Amazon EKS, dalla teoria al runbook

aws sts get-caller-identity

aws eks describe-cluster --name a-4510-eks-mil-cluster-p-01 --region eu-south-1 \
  --query 'cluster.{arn:arn,role:roleArn,oidc:identity.oidc.issuer,version:version,platform:platformVersion}' --output table

aws iam list-roles --query 'Roles[?contains(RoleName,`4510`)].[RoleName,Arn]' --output table

aws ec2 modify-instance-metadata-options --instance-id i-0abc123 \
  --http-tokens required --http-put-response-hop-limit 1 --region eu-south-1

aws iam get-role --role-name a-4510-iam-mil-clusterrole-p-01 --query 'Role.AssumeRolePolicyDocument'

aws iam list-attached-role-policies --role-name a-4510-iam-mil-clusterrole-p-01 --output table
aws iam list-role-policies --role-name a-4510-iam-mil-clusterrole-p-01

aws iam simulate-principal-policy \
  --policy-source-arn arn:aws:iam::122610509347:role/a-4510-eks-mil-cluster-p-01-EBSCSIController \
  --action-names ec2:CreateVolume ec2:AttachVolume \
  --query 'EvaluationResults[].{action:EvalActionName,decision:EvalDecision}' --output table

aws eks describe-cluster --name a-4510-eks-mil-cluster-p-01 --region eu-south-1 \
  --query 'cluster.identity.oidc.issuer' --output text
aws iam list-open-id-connect-providers

eksctl utils associate-iam-oidc-provider --cluster a-4510-eks-mil-cluster-p-01 --region eu-south-1 --approve

eksctl create iamserviceaccount \
  --cluster a-4510-eks-mil-cluster-p-01 --region eu-south-1 \
  --namespace app-prod --name s3-reader \
  --attach-policy-arn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess \
  --role-name a-4510-iam-mil-s3reader-p-01 \
  --approve

kubectl -n app-prod exec deploy/mia-app -- env | grep AWS_

kubectl -n app-prod run awscli --rm -it --restart=Never \
  --overrides='{"spec":{"serviceAccountName":"s3-reader"}}' \
  --image=amazon/aws-cli:latest -- sts get-caller-identity

aws eks list-nodegroups --cluster-name a-4510-eks-mil-cluster-p-01 --region eu-south-1 --output table

aws eks describe-nodegroup --cluster-name a-4510-eks-mil-cluster-p-01 \
  --nodegroup-name a-4510-eks-mil-mainworkers-p-01 --region eu-south-1 \
  --query 'nodegroup.{k8s:version,ami:releaseVersion,amiType:amiType,type:instanceTypes,cap:capacityType,scaling:scalingConfig,subnets:subnets,role:nodeRole,health:health.issues}'

for ng in $(aws eks list-nodegroups --cluster-name a-4510-eks-mil-cluster-p-01 --region eu-south-1 --query 'nodegroups[]' --output text); do
  aws eks describe-nodegroup --cluster-name a-4510-eks-mil-cluster-p-01 --nodegroup-name $ng --region eu-south-1 \
    --query "nodegroup.[nodegroupName,version,releaseVersion,amiType,scalingConfig.desiredSize,status]" --output text
done

kubectl get nodes -L eks.amazonaws.com/nodegroup,topology.kubernetes.io/zone,node.kubernetes.io/instance-type -o wide

kubectl get nodes -o custom-columns='NODE:.metadata.name,MAXPODS:.status.allocatable.pods,CPU:.status.allocatable.cpu,MEM:.status.allocatable.memory'

kubectl get nodes -l eks.amazonaws.com/nodegroup=a-4510-eks-mil-dbworkers-p-01

aws eks update-nodegroup-config --cluster-name a-4510-eks-mil-cluster-p-01 \
  --nodegroup-name a-4510-eks-mil-mainworkers-p-01 --region eu-south-1 \
  --scaling-config minSize=3,maxSize=6,desiredSize=4 \
  --update-config maxUnavailable=1

