server:\t\t10.96.0.10\nAddress:\t10.96.0.10:53\n\n** server can't find catalog.svc.cluster.local: NXDOMAIN\n\nName:\tcatalog.shopline.svc.cluster.local\nAddress: 10.100.245.13\n\n** server can't find catalog.cluster.local: NXDOMAIN\n\n\n** server can't find catalog.cluster.local: NXDOMAIN\n\n** server can't find catalog.svc.cluster.local: NXDOMAIN\n\n\nsearch shopline.svc.cluster.local svc.cluster.local cluster.local\nnameserver 10.96.0.10\noptions ndots:5", "rc": 0 }, "net.iptables": { "cmd": "SVCIP=$(kubectl --context kind-ct-dk8s get svc catalog -n shopline -o jsonpath='{.spec.clusterIP}');\n echo \"catalog ClusterIP = $SVCIP\"; echo;\n docker exec ct-dk8s-worker iptables-save -t nat 2>/dev/null | grep \"$SVCIP\" | head -8", "out": "catalog ClusterIP = 10.100.245.13\n\n-A KUBE-SERVICES -d 10.100.245.13/32 -p tcp -m comment --comment \"shopline/catalog:http cluster IP\" -m tcp --dport 8080 -j KUBE-SVC-7ASELIGT75FRHZLO\n-A KUBE-SVC-7ASELIGT75FRHZLO ! -s 10.244.0.0/16 -d 10.100.245.13/32 -p tcp -m comment --comment \"shopline/catalog:http cluster IP\" -m tcp --dport 8080 -j KUBE-MARK-MASQ", "rc": 0 }, "net.rulecount": { "cmd": "docker exec ct-dk8s-worker sh -c 'iptables-save -t nat | wc -l' 2>/dev/null; echo 'services in cluster:'; kubectl --context kind-ct-dk8s get svc -A --no-headers | wc -l", "out": "124\nservices in cluster:\n7", "rc": 0 }, "net.hop": { "cmd": "kubectl --context kind-ct-dk8s run hop -n shopline --rm -i --restart=Never --image=busybox:1.36 --quiet --overrides='{\"spec\":{\"securityContext\":{\"runAsNonRoot\":true,\"runAsUser\":65532,\"seccompProfile\":{\"type\":\"RuntimeDefault\"}},\"containers\":[{\"name\":\"h\",\"image\":\"busybox:1.36\",\"command\":[\"sh\",\"-c\",\"for i in 1 2 3 4 5 6; do wget -qO- http://catalog:8080/ | grep -E \\\"^pod:\\\"; done\"],\"securityContext\":{\"allowPrivilegeEscalation\":false,\"capabilities\":{\"drop\":[\"ALL\"]}}}]}}' 2>&1 | head -10", "out": "pod: catalog-676d8988d8-s7ccg\npod: catalog-676d8988d8-tdnkd\npod: catalog-676d8988d8-tdnkd\npod: catalog-676d8988d8-4cvsh\npod: catalog-676d8988d8-4cvsh\npod: catalog-676d8988d8-4cvsh", "rc": 0 }, "net.gateway": { "cmd": "curl -s --max-time 6 http://127.0.0.1:31080/ ; echo '--- catalog via gateway ---'; curl -s --max-time 6 http://127.0.0.1:31080/api/catalog/items | head -16", "out": "shopline gateway\ntry /api/catalog/items or /api/orders/orders\n--- catalog via gateway ---\n{\n \"service\": \"catalog\",\n \"version\": \"v1\",\n \"pod\": \"catalog-676d8988d8-tdnkd\",\n \"currency\": \"USD\",\n \"items\": [\n {\n \"sku\": \"CT-1001\",\n \"name\": \"Espresso, single origin\",\n \"price\": 8.5\n },\n {\n \"sku\": \"CT-1002\",\n \"name\": \"Cold brew concentrate\",\n \"price\": 12.0\n },", "rc": 0 }, "np.before": { "cmd": "kubectl --context kind-ct-dk8s run probe-a -n shopline --rm -i --restart=Never --image=busybox:1.36 --quiet --overrides='{\"spec\":{\"securityContext\":{\"runAsNonRoot\":true,\"runAsUser\":65532,\"seccompProfile\":{\"type\":\"RuntimeDefault\"}},\"containers\":[{\"name\":\"p\",\"image\":\"busybox:1.36\",\"command\":[\"sh\",\"-c\",\"wget -qO- --timeout=4 http://catalog:8080/healthz && echo REACHABLE\"],\"securityContext\":{\"allowPrivilegeEscalation\":false,\"capabilities\":{\"drop\":[\"ALL\"]}}}]}}' 2>&1 | head -5", "out": "ok\nREACHABLE", "rc": 0 }, "np.apply": { "cmd": "kubectl --context kind-ct-dk8s apply -f /root/ct-dk8s-lab/lab/app/70-security.yaml 2>&1 | head -14; kubectl --context kind-ct-dk8s get netpol -n shopline", "out": "networkpolicy.networking.k8s.io/default-deny created\nnetworkpolicy.networking.k8s.io/allow-dns created\nnetworkpolicy.networking.k8s.io/gateway-to-backends created\nnetworkpolicy.networking.k8s.io/allow-gateway-ingress created\nnetworkpolicy.networking.k8s.io/backends-to-data created\nserviceaccount/catalog created\nrole.rbac.authorization.k8s.io/developer created\nrole.rbac.authorization.k8s.io/auditor created\nrolebinding.rbac.authorization.k8s.io/developer created\nrolebinding.rbac.authorization.k8s.io/auditor created\nNAME POD-SELECTOR AGE\nallow-dns 0s\nallow-gateway-ingress app=gateway 0s\nbackends-to-data app in (postgres,redis) 0s\ndefault-deny 0s\ngateway-to-backends app in (catalog,orders) 0s", "rc": 0 }, "np.after": { "cmd": "sleep 3; kubectl --context kind-ct-dk8s run probe-b -n shopline --rm -i --restart=Never --image=busybox:1.36 --quiet --overrides='{\"spec\":{\"securityContext\":{\"runAsNonRoot\":true,\"runAsUser\":65532,\"seccompProfile\":{\"type\":\"RuntimeDefault\"}},\"containers\":[{\"name\":\"p\",\"image\":\"busybox:1.36\",\"command\":[\"sh\",\"-c\",\"wget -qO- --timeout=5 http://catalog:8080/healthz || echo BLOCKED_BY_NETWORKPOLICY\"],\"securityContext\":{\"allowPrivilegeEscalation\":false,\"capabilities\":{\"drop\":[\"ALL\"]}}}]}}' 2>&1 | head -6", "out": "wget: download timed out\nBLOCKED_BY_NETWORKPOLICY", "rc": 0 }, "np.allowed": { "cmd": "curl -s --max-time 8 http://127.0.0.1:31080/api/catalog/items | head -8", "out": "{\n \"service\": \"catalog\",\n \"version\": \"v1\",\n \"pod\": \"catalog-676d8988d8-4cvsh\",\n \"currency\": \"USD\",\n \"items\": [\n {\n \"sku\": \"CT-1001\",", "rc": 0 }, "st.sc": { "cmd": "kubectl --context kind-ct-dk8s get storageclass", "out": "NAME PROVISIONER RECLAIMPOLICY VOLUMEBINDINGMODE ALLOWVOLUMEEXPANSION AGE\nstandard (default) rancher.io/local-path Delete WaitForFirstConsumer false 9m42s", "rc": 0 }, "st.pvpvc": { "cmd": "kubectl --context kind-ct-dk8s get pvc -n shopline; echo; kubectl --context kind-ct-dk8s get pv", "out": "NAME STATUS VOLUME CAPACITY ACCESS MODES STORAGECLASS VOLUMEATTRIBUTESCLASS AGE\ndata-postgres-0 Bound pvc-ee7a8d1c-c71c-4a55-b975-a0506153dfe2 1Gi RWO standard 5m37s\n\nNAME CAPACITY ACCESS MODES RECLAIM POLICY STATUS CLAIM STORAGECLASS VOLUMEATTRIBUTESCLASS REASON AGE\npvc-ee7a8d1c-c71c-4a55-b975-a0506153dfe2 1Gi RWO Delete Bound shopline/data-postgres-0 standard 5m33s", "rc": 0 }, "st.bind": { "cmd": "kubectl --context kind-ct-dk8s get pv -o custom-columns='PV:.metadata.name,CAPACITY:.spec.capacity.storage,RECLAIM:.spec.persistentVolumeReclaimPolicy,STATUS:.status.phase,CLAIM:.spec.claimRef.name'", "out": "PV CAPACITY RECLAIM STATUS CLAIM\npvc-ee7a8d1c-c71c-4a55-b975-a0506153dfe2 1Gi Delete Bound data-postgres-0", "rc": 0 }, "st.persist": { "cmd": "echo '# write a row, then destroy the pod holding the database';\n kubectl --context kind-ct-dk8s exec postgres-0 -n shopline -- psql -U catalog -d shopline -f /tmp/proof.sql 2>&1 | tail -8;\n echo;\n echo '$ kubectl delete pod postgres-0';\n kubectl --context kind-ct-dk8s delete pod postgres-0 -n shopline --wait=true >/dev/null 2>&1;\n kubectl --context kind-ct-dk8s wait --for=condition=Ready pod/postgres-0 -n shopline --timeout=180s >/dev/null 2>&1;\n echo 'postgres-0 rescheduled and Ready';\n echo;\n echo '# a brand new pod — same PersistentVolume';\n kubectl --context kind-ct-dk8s exec postgres-0 -n shopline -- psql -U catalog -d shopline -c 'SELECT id, note FROM proof;' 2>&1 | tail -8", "out": "# write a row, then destroy the pod holding the database\nCREATE TABLE\nINSERT 0 1\n id | note\n----+------------------------------------\n 1 | written before the pod was deleted\n(1 row)\n\n\n$ kubectl delete pod postgres-0\npostgres-0 rescheduled and Ready\n\n# a brand new pod — same PersistentVolume\n id | note\n----+------------------------------------\n 1 | written before the pod was deleted\n(1 row)", "rc": 0 }, "cfg.provenance": { "cmd": "POD=$(kubectl --context kind-ct-dk8s get pod -n shopline -l app=catalog -o jsonpath='{.items[0].metadata.name}'); kubectl --context kind-ct-dk8s exec $POD -n shopline -- python -c \"import urllib.request;print(urllib.request.urlopen('http://127.0.0.1:8080/config').read().decode())\" 2>&1 | head -12", "out": "setting value source\n----------------------- ------------------------ --------------------------\ngreeting catalog online configmap volume (live)\npage_size 4 configmap volume (live)\ncurrency USD configmap volume (live)\nfeature_recommendations off configmap volume (live)\ndb_password ******************* secret volume", "rc": 0 }, "cfg.live": { "cmd": "kubectl --context kind-ct-dk8s patch configmap catalog-config -n shopline --type merge -p '{\"data\":{\"catalog.conf\":\"greeting=catalog online (edited live)\\npage_size=2\\ncurrency=EUR\\nfeature_recommendations=on\\n\"}}' >/dev/null;\n echo 'patched. waiting for the kubelet to sync the volume…'; sleep 65;\n POD=$(kubectl --context kind-ct-dk8s get pod -n shopline -l app=catalog -o jsonpath='{.items[0].metadata.name}');\n kubectl --context kind-ct-dk8s exec $POD -n shopline -- cat /etc/catalog/catalog.conf 2>&1;\n echo '--- and the app sees it, with no restart ---';\n kubectl --context kind-ct-dk8s exec $POD -n shopline -- python -c \"import urllib.request;print(urllib.request.urlopen('http://127.0.0.1:8080/config').read().decode())\" 2>&1 | head -8;\n kubectl --context kind-ct-dk8s get pods -n shopline -l app=catalog --no-headers | awk '{print $1, \"restarts=\" $4}'", "out": "patched. waiting for the kubelet to sync the volume…\ngreeting=catalog online (edited live)\npage_size=2\ncurrency=EUR\nfeature_recommendations=on\n--- and the app sees it, with no restart ---\nsetting value source\n----------------------- ------------------------ --------------------------\ngreeting catalog online (edited live) configmap volume (live)\npage_size 2 configmap volume (live)\ncurrency EUR configmap volume (live)\nfeature_recommendations on configmap volume (live)\ndb_password ******************* secret volume\n\ncatalog-676d8988d8-4cvsh