> ## Content Index > Fetch the complete content index at: https://www.sredevops.org/llms.txt > Use this file to discover other available public pages before exploring further. # Check Kubernetes with Popeye! Security, configs, problems, scores and more with an open source and lightweight CLI tool - URL: https://www.sredevops.org/en/check-kubernetes-with-popeye-security-configs-problems-scores-and-more-with-an-open-source-and-lightweight-cli-tool/ - Published: 2024-07-08T10:30:00.000Z - Updated: 2024-07-08T11:20:45.000Z - Author: NicolΓ‘s Georger - Tags: Kubernetes, #en, Security, DevSecOps, #home, Open Source, Apps, DevOps, English, SRE ## TL/DR; Tired of manually combing through your Kubernetes cluster for issues? Popeye is like a health check-up for your cluster, finding potential problems with your configurations and resource usage. It's a command-line tool that scans your live cluster, not just static files, and points out things like misconfigurations, unused resources, and even potential resource over-allocations. It's read-only, so it won't touch your cluster, just give you a friendly (or maybe not-so-friendly, depending on your cluster's health) report. You can even get fancy with different output formats (JSON, HTML, you name it), send reports to S3, and integrate it with Prometheus and Grafana for ongoing monitoring. ![](https://popeyecli.io/assets/screens/console.png) ## Why You Need a Kubernetes Linter Like Popeye Let's face it, Kubernetes is awesome for orchestrating your containerized applications. However, as your deployments grow, so does the complexity. Suddenly, you're drowning in a sea of YAML files, wondering if that `Service` in the `default` namespace is *actually* talking to your `Pod`, or if that `PersistentVolumeClaim` from a deleted project is still hanging around like a bad smell. That's where Popeye comes in, flexing its spinach-powered muscles to give your cluster a thorough checkup. ### Popeye to the Rescue! Popeye dives into your *live* cluster, inspecting your resources as they're actually running. This isn't just some dry-run static analysis tool. It's the real deal, looking for common problems that can trip you up: - **Misconfigurations:** Are your container port mappings correct? Do your `Pod` labels match your `Service` selectors? - **Resource Usage:** Popeye can even tap into your metrics server (if you're using one) and warn you about potential CPU or memory over-allocations *before* your cluster throws in the towel. - **Stale Resources:** Remember that `Namespace` you thought you deleted months ago? Popeye will find it. Those unused `Secrets`? Yep, it'll flag those too. - **Security Best Practices:** Popeye can help you catch things like Pods running as root, missing resource limits, and other security gotchas. ![](https://popeyecli.io/assets/screens/html.png) ## **Installation** You've got options! *~~(Yay! fuN!)~~* Download binaries, use `brew install`, or `go install` if you're a Go aficionado. ```bash brew install derailed/popeye/popeye ``` ```bash go install github.com/derailed/popeye@latest ``` ## Getting Started with Popeye **Interpreting the Report:** Popeye color-codes its findings to give you a clear picture of your cluster's health: - **βœ… OK:** Everything looks good! - **πŸ”Š Info:** Just some FYI messages. - **😱 Warn:** Potential issues that you might want to look into. - **πŸ’₯ Error:** Action required! These are problems that need fixing. **Level Up with Prometheus and Grafana:** Integrate Popeye with Prometheus to collect metrics and visualize your cluster's health over time in Grafana. You can even set up alerts so you're notified when Popeye finds something fishy. ![](https://github.com/sredevopsorg/popeye/raw/master/assets/screens/pop-dash.png) ### **Customizing Scans (Spinach, Anyone?)