aws eks update-nodegroup-config --cluster-name a-4510-eks-mil-cluster-p-01 \
  --nodegroup-name a-4510-eks-mil-dbworkers-p-01 --region eu-south-1 \
  --labels 'addOrUpdateLabels={workload=database,tier=data}'

aws eks update-nodegroup-config --cluster-name a-4510-eks-mil-cluster-p-01 \
  --nodegroup-name a-4510-eks-mil-dbworkers-p-01 --region eu-south-1 \
  --taints 'addOrUpdateTaints=[{key=workload,value=database,effect=NO_SCHEDULE}]'

ASG=$(aws eks describe-nodegroup --cluster-name a-4510-eks-mil-cluster-p-01 \
  --nodegroup-name a-4510-eks-mil-mainworkers-p-01 --region eu-south-1 \
  --query 'nodegroup.resources.autoScalingGroups[0].name' --output text)
aws autoscaling describe-scaling-activities --auto-scaling-group-name $ASG --region eu-south-1 \
  --max-items 10 --query 'Activities[].[StartTime,StatusCode,Cause]' --output text

kubectl top nodes
kubectl top pods -A --sort-by=memory | head -20

aws autoscaling create-or-update-tags --region eu-south-1 --tags \
  ResourceId=$ASG,ResourceType=auto-scaling-group,Key=k8s.io/cluster-autoscaler/enabled,Value=true,PropagateAtLaunch=false \
  ResourceId=$ASG,ResourceType=auto-scaling-group,Key=k8s.io/cluster-autoscaler/a-4510-eks-mil-cluster-p-01,Value=owned,PropagateAtLaunch=false

kubectl get node <nodo> -o jsonpath='{.status.allocatable.pods}{"\n"}'

kubectl set env daemonset aws-node -n kube-system ENABLE_PREFIX_DELEGATION=true
kubectl set env daemonset aws-node -n kube-system WARM_PREFIX_TARGET=1

aws ec2 describe-subnets --region eu-south-1 \
  --filters "Name=tag:kubernetes.io/cluster/a-4510-eks-mil-cluster-p-01,Values=owned,shared" \
  --query 'Subnets[].{id:SubnetId,az:AvailabilityZone,cidr:CidrBlock,free:AvailableIpAddressCount}' --output table

aws eks describe-cluster --name a-4510-eks-mil-cluster-p-01 --region eu-south-1 \
  --query 'cluster.resourcesVpcConfig.{public:endpointPublicAccess,private:endpointPrivateAccess,cidrs:publicAccessCidrs,sg:clusterSecurityGroupId,subnets:subnetIds}'

aws eks update-cluster-config --name a-4510-eks-mil-cluster-p-01 --region eu-south-1 \
  --resources-vpc-config endpointPublicAccess=true,endpointPrivateAccess=true,publicAccessCidrs="203.0.113.0/24"

kubectl describe pvc <pvc> -n <ns>
kubectl -n kube-system logs deploy/ebs-csi-controller -c csi-provisioner --tail=100

aws ec2 describe-volumes --region eu-south-1 \
  --filters "Name=tag:kubernetes.io/cluster/a-4510-eks-mil-cluster-p-01,Values=owned" \
  --query 'Volumes[].{id:VolumeId,size:Size,type:VolumeType,state:State,az:AvailabilityZone,pvc:Tags[?Key==`kubernetes.io/created-for/pvc/name`]|[0].Value}' --output table

aws eks list-addons --cluster-name a-4510-eks-mil-cluster-p-01 --region eu-south-1 --output table

aws eks describe-addon --cluster-name a-4510-eks-mil-cluster-p-01 --addon-name aws-ebs-csi-driver --region eu-south-1 \
  --query 'addon.{v:addonVersion,status:status,role:serviceAccountRoleArn,issues:health.issues}'