restarts=0\ncatalog-676d8988d8-s7ccg restarts=0\ncatalog-676d8988d8-tdnkd restarts=0", "rc": 0 }, "cfg.immutable": { "cmd": "kubectl --context kind-ct-dk8s patch configmap catalog-config-v1 -n shopline --type merge -p '{\"data\":{\"catalog.conf\":\"greeting=nope\\n\"}}' 2>&1 | head -4", "out": "The ConfigMap \"catalog-config-v1\" is invalid: data: Forbidden: field is immutable when `immutable` is set", "rc": 1 }, "cfg.secret": { "cmd": "kubectl --context kind-ct-dk8s get secret catalog-secret -n shopline -o jsonpath='{.data.password}'; echo; echo '--- decoded by anyone with get secrets ---'; kubectl --context kind-ct-dk8s get secret catalog-secret -n shopline -o jsonpath='{.data.password}' | base64 -d; echo", "out": "czNjcjN0LWxhYi1wYXNzd29yZA==\n--- decoded by anyone with get secrets ---\ns3cr3t-lab-password", "rc": 0 }, "sec.psa": { "cmd": "kubectl --context kind-ct-dk8s apply -n shopline -f - <<'EOF' 2>&1 | head -12\napiVersion: v1\nkind: Pod\nmetadata: {name: bad-pod}\nspec:\n containers:\n - name: c\n image: busybox:1.36\n command: ['sleep','60']\n securityContext: {privileged: true}\nEOF", "out": "Error from server (Forbidden): error when creating \"STDIN\": pods \"bad-pod\" is forbidden: violates PodSecurity \"restricted:latest\": privileged (container \"c\" must not set securityContext.privileged=true), allowPrivilegeEscalation != false (container \"c\" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container \"c\" must set securityContext.capabilities.drop=[\"ALL\"]), runAsNonRoot != true (pod or container \"c\" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container \"c\" must set securityContext.seccompProfile.type to \"RuntimeDefault\" or \"Localhost\")", "rc": 1 }, "sec.context": { "cmd": "POD=$(kubectl --context kind-ct-dk8s get pod -n shopline -l app=catalog -o jsonpath='{.items[0].metadata.name}');\n kubectl --context kind-ct-dk8s exec $POD -n shopline -- id 2>&1;\n kubectl --context kind-ct-dk8s get pod $POD -n shopline -o jsonpath='{.spec.containers[0].securityContext}' | python3 -m json.tool", "out": "uid=65532(app) gid=65532 groups=65532\n{\n \"allowPrivilegeEscalation\": false,\n \"capabilities\": {\n \"drop\": [\n \"ALL\"\n ]\n },\n \"readOnlyRootFilesystem\": true\n}", "rc": 0 }, "sec.rofs": { "cmd": "POD=$(kubectl --context kind-ct-dk8s get pod -n shopline -l app=catalog -o jsonpath='{.items[0].metadata.name}');\n kubectl --context kind-ct-dk8s exec $POD -n shopline -- sh -c 'touch /etc/pwned' 2>&1 | head -3;\n echo '--- but the emptyDir it was given IS writable ---';\n kubectl --context kind-ct-dk8s exec $POD -n shopline -- sh -c 'touch /tmp/fine && echo \"wrote /tmp/fine OK\"' 2>&1", "out": "touch: cannot touch '/etc/pwned': Read-only file system\ncommand terminated with exit code 1\n--- but the emptyDir it was given IS writable ---\nwrote /tmp/fine OK", "rc": 0 }, "sec.rbac": { "cmd": "printf '%-34s %s\\n' 'CHECK (as dev@cafetele.com)' 'ALLOWED';\n printf '%-34s %s\\n' '--------------------------------' '-------';\n for v in 'get pods' 'list deployments' 'patch deployments' 'delete deployments' 'get secrets' 'get pods --subresource=log'; do\n printf '%-34s %s\\n' \"kubectl auth can-i $v\" \"$(kubectl --context kind-ct-dk8s auth can-i $v -n shopline --as=dev@cafetele.com 2>&1)\";\n done;\n printf '%-34s %s\\n' 'kubectl auth can-i create pods --subresource=exec' \"$(kubectl --context kind-ct-dk8s auth can-i create pods --subresource=exec -n shopline --as=dev@cafetele.com 2>&1)\";\n echo;\n printf '%-34s %s\\n' 'CHECK (as audit@cafetele.com)' 'ALLOWED';\n printf '%-34s %s\\n' '--------------------------------' '-------';\n for v in 'get pods' 'get secrets' 'delete pods' 'create deployments'; do\n printf '%-34s %s\\n' \"kubectl auth can-i $v\" \"$(kubectl --context kind-ct-dk8s auth can-i $v -n shopline --as=audit@cafetele.com 2>&1)\";\n done", "out": "CHECK (as dev@cafetele.com) ALLOWED\n-------------------------------- -------\nkubectl auth can-i get pods yes\nkubectl auth can-i list deployments yes\nkubectl auth can-i patch deployments yes\nkubectl auth can-i delete deployments no\nkubectl auth can-i get secrets no\nkubectl auth can-i get pods --subresource=log yes\nkubectl auth can-i create pods --subresource=exec yes\n\nCHECK (as audit@cafetele.com) ALLOWED\n-------------------------------- -------\nkubectl auth can-i get pods yes\nkubectl auth can-i get secrets yes\nkubectl auth can-i delete pods no\nkubectl auth can-i create deployments no", "rc": 0 }, "sec.sa": { "cmd": "kubectl --context kind-ct-dk8s get sa -n shopline; echo; echo 'automountServiceAccountToken on catalog SA:'; kubectl --context kind-ct-dk8s get sa catalog -n shopline -o jsonpath='{.automountServiceAccountToken}'; echo", "out": "NAME SECRETS AGE\ncatalog 0 83s\ndefault 0 6m50s\n\nautomountServiceAccountToken