当前位置：首页 > 软件库 > 云计算 > 云原生 >

kube-score

授权协议 MIT License

开发语言 Google Go

所属分类云计算、云原生

软件类型开源软件

地区不详

投递者慕佑运

操作系统跨平台

开源组织无

适用人群未知

软件概览

kube-score

kube-score is a tool that performs static code analysis of your Kubernetes object definitions.

The output is a list of recommendations of what you can improve to make your application more secure and resilient.

You can test kube-score out in the browser with the online demo (source).

Installation

kube-score is easy to install, and is available from the following sources:

Distribution	Command / Link
Pre-built binaries for macOS, Linux, and Windows	GitHub releases
Docker	`docker pull zegl/kube-score` (Docker Hub)
Homebrew (macOS and Linux)	`brew install kube-score/tap/kube-score`
Krew (macOS and Linux)	`kubectl krew install score`

Checks

For a full list of checks, see README_CHECKS.md.

Container limits (should be set)
Pod is targeted by a NetworkPolicy, both egress and ingress rules are recommended
Deployments and StatefulSets should have a PodDisruptionPolicy
Deployments and StatefulSets should have host PodAntiAffinity configured
Container probes, a readiness should be configured, and should not be identical to the liveness probe. Read more in README_PROBES.md.
Container securityContext, run as high number user/group, do not run as root or with privileged root fs. Read more in README_SECURITYCONTEXT.md.
Stable APIs, use a stable API if available (supported: Deployments, StatefulSets, DaemonSet)

Example output

Usage in CI

kube-score can run in your CI/CD environment and will exit with exit code 1 if a critical error has been found.The trigger level can be changed to warning with the --exit-one-on-warning argument.

The input to kube-score should be all applications that you deploy to the same namespace for the best result.

Example with Helm

helm template my-app | kube-score score -

Example with Kustomize

kustomize build . | kube-score score -

Example with static YAMLs

kube-score score my-app/*.yaml

kube-score score my-app/deployment.yaml my-app/service.yaml

Example with an existing cluster

kubectl api-resources --verbs=list --namespaced -o name \
  | xargs -n1 -I{} bash -c "kubectl get {} --all-namespaces -oyaml && echo ---" \
  | kube-score score -

Example with Docker

docker run -v $(pwd):/project zegl/kube-score:v1.10.0 score my-app/*.yaml

Configuration

Usage of kube-score:
kube-score [action] --flags

Actions:
	score	Checks all files in the input, and gives them a score and recommendations
	list	Prints a CSV list of all available score checks
	version	Print the version of kube-score
	help	Print this message

Flags for score:
      --disable-ignore-checks-annotations   Set to true to disable the effect of the 'kube-score/ignore' annotations
      --enable-optional-test strings        Enable an optional test, can be set multiple times
      --exit-one-on-warning                 Exit with code 1 in case of warnings
      --help                                Print help
      --ignore-container-cpu-limit          Disables the requirement of setting a container CPU limit
      --ignore-container-memory-limit       Disables the requirement of setting a container memory limit
      --ignore-test strings                 Disable a test, can be set multiple times
      --kubernetes-version string           Setting the kubernetes-version will affect the checks ran against the manifests. Set this to the version of Kubernetes that you're using in production for the best results. (default "v1.18")
  -o, --output-format string                Set to 'human', 'json' or 'ci'. If set to ci, kube-score will output the program in a format that is easier to parse by other programs. (default "human")
      --output-version string               Changes the version of the --output-format. The 'json' format has version 'v2' (default) and 'v1' (deprecated, will be removed in v1.7.0). The 'human' and 'ci' formats has only version 'v1' (default). If not explicitly set, the default version for that particular output format will be used.
  -v, --verbose count                       Enable verbose output, can be set multiple times for increased verbosity.

Ignoring a test

Tests can be ignored in the whole run of the program, with the --ignore-test flag.

A test can also be ignored on a per-object basis, by adding the annotation kube-score/ignore to the object.The value should be a comma separated string of the test IDs.

Example:

Testing this object will temporarily disable the service-type test, which warns against using services of type NodePort.

apiVersion: v1
kind: Service
metadata:
  name: node-port-service-with-ignore
  namespace: foospace
  annotations:
    kube-score/ignore: service-type
spec:
  selector:
    app: my-app
  ports:
  - protocol: TCP
    port: 80
    targetPort: 8080
  type: NodePort

Building from source

kube-score requires Go 1.11 or later to build. Clone this repository, and then:

# Build the project
go build github.com/zegl/kube-score/cmd/kube-score

# Run all tests
go test -v github.com/zegl/kube-score/...

Contributing?

Do you want to help out? Take a look at the Contributing Guidelines for more info. ��

使用案例

kube-scheduler 配置文件及插件

kube-scheduler是k8s的一个核心组件，其主要功能是为刚创建的pod(nodename为空)选择一个合适的node。工作流程大概为：kube-scheduler会使用informer机制监听pod资源变化(除了监听pod，也会监听node, pv等，这里先关注pod)，如果发现pod的pod.Spec.NodeName字段为空，表示此pod还没有被分配node(如果用户指定pod.S
Kube-Scheduler配置与源码分析

scheduler配置与源码分析配置参数启动参数在kubernetes中，组件的配置文件格式都推荐使用yaml格式，scheduler也不例外。下面是scheduler启动时所需要的全局配置类。 // scheduler的全局配置 type Options struct { // The default values. These are overridden if ConfigFile
kube-scheduler的Extender解析

前言 kube-scheduler基于Kubernetes管理的资源（比如CPU、内存、PV等）进行调度，但是，当需要对在Kubernetes外部管理的资源进行调度时，在Extender之前没有任何机制可以做到这一点。有一种方法可以让kubernetes具有扩展性，就是增加HTTP调度扩展程序。有三种方法可以向kube-scheduler添加新的调度规则：更新现有的或添加新的调度插件并重新编译
kube-proxy源码阅读分析

Version: Kubernetes 1.13 前言 Kubernetes每个Node上运行Kube-proxy做网络代理，用来实现Kubernetes中的service与pod之间的流量转发。本文将对Kube-Proxy的源码进行阅读，看看Kube-Proxy具体的实现逻辑。其中关于Kube-Proxy的实现原理可以参考： https://kubernetes.io/docs/concept
kube-scheduler framework

调度框架用来保存配置的插件，并在调度算法中被执行遍历插件，其实现了如下接口 type Framework interface { //提供了插件获取调度框架里数据的接口和抢占接口，见下面注释 Handle //返回排序函数，用在调度队列中，用来给pod排序 QueueSortFunc() LessFunc //用来执行配置的PreFilter插件 RunPreFilterPlugi
【kubernetes/k8s概念】kube-proxy启动参数

kubernetes 1.12.1版本 Desc The Kubernetes network proxy runs on each node. This reflects services as defined in the Kubernetes API on each node and can do simple TCP, UDP, and SCTP stream forwar

kube-score

kube-score

Installation

Checks

Example output

Usage in CI

Example with Helm

Example with Kustomize

Example with static YAMLs

Example with an existing cluster

Example with Docker

Configuration

Ignoring a test

Building from source

Contributing?

同类工具

相关阅读

相关文章

相关问答

相关文档