aws eks describe-addon-versions --addon-name vpc-cni --kubernetes-version 1.33 --region eu-south-1 \
  --query 'addons[].addonVersions[].{version:addonVersion,default:compatibilities[0].defaultVersion}' --output table

aws eks update-addon --cluster-name a-4510-eks-mil-cluster-p-01 --region eu-south-1 \
  --addon-name aws-ebs-csi-driver --addon-version v1.4x.x-eksbuild.x \
  --resolve-conflicts PRESERVE

aws eks create-addon --cluster-name a-4510-eks-mil-cluster-p-01 --region eu-south-1 \
  --addon-name coredns --resolve-conflicts OVERWRITE

aws eks update-addon --cluster-name a-4510-eks-mil-cluster-p-01 --region eu-south-1 \
  --addon-name coredns \
  --configuration-values '{"replicaCount":3,"resources":{"requests":{"cpu":"200m","memory":"128Mi"}}}'

aws eks describe-cluster --name a-4510-eks-mil-cluster-p-01 --region eu-south-1 --query 'cluster.accessConfig'

aws eks update-cluster-config --name a-4510-eks-mil-cluster-p-01 --region eu-south-1 \
  --access-config authenticationMode=API_AND_CONFIG_MAP

aws eks create-access-entry --cluster-name a-4510-eks-mil-cluster-p-01 --region eu-south-1 \
  --principal-arn arn:aws:iam::122610509347:role/a-4510-ops-readonly

aws eks associate-access-policy --cluster-name a-4510-eks-mil-cluster-p-01 --region eu-south-1 \
  --principal-arn arn:aws:iam::122610509347:role/a-4510-ops-readonly \
  --policy-arn arn:aws:eks::aws:cluster-access-policy/AmazonEKSViewPolicy \
  --access-scope type=cluster

kubectl -n kube-system get configmap aws-auth -o yaml

aws eks update-kubeconfig --name a-4510-eks-mil-cluster-p-01 --region eu-south-1 --alias eks-mil-prod

kubectl auth can-i --list --namespace app-prod
kubectl auth can-i delete deployments -n app-prod

aws ecr get-login-password --region eu-south-1 | docker login --username AWS --password-stdin 122610509347.dkr.ecr.eu-south-1.amazonaws.com

aws ecr create-repository --repository-name myapp --region eu-south-1 \
  --image-scanning-configuration scanOnPush=true --image-tag-mutability IMMUTABLE

docker build -t myapp:1.4.0 .
docker tag myapp:1.4.0 122610509347.dkr.ecr.eu-south-1.amazonaws.com/myapp:1.4.0
docker push 122610509347.dkr.ecr.eu-south-1.amazonaws.com/myapp:1.4.0

aws ecr describe-images --repository-name myapp --region eu-south-1 \
  --query 'sort_by(imageDetails,&imagePushedAt)[-10:].{tag:imageTags[0],pushed:imagePushedAt,mb:imageSizeInBytes}' --output table

aws eks describe-cluster --name a-4510-eks-mil-cluster-p-01 --region eu-south-1 \
  --query 'cluster.logging.clusterLogging[].{types:types,enabled:enabled}'

aws eks update-cluster-config --name a-4510-eks-mil-cluster-p-01 --region eu-south-1 \
  --logging '{"clusterLogging":[{"types":["audit","authenticator"],"enabled":true}]}'

aws logs start-query --region eu-south-1 \
  --log-group-name /aws/eks/a-4510-eks-mil-cluster-p-01/cluster \
  --start-time $(date -v-2H +%s) --end-time $(date +%s) \
  --query-string 'fields @timestamp, user.username, verb, objectRef.resource, objectRef.name | filter verb="delete" | sort @timestamp desc | limit 50'