on catalog SA:\nfalse", "rc": 0 }, "tr.imagepull": { "cmd": "kubectl --context kind-ct-dk8s run badimage -n shopline --image=ct.io/does-not-exist:v9 --restart=Never --overrides='{\"spec\":{\"securityContext\":{\"runAsNonRoot\":true,\"runAsUser\":65532,\"seccompProfile\":{\"type\":\"RuntimeDefault\"}},\"containers\":[{\"name\":\"badimage\",\"image\":\"ct.io/does-not-exist:v9\",\"securityContext\":{\"allowPrivilegeEscalation\":false,\"capabilities\":{\"drop\":[\"ALL\"]}}}]}}' >/dev/null 2>&1;\n sleep 12; kubectl --context kind-ct-dk8s get pod badimage -n shopline; echo; kubectl --context kind-ct-dk8s describe pod badimage -n shopline | sed -n '/Events:/,$p' | head -12", "out": "NAME READY STATUS RESTARTS AGE\nbadimage 0/1 ContainerCreating 0 12s\n\nEvents:\n Type Reason Age From Message\n ---- ------ ---- ---- -------\n Normal Scheduled 12s default-scheduler Successfully assigned shopline/badimage to ct-dk8s-worker2\n Normal Pulling 12s kubelet Pulling image \"ct.io/does-not-exist:v9\"", "rc": 0 }, "tr.crashloop": { "cmd": "kubectl --context kind-ct-dk8s run crasher -n shopline --image=busybox:1.36 --restart=Always --overrides='{\"spec\":{\"securityContext\":{\"runAsNonRoot\":true,\"runAsUser\":65532,\"seccompProfile\":{\"type\":\"RuntimeDefault\"}},\"containers\":[{\"name\":\"crasher\",\"image\":\"busybox:1.36\",\"command\":[\"sh\",\"-c\",\"echo starting up; echo \\\"FATAL: cannot read /etc/app/config.yaml\\\" >&2; exit 1\"],\"securityContext\":{\"allowPrivilegeEscalation\":false,\"capabilities\":{\"drop\":[\"ALL\"]}}}]}}' >/dev/null 2>&1;\n sleep 30; kubectl --context kind-ct-dk8s get pod crasher -n shopline;\n echo; echo '--- kubectl logs crasher (the CURRENT, not-yet-started container) ---';\n kubectl --context kind-ct-dk8s logs crasher -n shopline 2>&1 | head -4;\n echo; echo '--- kubectl logs crasher --previous (the one that actually died) ---';\n kubectl --context kind-ct-dk8s logs crasher -n shopline --previous 2>&1 | head -4;\n echo; echo '--- the backoff, in the events ---';\n kubectl --context kind-ct-dk8s describe pod crasher -n shopline | sed -n '/Events:/,$p' | head -10", "out": "NAME READY STATUS RESTARTS AGE\ncrasher 0/1 CrashLoopBackOff 2 (11s ago) 30s\n\n--- kubectl logs crasher (the CURRENT, not-yet-started container) ---\nstarting up\nFATAL: cannot read /etc/app/config.yaml\n\n--- kubectl logs crasher --previous (the one that actually died) ---\nstarting up\nFATAL: cannot read /etc/app/config.yaml\n\n--- the backoff, in the events ---\nEvents:\n Type Reason Age From Message\n ---- ------ ---- ---- -------\n Normal Scheduled 31s default-scheduler Successfully assigned shopline/crasher to ct-dk8s-worker\n Normal Pulled 12s (x3 over 30s) kubelet Container image \"busybox:1.36\" already present on machine\n Normal Created 12s (x3 over 30s) kubelet Created container: crasher\n Normal Started 12s (x3 over 30s) kubelet Started container crasher\n Warning BackOff 1s (x4 over 28s) kubelet Back-off restarting failed container crasher in pod crasher_shopline(3d62dea0-62ce-42b5-8b6d-6dc748ae62d9)", "rc": 0 }, "tr.events": { "cmd": "kubectl --context kind-ct-dk8s get events -n shopline --sort-by=.lastTimestamp -o custom-columns='TIME:.lastTimestamp,TYPE:.type,REASON:.reason,OBJECT:.involvedObject.name,MESSAGE:.message' | tail -22", "out": " Normal Scheduled probe-b Successfully assigned shopline/probe-b to ct-dk8s-worker\n Normal Created probe-b Created container: p\n Normal Pulled probe-b Container image \"busybox:1.36\" already present on machine\n Normal Started probe-b Started container p\n Warning FailedGetResourceMetric orders failed to get cpu utilization: unable to get metrics for resource cpu: unable to fetch metrics from resource metrics API: the server could not find the requested resource (get pods.metrics.k8s.io)\n Normal Scheduled badimage Successfully assigned shopline/badimage to ct-dk8s-worker2\n Normal Pulling badimage Pulling image \"ct.io/does-not-exist:v9\"\n Normal Scheduled crasher Successfully assigned shopline/crasher to ct-dk8s-worker\n Warning Failed badimage Error: ErrImagePull\n Warning Failed badimage Failed to pull image \"ct.io/does-not-exist:v9\": rpc error: code = DeadlineExceeded desc = failed to pull and unpack image \"ct.io/does-not-exist:v9\": failed to resolve reference \"ct.io/does-not-exist:v9\": failed to do request: Head \"https://ct.io/v2/does-not-exist/manifests/v9\": dial tcp 3.139.159.151:443: i/o timeout\n Warning Failed badimage Error: ImagePullBackOff\n Normal BackOff badimage Back-off pulling image \"ct.io/does-not-exist:v9\"\n Normal Started crasher Started container crasher\n Normal Created crasher Created container: crasher\n Normal Pulled crasher Container image \"busybox:1.36\" already present on machine\n Normal SuccessfulCreate