kosli snapshot gke

This is a beta feature. Beta features provide early access to product functionality. These features may change between releases without warning, or can be removed in a future release. Please contact us to enable this feature for your organization.

Synopsis

kosli snapshot gke ENVIRONMENT-NAME [flags]

Report a snapshot of running pods in GKE clusters to Kosli, read from Cloud Asset Inventory.
Reads the pods of every GKE cluster in a Google Cloud project, folder or organization from Cloud Asset Inventory, so it needs no kubeconfig, no Kubernetes RBAC and no network access to any cluster control plane. The reported data matches kosli snapshot k8s: container image digests, creation timestamps and owners of the Running and Failed pods. GCP authentication uses Application Default Credentials. On a developer machine, run gcloud auth application-default login; in GCE/GKE/Cloud Run the metadata server / Workload Identity is used automatically. The Cloud Asset API (cloudasset.googleapis.com) must be enabled in the quota project of the caller’s credentials. The caller needs cloudasset.assets.listContainerPod and serviceusage.services.use on the project, folder or organization. Grant them through a custom role for least privilege: roles/cloudasset.viewer also works, but it can list every asset type, including k8s.io/Secret. Asset Inventory is eventually consistent, so a snapshot can lag behind recent pod changes. Skip --clusters, --clusters-regex and --locations to report the pods of every cluster in scope, and skip the namespace flags to report every namespace. Filters are case-sensitive. With --folder or --organization, --clusters and --clusters-regex match cluster names in every project under the scope. The snapshot captures every pod that matches the filters, across all selected clusters, and reports them to one environment. With no cluster or location filter, that is every GKE cluster in the scope. The report does not record which cluster a pod runs in, so pods with the same namespace and name in two clusters (e.g. StatefulSet pods such as web-0) cannot be told apart by name. To keep clusters apart, snapshot each one with --clusters to its own environment.

Flags

Flag	Type	Description
`--clusters`	strings	[optional] The comma-separated list of GKE cluster names to snapshot. Defaults to every cluster in scope.
`--clusters-regex`	strings	[optional] The comma-separated list of GKE cluster name regex patterns to snapshot. Defaults to every cluster in scope.
`-D`, `--dry-run`	bool	[optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors.
`-x`, `--exclude-namespaces`	strings	[optional] The comma separated list of namespaces names to exclude from reporting artifacts info from. Can’t be used together with `--namespaces` or `--namespaces-regex`.
`--exclude-namespaces-regex`	strings	[optional] The comma separated list of namespaces regex patterns to exclude from reporting artifacts info from. Can’t be used together with `--namespaces` or `--namespaces-regex`.
`--folder`	string	[conditional] The Google Cloud folder ID to snapshot GKE pods from, covering every project under it. Exactly one of `--project`, `--folder` or `--organization` is required.
`-h`, `--help`	bool	help for gke
`--locations`	strings	[optional] The comma-separated list of GKE cluster locations (regions or zones, e.g. europe-west1,us-central1-a) to snapshot. A region also matches the zonal clusters in it. Defaults to every location.
`-n`, `--namespaces`	strings	[optional] The comma separated list of namespaces names to report artifacts info from. Can’t be used together with `--exclude-namespaces` or `--exclude-namespaces-regex`.
`--namespaces-regex`	strings	[optional] The comma separated list of namespaces regex patterns to report artifacts info from. Can’t be used together with `--exclude-namespaces` or `--exclude-namespaces-regex`.
`--organization`	string	[conditional] The Google Cloud organization ID to snapshot GKE pods from, covering every project under it. Exactly one of `--project`, `--folder` or `--organization` is required.
`--project`	string	[conditional] The Google Cloud project ID to snapshot GKE pods from. Exactly one of `--project`, `--folder` or `--organization` is required.

Flags inherited from parent commands

Flag	Type	Description
`-a`, `--api-token`	string	The Kosli API token.
`-A`, `--auto-environment`	bool	[optional] Create the environment (with the type inferred from the snapshot subcommand) if it does not already exist, before reporting the snapshot.
`-c`, `--config-file`	string	[optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default “$HOME/.kosli.yml”)
`--debug`	bool	[optional] Print debug logs to stdout.
`--environment-description`	string	[optional] The environment description.
`--exclude-scaling`	bool	[optional] Exclude scaling events for snapshots. Snapshots with scaling changes will not result in new environment records. (DEPRECATED: this flag is deprecated and will be removed in a future version. Scaling events do not trigger new snapshots.)
`-H`, `--host`	string	[defaulted] The Kosli endpoint. (default “https://app.kosli.com”)
`--http-proxy`	string	[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`
`--include-scaling`	bool	[optional] Include scaling events for snapshots. Snapshots with scaling changes will result in new environment records. (DEPRECATED: this flag is deprecated and will be removed in a future version. Scaling events do not trigger new snapshots.)
`-r`, `--max-api-retries`	int	[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)
`--org`	string	The Kosli organization.
`-q`, `--quiet`	bool	[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins.

Examples Use Cases

These examples all assume that the flags --api-token, --org, --host, (and --flow, --trail when required), are set/provided.

report the pods of every GKE cluster in a project

kosli snapshot gke yourEnvironmentName 
	--project yourGCPProject 

report the pods of every GKE cluster in all projects under a folder

kosli snapshot gke yourEnvironmentName 
	--folder yourGCPFolderID 

report the pods of one cluster to its own environment, excluding system namespaces

kosli snapshot gke yourEnvironmentName 
	--project yourGCPProject 
	--clusters yourClusterName 
	--locations europe-west1 
	--exclude-namespaces-regex "^kube-,^gke-" 

General

Top-level commands

kosli allow

kosli archive

kosli assert

kosli attest

kosli begin

kosli create

kosli delete

kosli diff

kosli disable / enable

kosli evaluate

kosli get

kosli join

kosli list

kosli log

kosli rename

kosli report

kosli rotate

kosli snapshot

kosli unarchive

kosli update

Synopsis

Flags

Flags inherited from parent commands

Examples Use Cases

​Synopsis

​Flags

​Flags inherited from parent commands

​Examples Use Cases

Synopsis

Flags

Flags inherited from parent commands

Examples Use Cases