kubectl get events -A --sort-by=.lastTimestamp | tail -40

aws ec2 describe-vpcs --region eu-south-1 --vpc-ids vpc-0abc123 \
  --query 'Vpcs[].{cidr:CidrBlock,dns:EnableDnsSupport,hostnames:EnableDnsHostnames}'
aws ec2 describe-subnets --region eu-south-1 --filters "Name=vpc-id,Values=vpc-0abc123" \
  --query 'Subnets[].{id:SubnetId,az:AvailabilityZone,cidr:CidrBlock,free:AvailableIpAddressCount,public:MapPublicIpOnLaunch}' --output table

aws ec2 create-tags --region eu-south-1 --resources subnet-0aaa subnet-0bbb --tags Key=kubernetes.io/role/internal-elb,Value=1

eksctl create cluster -f cluster.yaml --dry-run

eksctl create cluster -f cluster.yaml

eksctl utils describe-stacks --cluster a-4510-eks-mil-cluster-p-02 --region eu-south-1

cat > cluster-trust.json <<'EOF'
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": { "Service": "eks.amazonaws.com" },
    "Action": "sts:AssumeRole"
  }]
}
EOF

aws iam create-role --role-name a-4510-iam-mil-clusterrole-p-02 \
  --assume-role-policy-document file://cluster-trust.json

aws iam attach-role-policy --role-name a-4510-iam-mil-clusterrole-p-02 \
  --policy-arn arn:aws:iam::aws:policy/AmazonEKSClusterPolicy

cat > node-trust.json <<'EOF'
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": { "Service": "ec2.amazonaws.com" },
    "Action": "sts:AssumeRole"
  }]
}
EOF

aws iam create-role --role-name a-4510-iam-mil-noderole-p-02 \
  --assume-role-policy-document file://node-trust.json

for p in AmazonEKSWorkerNodePolicy AmazonEC2ContainerRegistryPullOnly AmazonEKS_CNI_Policy; do
  aws iam attach-role-policy --role-name a-4510-iam-mil-noderole-p-02 --policy-arn arn:aws:iam::aws:policy/$p
done

aws eks create-cluster --name a-4510-eks-mil-cluster-p-02 --region eu-south-1 \
  --kubernetes-version 1.34 \
  --role-arn arn:aws:iam::122610509347:role/a-4510-iam-mil-clusterrole-p-02 \
  --resources-vpc-config subnetIds=subnet-0aaa,subnet-0bbb,subnet-0ccc,endpointPublicAccess=false,endpointPrivateAccess=true \
  --access-config authenticationMode=API_AND_CONFIG_MAP,bootstrapClusterCreatorAdminPermissions=true \
  --logging '{"clusterLogging":[{"types":["audit","authenticator","api"],"enabled":true}]}' \
  --tags Environment=production,CostCenter=4510

aws eks wait cluster-active --name a-4510-eks-mil-cluster-p-02 --region eu-south-1
aws eks describe-cluster --name a-4510-eks-mil-cluster-p-02 --region eu-south-1 --query 'cluster.[status,version,platformVersion]' --output text

eksctl utils associate-iam-oidc-provider --cluster a-4510-eks-mil-cluster-p-02 --region eu-south-1 --approve
aws iam list-open-id-connect-providers

aws eks create-nodegroup --cluster-name a-4510-eks-mil-cluster-p-02 --region eu-south-1 \
  --nodegroup-name a-4510-eks-mil-dbworkers-p-02 \
  --node-role arn:aws:iam::122610509347:role/a-4510-iam-mil-noderole-p-02 \
  --subnets subnet-0aaa subnet-0bbb subnet-0ccc \
  --instance-types r6i.xlarge --ami-type AL2023_x86_64_STANDARD --capacity-type ON_DEMAND \
  --disk-size 200 \
  --scaling-config minSize=3,maxSize=3,desiredSize=3 \
  --update-config maxUnavailable=1 \
  --labels workload=database,tier=data \
  --taints 'key=workload,value=database,effect=NO_SCHEDULE' \
  --tags Environment=production,CostCenter=4510