nightly-reindex Created job nightly-reindex-29750180\n Normal SuccessfulCreate nightly-reindex-29750180 Created pod: nightly-reindex-29750180-vhdzs\n Normal Scheduled nightly-reindex-29750180-vhdzs Successfully assigned shopline/nightly-reindex-29750180-vhdzs to ct-dk8s-worker3\n Normal Created nightly-reindex-29750180-vhdzs Created container: reindex\n Normal Pulled nightly-reindex-29750180-vhdzs Container image \"busybox:1.36\" already present on machine\n Normal Started nightly-reindex-29750180-vhdzs Started container reindex\n Warning BackOff crasher Back-off restarting failed container crasher in pod crasher_shopline(3d62dea0-62ce-42b5-8b6d-6dc748ae62d9)", "rc": 0 }, "tr.svcdebug": { "cmd": "kubectl --context kind-ct-dk8s apply -n shopline -f - <<'EOF' >/dev/null\napiVersion: v1\nkind: Service\nmetadata: {name: catalog-typo}\nspec:\n selector: {app: catlog}\n ports: [{port: 8080, targetPort: 8080}]\nEOF\nsleep 3\nkubectl --context kind-ct-dk8s get svc catalog-typo -n shopline; echo; echo '--- endpoints: ---'; kubectl --context kind-ct-dk8s get endpointslices -n shopline -l kubernetes.io/service-name=catalog-typo; echo; echo 'compare with the working one:'; kubectl --context kind-ct-dk8s get endpointslices -n shopline -l kubernetes.io/service-name=catalog", "out": "NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE\ncatalog-typo ClusterIP 10.100.12.196 8080/TCP 3s\n\n--- endpoints: ---\nNAME ADDRESSTYPE PORTS ENDPOINTS AGE\ncatalog-typo-jd8hr IPv4 3s\n\ncompare with the working one:\nNAME ADDRESSTYPE PORTS ENDPOINTS AGE\ncatalog-5whxq IPv4 8080 10.244.1.3,10.244.2.3,10.244.3.2 7m35s", "rc": 0 }, "tr.kubelet": { "cmd": "docker exec ct-dk8s-worker journalctl -u kubelet --no-pager -n 12 2>/dev/null | cut -c1-120", "out": "Jul 25 20:19:36 ct-dk8s-worker kubelet[214]: I0725 20:19:36.192623 214 scope.go:117] \"RemoveContainer\" containerID=\"\nJul 25 20:19:37 ct-dk8s-worker kubelet[214]: I0725 20:19:37.199568 214 scope.go:117] \"RemoveContainer\" containerID=\"\nJul 25 20:19:37 ct-dk8s-worker kubelet[214]: I0725 20:19:37.200214 214 scope.go:117] \"RemoveContainer\" containerID=\"\nJul 25 20:19:37 ct-dk8s-worker kubelet[214]: E0725 20:19:37.200438 214 pod_workers.go:1301] \"Error syncing pod, skip\nJul 25 20:19:38 ct-dk8s-worker kubelet[214]: I0725 20:19:38.210573 214 scope.go:117] \"RemoveContainer\" containerID=\"\nJul 25 20:19:38 ct-dk8s-worker kubelet[214]: E0725 20:19:38.210748 214 pod_workers.go:1301] \"Error syncing pod, skip\nJul 25 20:19:53 ct-dk8s-worker kubelet[214]: I0725 20:19:53.314170 214 scope.go:117] \"RemoveContainer\" containerID=\"\nJul 25 20:19:54 ct-dk8s-worker kubelet[214]: I0725 20:19:54.254363 214 scope.go:117] \"RemoveContainer\" containerID=\"\nJul 25 20:19:54 ct-dk8s-worker kubelet[214]: I0725 20:19:54.254794 214 scope.go:117] \"RemoveContainer\" containerID=\"\nJul 25 20:19:54 ct-dk8s-worker kubelet[214]: E0725 20:19:54.254976 214 pod_workers.go:1301] \"Error syncing pod, skip\nJul 25 20:20:04 ct-dk8s-worker kubelet[214]: I0725 20:20:04.315527 214 scope.go:117] \"RemoveContainer\" containerID=\"\nJul 25 20:20:04 ct-dk8s-worker kubelet[214]: E0725 20:20:04.316010 214 pod_workers.go:1301] \"Error syncing pod, skip", "rc": 0 }, "ops.cordon": { "cmd": "kubectl --context kind-ct-dk8s cordon ct-dk8s-worker2; kubectl --context kind-ct-dk8s get nodes", "out": "node/ct-dk8s-worker2 cordoned\nNAME STATUS ROLES AGE VERSION\nct-dk8s-control-plane Ready control-plane 11m v1.33.1\nct-dk8s-worker Ready 11m v1.33.1\nct-dk8s-worker2 Ready,SchedulingDisabled 11m v1.33.1\nct-dk8s-worker3 Ready 11m v1.33.1", "rc": 0 }, "ops.drain": { "cmd": "echo '# before'; kubectl --context kind-ct-dk8s get pods -n shopline -o wide --no-headers | awk '{printf \"%-30s %s\\n\", $1, $7}' | sort -k2;\n echo; echo '$ kubectl drain ct-dk8s-worker2 --ignore-daemonsets --delete-emptydir-data';\n kubectl --context kind-ct-dk8s drain ct-dk8s-worker2 --ignore-daemonsets --delete-emptydir-data --timeout=150s 2>&1 | head -12;\n echo; echo '# after — nothing is left on worker2, and catalog never dropped below 2';\n kubectl --context kind-ct-dk8s get pods -n shopline -o wide --no-headers | awk '{printf \"%-30s %s\\n\", $1, $7}' | sort -k2;\n echo; kubectl --context kind-ct-dk8s get nodes", "out": "# before\npostgres-0 ct-dk8s-worker3\norders-9648fc664-z9xdh ct-dk8s-worker\norders-9648fc664-5hjrj ct-dk8s-worker2\nredis-64cc6586cf-27j9h ct-dk8s-worker2\ncatalog-676d8988d8-4cvsh ct-dk8s-worker\ngateway-7d57f855df-m9r75 ct-dk8s-worker\ncatalog-676d8988d8-s7ccg ct-dk8s-worker2\ncatalog-676d8988d8-tdnkd ct-dk8s-worker3\ngateway-7d57f855df-tkpd7 ct-dk8s-worker3\nnightly-reindex-29750180-vhdzs ct-dk8s-worker3\nnightly-reindex-29750185-p5qpm ct-dk8s-worker3\n\n$ kubectl drain ct-dk8s-worker2 --ignore-daemonsets --delete-emptydir-data\nnode/ct-dk8s-worker2 cordoned\nWarning: ignoring DaemonSet-managed Pods: kube-system/kindnet-dnxjp, kube-system/kube-proxy-zqb59\nevicting pod shopline/catalog-676d8988d8-s7ccg\nevicting pod shopline/orders-9648fc664-5hjrj\nevicting pod shopline/redis-64cc6586cf-27j9h\npod/redis-64cc6586cf-27j9h evicted\npod/orders-9648fc664-5hjrj evicted\npod/catalog-676d8988d8-s7ccg evicted\nnode/ct-dk8s-worker2 drained\n\n# after — nothing is left on worker2, and catalog never dropped below 2\npostgres-0 ct-dk8s-worker3\norders-9648fc664-z9xdh ct-dk8s-worker\nredis-64cc6586cf-kj7cx ct-dk8s-worker\norders-9648fc664-kthxd ct-dk8s-worker3\ncatalog-676d8988d8-4cvsh ct-dk8s-worker\ncatalog-676d8988d8-q6r6h ct-dk8s-worker\ngateway-7d57f855df-m9r75 ct-dk8s-worker\ncatalog-676d8988d8-tdnkd ct-dk8s-worker3\ngateway-7d57f855df-tkpd7 ct-dk8s-worker3\nnightly-reindex-29750180-vhdzs ct-dk8s-worker3\nnightly-reindex-29750185-p5qpm ct-dk8s-worker3\n\nNAME STATUS ROLES AGE VERSION\nct-dk8s-control-plane Ready control-plane 19m v1.33.1\nct-dk8s-worker Ready 18m v1.33.1\nct-dk8s-worker2 Ready,SchedulingDisabled 18m v1.33.1\nct-dk8s-worker3 Ready 18m v1.33.1", "rc": 0 }, "ops.uncordon": { "cmd": "kubectl --context kind-ct-dk8s uncordon ct-dk8s-worker2; kubectl --context kind-ct-dk8s get nodes -o custom-columns='NODE:.metadata.name,STATUS:.status.conditions[-1].type,SCHEDULABLE:.spec.unschedulable'", "out": "node/ct-dk8s-worker2 uncordoned\nNODE STATUS SCHEDULABLE\nct-dk8s-control-plane Ready \nct-dk8s-worker Ready \nct-dk8s-worker2 Ready \nct-dk8s-worker3 Ready ", "rc": 0 }, "ops.snapshot": { "cmd": "docker exec ct-dk8s-control-plane sh -c \"ETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/server.crt --key=/etc/kubernetes/pki/etcd/server.key snapshot save /tmp/etcd-backup.db\" 2>&1 | tail -4; docker exec ct-dk8s-control-plane sh -c \"ETCDCTL_API=3 etcdctl --write-out=table snapshot status /tmp/etcd-backup.db\" 2>&1 | tail -8", "out": "sh: 1: etcdctl: not found\nsh: 1: etcdctl: not found", "rc": 127 }, "ops.certs": { "cmd": "docker exec ct-dk8s-control-plane kubeadm certs check-expiration 2>/dev/null | head -16", "out": "[check-expiration] Reading configuration from the \"kubeadm-config\" ConfigMap in namespace \"kube-system\"...\n[check-expiration] Use 'kubeadm init phase upload-config --config your-config-file' to re-upload it.\n\nCERTIFICATE EXPIRES RESIDUAL TIME CERTIFICATE AUTHORITY EXTERNALLY MANAGED\nadmin.conf Jul 25, 2027 20:08 UTC 364d ca no\napiserver Jul 25, 2027 20:08 UTC 364d ca no\napiserver-etcd-client Jul 25, 2027 20:08 UTC 364d etcd-ca no\napiserver-kubelet-client Jul 25, 2027 20:08 UTC 364d ca no\ncontroller-manager.conf Jul 25, 2027 20:08 UTC 364d ca no\netcd-healthcheck-client Jul 25, 2027 20:08 UTC 364d etcd-ca no\netcd-peer Jul 25, 2027 20:08 UTC 364d etcd-ca no\netcd-server Jul 25, 2027 20:08 UTC 364d etcd-ca no\nfront-proxy-client Jul 25, 2027 20:08 UTC 364d front-proxy-ca no\nscheduler.conf Jul 25, 2027 20:08 UTC 364d ca no\nsuper-admin.conf Jul 25, 2027 20:08 UTC 364d ca no", "rc": 0 }, "etcd.endpoint": { "cmd": "kubectl --context kind-ct-dk8s -n kube-system exec etcd-ct-dk8s-control-plane -- sh -c 'ETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/server.crt --key=/etc/kubernetes/pki/etcd/server.key endpoint status -w table'", "out": "+------------------------+------------------+---------+---------+-----------+------------+-----------+------------+--------------------+--------+\n| ENDPOINT | ID | VERSION | DB SIZE | IS LEADER | IS LEARNER | RAFT TERM | RAFT INDEX | RAFT APPLIED INDEX | ERRORS |\n+------------------------+------------------+---------+---------+-----------+------------+-----------+------------+--------------------+--------+\n| https://127.0.0.1:2379 | b440e45667b0f9da | 3.5.21 | 5.9 MB | true | false | 2 | 3325 | 3325 | |\n+------------------------+------------------+---------+---------+-----------+------------+-----------+------------+--------------------+--------+", "rc": 0 }, "etcd.podkey": { "cmd": "kubectl --context kind-ct-dk8s -n kube-system exec etcd-ct-dk8s-control-plane -- sh -c 'ETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/server.crt --key=/etc/kubernetes/pki/etcd/server.key get /registry/pods/shopline --prefix --keys-only' | grep . | head -8", "out": "/registry/pods/shopline/catalog-676d8988d8-4cvsh\n/registry/pods/shopline/catalog-676d8988d8-s7ccg\n/registry/pods/shopline/catalog-676d8988d8-tdnkd\n/registry/pods/shopline/gateway-7d57f855df-m9r75\n/registry/pods/shopline/gateway-7d57f855df-tkpd7\n/registry/pods/shopline/nightly-reindex-29750175-25fqb\n/registry/pods/shopline/nightly-reindex-29750180-vhdzs\n/registry/pods/shopline/nightly-reindex-29750185-p5qpm", "rc": 0 }, "etcd.snapshot": { "cmd": "kubectl --context kind-ct-dk8s -n kube-system exec