** You can fine-tune Popeye's behavior using a `spinach.yaml` configuration file. Want to adjust resource utilization thresholds, exclude specific resources, or even override the severity of certain checks? Spinach has got you covered! ```yaml popeye: allocations: cpu: overPercUtilization: 70 # Trigger a warning if CPU utilization goes above 70% ``` **Run the Scan:** Popeye works right out of the box. Just point it at your cluster: ```bash popeye ``` Want to scan a specific namespace? No problem: ```bash popeye -n my-awesome-app ``` ### Popeye in Action: A Practical Example Let's say you're running a web app in your cluster. You've got a `Deployment`, a `Service`, and a few other resources. You run Popeye, and it spits out the following: ```log 😱 WARN po Pods default/my-awesome-app-7c94985768-x5fzk Container 'my-awesome-app' has no resource requests or limits defined! ``` Uh oh! Looks like you forgot to set resource limits on your `Pod`. This means your app could potentially consume all the resources on your node, starving out other applications. Time to update that YAML file! ## Keep Your Cluster Healthy with Popeye Popeye is an essential tool for anyone running Kubernetes. It's like having a Kubernetes expert constantly looking over your shoulder, pointing out potential issues before they turn into major headaches. So, add Popeye to your toolbox and start giving your cluster the health checks it deserves! ## Useful Links - [Popeye GitHub Repository](https://github.com/derailed/popeye?ref=sredevops.org) [GitHub - derailed/popeye: πŸ‘€ A Kubernetes cluster resource sanitizerπŸ‘€ A Kubernetes cluster resource sanitizer. Contribute to derailed/popeye development by creating an account on GitHub.![](https://github.githubassets.com/assets/pinned-octocat-093da3e6fa40.svg)GitHubderailed![](https://repository-images.githubusercontent.com/176379662/c23cb480-3267-11ea-9bae-e0737521678e)](https://github.com/derailed/popeye?ref=sredevops.org) - [Official website](https://popeyecli.io/?ref=sredevops.org) [popeyeπŸ‘€ A Kubernetes cluster resource sanitizerpopeye![](https://github.com/derailed/popeye/raw/master/assets/popeye_logo.png)](https://popeyecli.io/?ref=sredevops.org) ### Some of the available linters | | K8s Resource | Linters | Aliases | | -- | ----------------------- | ----------------------------------------------------------------------- | ---------- | | πŸ›€ | Node | | no | | | | Conditions ie not ready, out of mem/disk, network, pids, etc | | | | | Pod tolerations referencing node taints | | | | | CPU/MEM utilization metrics, trips if over limits (default 80% CPU/MEM) | | | πŸ›€ | Namespace | | ns | | | | Inactive | | | | | Dead namespaces | | | πŸ›€ | Pod | | po | | | | Pod status | | | | | Containers statuses | | | | | ServiceAccount presence | | | | | CPU/MEM on containers over a set CPU/MEM limit (default 80% CPU/MEM) | | | | | Container image with no tags | | | | | Container image using latest tag | | | | | Resources request/limits presence | | | | | Probes liveness/readiness presence | | | | | Named ports and their references | | | πŸ›€ | Service | | svc | | | | Endpoints presence | | | | | Matching pods labels | | | | | Named ports and their references | | | πŸ›€ | ServiceAccount | | sa | | | | Unused, detects potentially unused SAs | | | πŸ›€ | Secrets | | sec | | | | Unused, detects potentially unused secrets or associated keys | | | πŸ›€ | ConfigMap | | cm | | | | Unused, detects potentially unused cm or associated keys | | | πŸ›€ | Deployment | | dp, deploy | | | | Unused, pod template validation, resource utilization | | | πŸ›€ | StatefulSet | | sts | | | | Unused, pod template validation, resource utilization | | | πŸ›€ | DaemonSet | | ds | | | | Unused, pod template validation, resource utilization | | | πŸ›€ | PersistentVolume | | pv | | | | Unused, check volume bound or volume error | | | πŸ›€ | PersistentVolumeClaim | | pvc | | | | Unused, check bounded or volume mount error | | | πŸ›€ | HorizontalPodAutoscaler | | hpa | | | | Unused, Utilization, Max burst checks | | | πŸ›€ | PodDisruptionBudget | | | | | | Unused, Check minAvailable configuration | pdb | | πŸ›€ | ClusterRole | | | | | | Unused | cr | | πŸ›€ | ClusterRoleBinding | | | | | | Unused | crb | | πŸ›€ | Role | | | | | | Unused | ro | | πŸ›€ | RoleBinding | | | | | | Unused | rb | | πŸ›€ | Ingress | | | | | | Valid | ing | | πŸ›€ | NetworkPolicy | | | | | | Valid, Stale, Guarded | np | | πŸ›€ | PodSecurityPolicy | | | | | | Valid | psp | | πŸ›€ | Cronjob | | | | | | Valid, Suspended, Runs | cj | | πŸ›€ | Job | | | | | | Pod checks | job | | πŸ›€ | GatewayClass | | | | | | Valid, Unused | gwc | | πŸ›€ | Gateway | | | | | | Valid, Unused | gw | | πŸ›€ | HTTPRoute | | | | | | Valid, Unused | gwr | ###