aws eks wait nodegroup-active --cluster-name a-4510-eks-mil-cluster-p-02 --nodegroup-name a-4510-eks-mil-dbworkers-p-02 --region eu-south-1

aws eks create-addon --cluster-name a-4510-eks-mil-cluster-p-02 --region eu-south-1 --addon-name vpc-cni
aws eks create-addon --cluster-name a-4510-eks-mil-cluster-p-02 --region eu-south-1 --addon-name kube-proxy
aws eks create-addon --cluster-name a-4510-eks-mil-cluster-p-02 --region eu-south-1 --addon-name coredns
aws eks create-addon --cluster-name a-4510-eks-mil-cluster-p-02 --region eu-south-1 --addon-name aws-ebs-csi-driver \
  --service-account-role-arn arn:aws:iam::122610509347:role/a-4510-eks-mil-cluster-p-02-EBSCSIController

aws eks update-kubeconfig --name a-4510-eks-mil-cluster-p-02 --region eu-south-1 --alias eks-mil-p02
kubectl get nodes
kubectl get pods -A

aws eks create-access-entry --cluster-name a-4510-eks-mil-cluster-p-02 --region eu-south-1 \
  --principal-arn arn:aws:iam::122610509347:role/a-4510-infraops-admin

aws eks associate-access-policy --cluster-name a-4510-eks-mil-cluster-p-02 --region eu-south-1 \
  --principal-arn arn:aws:iam::122610509347:role/a-4510-infraops-admin \
  --policy-arn arn:aws:eks::aws:cluster-access-policy/AmazonEKSClusterAdminPolicy \
  --access-scope type=cluster

module "eks" {
  source  = "terraform-aws-modules/eks/aws"
  version = "~> 20.0"

  cluster_name    = "a-4510-eks-mil-cluster-p-02"
  cluster_version = "1.34"

  vpc_id     = "vpc-0abc123"
  subnet_ids = ["subnet-0aaa", "subnet-0bbb", "subnet-0ccc"]

  cluster_endpoint_public_access  = false
  cluster_endpoint_private_access = true
  enable_irsa                     = true

  cluster_addons = {
    vpc-cni            = {}
    kube-proxy         = {}
    coredns            = {}
    aws-ebs-csi-driver = {}
  }

  eks_managed_node_groups = {
    mainworkers = {
      instance_types = ["m6i.xlarge"]
      ami_type       = "AL2023_x86_64_STANDARD"
      min_size       = 3
      max_size       = 6
      desired_size   = 3
    }
  }
}

kubectl get nodes -o wide
kubectl get pods -A --field-selector=status.phase!=Running,status.phase!=Succeeded
kubectl run net-test --rm -it --restart=Never --image=busybox -- nslookup kubernetes.default
aws eks list-addons --cluster-name a-4510-eks-mil-cluster-p-02 --region eu-south-1 --output table
aws eks list-access-entries --cluster-name a-4510-eks-mil-cluster-p-02 --region eu-south-1
aws eks describe-cluster --name a-4510-eks-mil-cluster-p-02 --region eu-south-1 --query 'cluster.logging'

kubectl apply -f - <<'EOF'
apiVersion: v1
kind: PersistentVolumeClaim
metadata: { name: test-ebs }
spec:
  accessModes: [ReadWriteOnce]
  storageClassName: gp3
  resources: { requests: { storage: 1Gi } }
EOF
kubectl get pvc test-ebs -w

kubectl delete ingress,svc --all -A          # altrimenti restano ALB e NLB orfani, che continuano a costare
aws eks delete-nodegroup --cluster-name a-4510-eks-mil-cluster-p-02 --nodegroup-name <ng> --region eu-south-1
aws eks wait nodegroup-deleted --cluster-name a-4510-eks-mil-cluster-p-02 --nodegroup-name <ng> --region eu-south-1
aws eks delete-cluster --name a-4510-eks-mil-cluster-p-02 --region eu-south-1