etcd-ct-dk8s-control-plane -- sh -c 'ETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/server.crt --key=/etc/kubernetes/pki/etcd/server.key snapshot save /tmp/etcd-backup.db' 2>&1 | tail -3; echo; kubectl --context kind-ct-dk8s -n kube-system exec etcd-ct-dk8s-control-plane -- sh -c 'ETCDCTL_API=3 etcdctl --write-out=table snapshot status /tmp/etcd-backup.db'", "out": "Snapshot saved at /tmp/etcd-backup.db\n{\"level\":\"info\",\"ts\":\"\",\"caller\":\"snapshot/v3_snapshot.go:88\",\"msg\":\"fetched snapshot\",\"endpoint\":\"https://127.0.0.1:2379\",\"size\":\"5.9 MB\",\"took\":\"now\"}\n{\"level\":\"info\",\"ts\":\"\",\"caller\":\"snapshot/v3_snapshot.go:97\",\"msg\":\"saved\",\"path\":\"/tmp/etcd-backup.db\"}\n\nDeprecated: Use `etcdutl snapshot status` instead.\n\n+----------+----------+------------+------------+\n| HASH | REVISION | TOTAL KEYS | TOTAL SIZE |\n+----------+----------+------------+------------+\n| 8549702d | 3093 | 1474 | 5.9 MB |\n+----------+----------+------------+------------+", "rc": 0 }, "etcd.revision": { "cmd": "kubectl --context kind-ct-dk8s -n kube-system exec etcd-ct-dk8s-control-plane -- sh -c 'ETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/server.crt --key=/etc/kubernetes/pki/etcd/server.key endpoint status --write-out=json' | python3 -c 'import json,sys; d=json.load(sys.stdin)[0][\"Status\"]; print(\"raft term: \", d[\"raftTerm\"]); print(\"revision: \", d[\"header\"][\"revision\"]); print(\"db size: \", round(d[\"dbSize\"]/1024/1024,1), \"MiB\"); print(\"db size in use:\", round(d[\"dbSizeInUse\"]/1024/1024,1), \"MiB\")'", "out": "raft term: 2\nrevision: 3094\ndb size: 5.6 MiB\ndb size in use: 2.8 MiB", "rc": 0 }, "sch.limitrange": { "cmd": "sed 's/namespace: sched-demo/namespace: shopline/' /tmp/too-big.yaml | kubectl --context kind-ct-dk8s apply -f - 2>&1 | head -6", "out": "The Pod \"too-big\" is invalid:\n* spec.containers[0].resources.requests: Invalid value: \"64\": must be less than or equal to cpu limit of 200m\n* spec.containers[0].resources.requests: Invalid value: \"4Gi\": must be less than or equal to memory limit of 128Mi", "rc": 1 }, "sec.whocan": { "cmd": "kubectl --context kind-ct-dk8s auth can-i --list -n shopline --as=dev@cafetele.com 2>&1 | head -12", "out": "Resources Non-Resource URLs Resource Names Verbs\npods/exec [] [] [create]\npods/portforward [] [] [create]\nselfsubjectreviews.authentication.k8s.io [] [] [create]\nselfsubjectaccessreviews.authorization.k8s.io [] [] [create]\nselfsubjectrulesreviews.authorization.k8s.io [] [] [create]\ndeployments.apps [] [] [get list watch patch update]\nconfigmaps [] [] [get list watch]\ndeployments [] [] [get list watch]\npods/log [] [] [get list watch]\npods [] [] [get list watch]\nreplicasets [] [] [get list watch]", "rc": 141 }, "st.samepvc": { "cmd": "kubectl --context kind-ct-dk8s get pvc -n shopline -o custom-columns='PVC:.metadata.name,STATUS:.status.phase,VOLUME:.spec.volumeName,AGE:.metadata.creationTimestamp';\n echo;\n kubectl --context kind-ct-dk8s get pod postgres-0 -n shopline -o custom-columns='POD:.metadata.name,CREATED:.metadata.creationTimestamp,NODE:.spec.nodeName'", "out": "PVC STATUS VOLUME AGE\ndata-postgres-0 Bound pvc-ee7a8d1c-c71c-4a55-b975-a0506153dfe2 \n\nPOD CREATED NODE\npostgres-0 ct-dk8s-worker3", "rc": 0 }, "res.throttle2": { "cmd": "sleep 20; kubectl --context kind-ct-dk8s exec throttled -n sched-demo -- cat /sys/fs/cgroup/cpu.stat 2>&1;\n echo; echo '# nr_throttled is the number of periods in which the kernel';\n echo '# stopped this container dead until the next 100ms window.';\n echo; kubectl --context kind-ct-dk8s top pod throttled -n sched-demo 2>&1 | head -3", "out": "usage_usec 4535868\nuser_usec 4459711\nsystem_usec 76157\ncore_sched.force_idle_usec 0\nnr_periods 453\nnr_throttled 447\nthrottled_usec 64821394\nnr_bursts 0\nburst_usec 0\n\n# nr_throttled is the number of periods in which the kernel\n# stopped this container dead until the next 100ms window.\n\nerror: Metrics API not available", "rc": 1 }, "hpa.state": { "cmd": "kubectl --context kind-ct-dk8s get hpa -n shopline; echo; kubectl --context kind-ct-dk8s describe hpa orders -n shopline | sed -n '/Metrics:/,/Events:/p' | head -12", "out": "NAME REFERENCE TARGETS MINPODS MAXPODS REPLICAS AGE\norders Deployment/orders cpu: /60% 2 8 2 15m\n\nMetrics: ( current / target )\n resource cpu on pods (as a percentage of request): / 60%\nMin replicas: 2\nMax replicas: 8\nBehavior:\n Scale Up:\n Stabilization Window: 0 seconds\n Select Policy: Max\n Policies:\n - Type: Percent Value: 100 Period: 15 seconds\n Scale Down:\n Stabilization Window: 180 seconds", "rc": 0 }, "ref.jsonpath": { "cmd": "echo '$ kubectl get pods -o jsonpath=…';\n kubectl --context kind-ct-dk8s get pods -n shopline -o jsonpath='{range .items[*]}{.metadata.name}{\"\\t\"}{.status.podIP}{\"\\t\"}{.spec.nodeName}{\"\\n\"}{end}' | head -10", "out": "$ kubectl get pods -o jsonpath=…\ncatalog-676d8988d8-4cvsh\t10.244.3.2\tct-dk8s-worker\ncatalog-676d8988d8-q6r6h\t10.244.3.15\tct-dk8s-worker\ncatalog-676d8988d8-tdnkd\t10.244.1.3\tct-dk8s-worker3\ngateway-7d57f855df-m9r75\t10.244.3.4\tct-dk8s-worker\ngateway-7d57f855df-tkpd7\t10.244.1.5\tct-dk8s-worker3\nnightly-reindex-29750180-vhdzs\t10.244.1.8\tct-dk8s-worker3\nnightly-reindex-29750185-p5qpm\t10.244.1.9\tct-dk8s-worker3\norders-9648fc664-kthxd\t10.244.1.11\tct-dk8s-worker3\norders-9648fc664-z9xdh\t10.244.3.9\tct-dk8s-worker\npostgres-0\t10.244.1.10\tct-dk8s-worker3", "rc": 0 }, "ref.dryrun": { "cmd": "kubectl --context kind-ct-dk8s create deployment demo --image=nginx:1.27-alpine --replicas=3 --dry-run=client -o yaml | head -28", "out": "apiVersion: apps/v1\nkind: Deployment\nmetadata:\n creationTimestamp: null\n labels:\n app: demo\n name: demo\nspec:\n replicas: 3\n selector:\n matchLabels:\n app: demo\n strategy: {}\n template:\n metadata:\n creationTimestamp: null\n labels:\n app: demo\n spec:\n containers:\n - image: nginx:1.27-alpine\n name: nginx\n resources: {}\nstatus: {}", "rc": 0 }, "ref.diff": { "cmd": "kubectl --context kind-ct-dk8s get deploy catalog -n shopline -o yaml > /tmp/catalog.yaml;\n sed 's/replicas: 3/replicas: 5/' /tmp/catalog.yaml > /tmp/catalog2.yaml;\n kubectl --context kind-ct-dk8s diff -f /tmp/catalog2.yaml 2>&1 | head -18; echo '(exit 1 simply means: there IS a difference)'", "out": "diff -u -N /tmp/LIVE-2821529640/apps.v1.Deployment.shopline.catalog /tmp/MERGED-1432799729/apps.v1.Deployment.shopline.catalog\n--- /tmp/LIVE-2821529640/apps.v1.Deployment.shopline.catalog\t2026-07-25 20:28:18.003697855 +0000\n+++ /tmp/MERGED-1432799729/apps.v1.Deployment.shopline.catalog\t2026-07-25 20:28:18.004697849 +0000\n@@ -6,7 +6,7 @@\n kubectl.kubernetes.io/last-applied-configuration: |\n {\"apiVersion\":\"apps/v1\",\"kind\":\"Deployment\",\"metadata\":{\"annotations\":{},\"labels\":{\"app\":\"catalog\",\"tier\":\"backend\"},\"name\":\"catalog\",\"namespace\":\"shopline\"},\"spec\":{\"replicas\":3,\"revisionHistoryLimit\":5,\"selector\":{\"matchLabels\":{\"app\":\"catalog\"}},\"strategy\":{\"rollingUpdate\":{\"maxSurge\":1,\"maxUnavailable\":0},\"type\":\"RollingUpdate\"},\"template\":{\"metadata\":{\"annotations\":{\"ct.io/config-revision\":\"1\"},\"labels\":{\"app\":\"catalog\",\"tier\":\"backend\"}},\"spec\":{\"containers\":[{\"env\":[{\"name\":\"APP_VERSION\",\"value\":\"v1\"},{\"name\":\"POD_IP\",\"valueFrom\":{\"fieldRef\":{\"fieldPath\":\"status.podIP\"}}},{\"name\":\"NODE_NAME\",\"valueFrom\":{\"fieldRef\":{\"fieldPath\":\"spec.nodeName\"}}},{\"name\":\"CONFIG_FILE\",\"value\":\"/etc/catalog/catalog.conf\"},{\"name\":\"DB_PASSWORD_FILE\",\"value\":\"/etc/catalog-secret/password\"}],\"image\":\"ct.io/catalog:v1\",\"imagePullPolicy\":\"IfNotPresent\",\"lifecycle\":{\"preStop\":{\"exec\":{\"command\":[\"sleep\",\"5\"]}}},\"livenessProbe\":{\"failureThreshold\":3,\"httpGet\":{\"path\":\"/healthz\",\"port\":\"http\"},\"periodSeconds\":10,\"timeoutSeconds\":2},\"name\":\"catalog\",\"ports\":[{\"containerPort\":8080,\"name\":\"http\"}],\"readinessProbe\":{\"failureThreshold\":2,\"httpGet\":{\"path\":\"/readyz\",\"port\":\"http\"},\"periodSeconds\":5,\"timeoutSeconds\":2},\"resources\":{\"limits\":{\"memory\":\"128Mi\"},\"requests\":{\"cpu\":\"25m\",\"memory\":\"48Mi\"}},\"securityContext\":{\"allowPrivilegeEscalation\":false,\"capabilities\":{\"drop\":[\"ALL\"]},\"readOnlyRootFilesystem\":true},\"startupProbe\":{\"failureThreshold\":30,\"httpGet\":{\"path\":\"/healthz\",\"port\":\"http\"},\"periodSeconds\":2},\"volumeMounts\":[{\"mountPath\":\"/etc/catalog\",\"name\":\"config\",\"readOnly\":true},{\"mountPath\":\"/etc/catalog-secret\",\"name\":\"secret\",\"readOnly\":true},{\"mountPath\":\"/tmp\",\"name\":\"tmp\"}]}],\"securityContext\":{\"runAsGroup\":65532,\"runAsNonRoot\":true,\"runAsUser\":65532,\"seccompProfile\":{\"type\":\"RuntimeDefault\"}},\"terminationGracePeriodSeconds\":30,\"topologySpreadConstraints\":[{\"labelSelector\":{\"matchLabels\":{\"app\":\"catalog\"}},\"maxSkew\":1,\"topologyKey\":\"topology.kubernetes.io/zone\",\"whenUnsatisfiable\":\"ScheduleAnyway\"}],\"volumes\":[{\"configMap\":{\"name\":\"catalog-config\"},\"name\":\"config\"},{\"name\":\"secret\",\"secret\":{\"secretName\":\"catalog-secret\"}},{\"emptyDir\":{\"sizeLimit\":\"16Mi\"},\"name\":\"tmp\"}]}}}}\n creationTimestamp: \"\"\n- generation: 1\n+ generation: 2\n labels:\n app: catalog\n tier: backend\n@@ -16,7 +16,7 @@\n uid: ca613d3d-d8c4-4191-90ad-bb15890cd853\n spec:\n progressDeadlineSeconds: 600\n- replicas: 3\n+ replicas: 5\n(exit 1 simply means: there IS a difference)", "rc": 0 } };