kubectl helper: commands, selectors, JSONPath, RBAC

Commands builds get, describe, logs, exec, port-forward, apply, diff, rollout, scale, drain, cordon/uncordon, top and delete commands. Each flag says what it does; the command is listed part by part with an explanation, and risky combinations get a warning (--disable-eviction, --force without --grace-period=0, --address 0.0.0.0). An -o jsonpath or -o custom-columns expression can be tried on the JSONPath tab.

Selectors takes a selector the way kubectl -l does — app=web, tier!=cache, env in (prod,staging), version notin (v1), track, !track, joined by commas — and shows which objects it matches and, for each one it does not, which requirement fails. It also writes the selector as matchLabels/matchExpressions for a manifest. Test it on the sample pods, or paste kubectl get pods -o yaml, -o json or --show-labels output.

JSONPath runs -o jsonpath templates and -o custom-columns specs with kubectl’s rules (client-go’s JSONPath): text between actions, {range …}{end}, {"\n"}, fields, unions, indexes and slices, [*], recursive .., and filters with ==, !=, <, >, ⇐, >= and existence. Several results are separated by spaces; maps and lists print as JSON. Custom columns print <none> for missing values, join several with commas, show maps the way Go prints them, and line up like kubectl’s table writer. The worked example from the Kubernetes documentation’s JSONPath page is built in.

RBAC reads Roles, ClusterRoles, RoleBindings and ClusterRoleBindings and answers "can <subject> <verb> <resource> in <namespace>?" — showing the binding, the role and the rule that grants it, or which bindings name the subject but fall short. It follows the API server’s RBAC authorizer: ClusterRoleBindings apply everywhere, RoleBindings only in their namespace (even when they reference a ClusterRole); a rule’s resources may be , pods, pods/log or /scale; resourceNames limits it to named objects (so never to list or create); non-resource URLs such as /metrics count only through ClusterRoleBindings; aggregated ClusterRoles collect the rules of the roles their selectors match; service accounts are also in system:serviceaccounts, system:serviceaccounts:<namespace> and system:authenticated, and system:masters bypasses RBAC. The matrix shows the verbs a subject has on each resource the roles mention, and Who can lists every subject allowed the same request. The equivalent kubectl auth can-i … --as … command checks it on a real cluster.

Related: Kubernetes manifest builder and explainer, container dashboard, Compose and Kubernetes checker, JSON formatter, regex tester.

Share link copies a link to what the open tab shows. Put the tab after #: commands, selectors, jsonpath or rbac. Pasted objects are not included; pasted roles are (up to 8,000 characters) when they differ from the sample.

Examples: ?selector=tier=backend, ?jsonpath={.items[?(@.status.phase=="Running").metadata.name}#jsonpath], ?jsonpath={..name}&data=docs#jsonpath, ?columns=NAME:.metadata.name.image#jsonpath], ?kind=ServiceAccount&subject=ci&saNs=tools&verb=patch&resource=deployments/scale&ns=shop#rbac, ?kind=ServiceAccount&subject=prometheus&saNs=monitoring&verb=get&url=/metrics#rbac, ?cmd=drain#commands.