eksctl delete cluster -f cluster.yaml --disable-nodegroup-eviction

brew install kind kubectl helm

kind create cluster --config kind-eks-lab.yaml
kubectl get nodes -L workload
kind delete cluster --name eks-lab

kind create cluster --name eks-lab-133 --image kindest/node:v1.33.0

aws ecr-public describe-image-tags --repository-name eks-distro/kubernetes-sigs/kind/node --region us-east-1 --no-sign-request --query 'imageTagDetails[-15:].imageTag' --output text

kind create cluster --name eksd-lab --image public.ecr.aws/eks-distro/kubernetes-sigs/kind/node:<tag>
kubectl version
kubectl -n kube-system get pods

brew install aws/tap/eks-anywhere
eksctl anywhere version

export CLUSTER_NAME=eksa-lab
eksctl anywhere generate clusterconfig $CLUSTER_NAME --provider docker > $CLUSTER_NAME.yaml
eksctl anywhere create cluster -f $CLUSTER_NAME.yaml

export KUBECONFIG=$PWD/$CLUSTER_NAME/$CLUSTER_NAME-eks-a-cluster.kubeconfig
kubectl get nodes
eksctl anywhere delete cluster -f $CLUSTER_NAME.yaml

docker run --rm -p 5000:5000 motoserver/moto:latest

export AWS_ACCESS_KEY_ID=test AWS_SECRET_ACCESS_KEY=test AWS_DEFAULT_REGION=eu-south-1
aws --endpoint-url http://localhost:5000 iam create-role --role-name lab-node-role --assume-role-policy-document file://node-trust.json
aws --endpoint-url http://localhost:5000 iam attach-role-policy --role-name lab-node-role --policy-arn arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy
aws --endpoint-url http://localhost:5000 iam list-roles --query 'Roles[].Arn'

brew install kwok
kwokctl create cluster --name kwok-lab
kwokctl scale node --name kwok-lab --replicas 20

for ng in $(aws eks list-nodegroups --cluster-name a-4510-eks-mil-cluster-p-01 --region eu-south-1 --query 'nodegroups[]' --output text); do
  aws eks describe-nodegroup --cluster-name a-4510-eks-mil-cluster-p-01 --nodegroup-name $ng --region eu-south-1 \
    --query "nodegroup.[nodegroupName,amiType,releaseVersion]" --output text
done

aws eks list-insights --cluster-name a-4510-eks-mil-cluster-p-01 --region eu-south-1 \
  --query 'insights[].{id:id,name:name,status:insightStatus.status,reason:insightStatus.reason}' --output table

aws eks describe-insight --cluster-name a-4510-eks-mil-cluster-p-01 --region eu-south-1 --id <insight-id> \
  --query 'insight.{name:name,desc:description,rec:recommendation,details:categorySpecificSummary.deprecationDetails}'

aws eks describe-cluster-versions --region eu-south-1 --output table

kubectl get pdb -A -o custom-columns='NS:.metadata.namespace,NAME:.metadata.name,MIN:.spec.minAvailable,MAX:.spec.maxUnavailable,ALLOWED:.status.disruptionsAllowed'

kubectl get --raw /metrics | grep apiserver_requested_deprecated_apis

aws logs start-query --region eu-south-1 \
  --log-group-name /aws/eks/a-4510-eks-mil-cluster-p-01/cluster \
  --start-time $(date -d '30 days ago' +%s) --end-time $(date +%s) \
  --query-string 'fields @timestamp, userAgent, user.username, objectRef.apiGroup, objectRef.apiVersion, objectRef.resource
                  | filter objectRef.apiVersion like /beta/
                  | stats count(*) by userAgent, objectRef.apiGroup, objectRef.apiVersion, objectRef.resource
                  | sort count desc | limit 100'

aws logs get-query-results --region eu-south-1 --query-id <query-id>

pluto detect-helm --target-versions k8s=v1.33 -A -o wide
pluto detect-api-resources --target-versions k8s=v1.33 -o wide

kubent --target-version 1.33 --cluster --helm3 --exit-error

kubectl api-resources --sort-by=name -o wide | grep -v -E '^(NAME|.*\.k8s\.io|.*kubernetes\.io)' | head -60
kubectl get crd -o custom-columns='CRD:.metadata.name,GROUP:.spec.group,VERSIONS:.spec.versions[*].name,STORED:.status.storedVersions'

kubectl get crd -o json | jq -r '.items[] | select(.spec.versions[].name | test("v1beta|v1alpha")) | "\(.metadata.name)\t\(.spec.versions[].name)"' | sort -u

pluto detect-files -d ./manifests --target-versions k8s=v1.33 -o wide
kubent --target-version 1.33 --filename ./manifests

helm template mia-release ./chart -f values-prod.yaml | pluto detect - --target-versions k8s=v1.33

kubectl convert -f vecchio.yaml --output-version apps/v1 > nuovo.yaml

helm list -A -o table

kubectl get deploy,ds -A -o custom-columns='NS:.metadata.namespace,KIND:.kind,NAME:.metadata.name,IMAGE:.spec.template.spec.containers[*].image' \
  | grep -E 'kube-system|monitoring|istio|cert-manager|argocd|external-secrets|dynatrace|operators'

kubectl get csv -A -o custom-columns='NS:.metadata.namespace,NAME:.metadata.name,VERSION:.spec.version,PHASE:.status.phase' 2>/dev/null

kubectl get cluster.postgresql.k8s.enterprisedb.io -A -o custom-columns='NS:.metadata.namespace,NAME:.metadata.name,INSTANCES:.spec.instances,READY:.status.readyInstances,PRIMARY:.status.currentPrimary,PHASE:.status.phase'

kubectl get pods -A -l role=primary -o custom-columns='NS:.metadata.namespace,POD:.metadata.name,NODE:.spec.nodeName'

kubectl get validatingwebhookconfigurations -o custom-columns='NAME:.metadata.name,POLICY:.webhooks[*].failurePolicy,SVC:.webhooks[*].clientConfig.service.name'
kubectl get mutatingwebhookconfigurations -o custom-columns='NAME:.metadata.name,POLICY:.webhooks[*].failurePolicy,SVC:.webhooks[*].clientConfig.service.name'

aws eks update-cluster-version --name a-4510-eks-mil-cluster-p-01 --region eu-south-1 --kubernetes-version 1.33

aws eks describe-update --name a-4510-eks-mil-cluster-p-01 --region eu-south-1 --update-id <update-id> \
  --query 'update.{status:status,type:type,errors:errors}'

aws eks describe-cluster --name a-4510-eks-mil-cluster-p-01 --region eu-south-1 --query 'cluster.[version,platformVersion,status]' --output text
kubectl version

for a in vpc-cni kube-proxy coredns aws-ebs-csi-driver; do
  echo "== $a"
  aws eks describe-addon-versions --addon-name $a --kubernetes-version 1.33 --region eu-south-1 \
    --query 'addons[0].addonVersions[?compatibilities[0].defaultVersion==`true`].addonVersion' --output text
done

aws eks update-addon --cluster-name a-4510-eks-mil-cluster-p-01 --region eu-south-1 \
  --addon-name kube-proxy --addon-version <versione> --resolve-conflicts PRESERVE
kubectl -n kube-system rollout status ds/kube-proxy

aws eks update-nodegroup-version --cluster-name a-4510-eks-mil-cluster-p-01 --region eu-south-1 \
  --nodegroup-name a-4510-eks-mil-apigwworkers-p-01 --kubernetes-version 1.33

aws eks update-nodegroup-version --cluster-name a-4510-eks-mil-cluster-p-01 --region eu-south-1 \
  --nodegroup-name a-4510-eks-mil-mainworkers-p-01

watch -n 20 "kubectl get nodes -L eks.amazonaws.com/nodegroup --sort-by=.metadata.creationTimestamp"

kubectl get pdb -A | awk '$5==0'
kubectl -n <ns> describe pdb <nome>

eksctl create nodegroup --cluster a-4510-eks-mil-cluster-p-01 --region eu-south-1 \
  --name a-4510-eks-mil-mainworkers-p-02 --node-type m6i.xlarge --nodes 3 --nodes-min 3 --nodes-max 6 \
  --node-ami-family AmazonLinux2023 --version 1.33

kubectl cordon -l eks.amazonaws.com/nodegroup=a-4510-eks-mil-mainworkers-p-01
kubectl drain <nodo> --ignore-daemonsets --delete-emptydir-data --timeout=600s

aws eks delete-nodegroup --cluster-name a-4510-eks-mil-cluster-p-01 --region eu-south-1 \
  --nodegroup-name a-4510-eks-mil-mainworkers-p-01

kubectl get nodes -o custom-columns='NODE:.metadata.name,KUBELET:.status.nodeInfo.kubeletVersion,OS:.status.nodeInfo.osImage,RUNTIME:.status.nodeInfo.containerRuntimeVersion'

kubectl get pods -A --field-selector=status.phase!=Running,status.phase!=Succeeded
kubectl get events -A --sort-by=.lastTimestamp | tail -30

aws eks list-insights --cluster-name a-4510-eks-mil-cluster-p-01 --region eu-south-1 \
  --query 'insights[?insightStatus.status!=`PASSING`]' --output table

kubectl describe pod <pod> -n <ns> | sed -n '/Events/,$p'

kubectl describe pod <pod> -n <ns> | grep -A15 Events

kubectl -n <ns> exec <pod> -- env | grep AWS_ROLE_ARN

kubectl -n <ns> exec <pod> -- aws sts get-caller-identity

aws iam simulate-principal-policy --policy-source-arn <role-arn> --action-names s3:GetObject --resource-arns arn:aws:s3:::bucket/key

kubectl describe node <nodo> | grep -A12 Conditions

aws eks describe-nodegroup --cluster-name a-4510-eks-mil-cluster-p-01 --nodegroup-name <ng> --region eu-south-1 --query 'nodegroup.health'

aws ssm start-session --target i-0abc123 --region eu-south-1
sudo journalctl -u kubelet -n 200 --no-pager
sudo journalctl -u containerd -n 100 --no-pager

kubectl -n kube-system logs deploy/aws-load-balancer-controller --tail=100 | grep -i error

aws eks list-clusters --region eu-south-1 --output table
aws eks describe-cluster --name <cluster> --region eu-south-1 --query 'cluster.{v:version,pf:platformVersion,status:status,ep:resourcesVpcConfig.endpointPublicAccess,role:roleArn}'
aws eks list-nodegroups --cluster-name <cluster> --region eu-south-1 --output table
aws eks list-addons --cluster-name <cluster> --region eu-south-1 --output table
aws eks list-insights --cluster-name <cluster> --region eu-south-1 --query 'insights[?insightStatus.status!=`PASSING`]' --output table

kubectl get pods -A --field-selector=status.phase!=Running,status.phase!=Succeeded

kubectl get pods -A --sort-by=.status.containerStatuses[0].restartCount -o wide | tail -20

kubectl describe nodes | grep -A5 "Allocated resources"

kubectl get sa -A -o json | jq -r '.items[] | select(.metadata.annotations."eks.amazonaws.com/role-arn") | "\(.metadata.namespace)\t\(.metadata.name)\t\(.metadata.annotations."eks.amazonaws.com/role-arn")"'

kubectl get pods -A -o jsonpath='{range .items[*]}{range .spec.containers[*]}{.image}{"\n"}{end}{end}' | sort | uniq -c | sort -rn