solveit's questions

I have a K3s cluster with system pods (i.e. kube-system namespace) and my application pods:

kube-system   pod/calico-node-xxxx                          
kube-system   pod/calico-kube-controllers-xxxxxx   
kube-system   pod/metrics-server-xxxxx
kube-system   pod/local-path-provisioner-xxxxx
kube-system   pod/coredns-xxxxx
app-system    pod/my-app-xxxx
db-system     pod/my-db-xxxxx

I am looking for a shell/kubectl command (for automation script) that can delete my application namespace (want to modify kubectl delete namespace app-system db-system) without mentioning the app namespaces name in the command (as in future if more app namespace would come in cluster, I have to edit this script every time).

That means I want to delete all namespace in cluster except kube-system

something like - kubectl delete namespace -v kube-system (I know -v is not a valid parameter here, just showing how in grep -v is used to except the following words. Similar thing looking for kubectl delete ns... )

I have a k3s cluster with kube-system pods and my application's (xyz-system namespace) pods:

kube-system   pod/calico-node-xxxx                          
kube-system   pod/calico-kube-controllers-xxxxxx   
kube-system   pod/metrics-server-xxxxx
kube-system   pod/local-path-provisioner-xxxxx
kube-system   pod/coredns-xxxxx
xyz-system    pod/my-app
xyz-system    pod/my-app-mqtt

I want to reset/restart all of these pods (kube-system + xyz-system) in one command (or it can be two commands for two namespace but without deployment name) without giving deployment names because in future I can have more deployments created, so it will be difficult to provide many deployment names manually.

Debugging:
With command kubectl -n kube-system rollout restart daemonsets,deployments as mentioned in link I am able to restart the kube-system pods. But when I modify this command with xyz-namespace : kubectl -n xyz-system rollout restart deployments the respective pods are not restarting when I monitor watch kubectl get all -A they remain as it is in Running state.

Can someone let me know how to achieve this ?

I have a k3s (v1.21.1+k3s1) cluster with following pods:

kube-system   pod/calico-node-xxxx                          
kube-system   pod/calico-kube-controllers-xxxxxx   
kube-system   pod/metrics-server-xxxxx
kube-system   pod/local-path-provisioner-xxxxx
kube-system   pod/coredns-xxxxx

How can I restart (stop and start the pods again) the pods either with command (kubectl maybe) or any script?

I have iptables starting from cali-

 root@Ubuntu-18-VM:~# iptables -S | grep -oP '(?<!^:)cali-[^ ]+'
    cali-FORWARD
    cali-INPUT
    cali-OUTPUT
    cali-cidr-block
    cali-from-hep-forward
    cali-from-host-endpoint
    cali-from-wl-dispatch
    cali-from-wl-dispatch-5
    cali-fw-cali2847b154969
    cali-fw-cali4bb24809f90
    cali-fw-cali531f8f2e712
    cali-fw-cali5a82b3ff301
    cali-pri-_CVSZITRyIpEmH8AB6H
    cali-pri-_HayIXLB85hzHkIhWER
    cali-pri-_PTRGc0U-L5Kz7V6ERW
    cali-pri-_u2Tn2rSoAPffvE7JO6
    cali-pri-kns.kube-system
    cali-pro-_CVSZITRyIpEmH8AB6H
    cali-pro-_HayIXLB85hzHkIhWER
    cali-pro-_PTRGc0U-L5Kz7V6ERW
    cali-pro-_u2Tn2rSoAPffvE7JO6
    cali-pro-kns.kube-system
    cali-to-hep-forward
    cali-to-host-endpoint
    cali-to-wl-dispatch
    cali-to-wl-dispatch-5
    cali-tw-cali2847b154969
    cali-tw-cali4bb24809f90
    cali-tw-cali531f8f2e712
    cali-tw-cali5a82b3ff301
    cali-wl-to-host

How can I delete these 31 iptables ? After grep what delete command shall I add so that iptables -S command didn't show the cali- iptables ?

I have a K3s setup with calico pods [calico-node- & calico-kube-controllers-] running. On uninstalling K3s, calico pods get deleted but I see that calicoctl and iptables -S commands still running and shows data.

I want to delete calico (including calicoctl and Iptables created by calico) completely. Which commands will help me to do so ?

K3s uninstalltion command: /usr/local/bin/k3s-uninstall.sh deletes all k3s pods including calico, but calicoctl and iptables -S still works.

PS: I already tried few things -

1. Command kubectl delete -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/release-1.5/config/v1.5/calico.yaml deletes the calico-node- but calico-kube-controller , calicoctl and iptables -S are still present
2. Kubectl delete commands in this que also not working for me, after executing these two commands still calicoctl and iptables -S are present

Can I modify and use /etc/host.allow file or something similar to restrict the outgoing (egress) calls from my kubernetes pods. If there is intermediate lookup happening while making an egress call from pod to external domain(lets say google.com), then I should be able to use hosts.allow kind of config to control and restrict the access of outgoing calls?
For example I want to allow google.com and block gitHub.com.

Note: I see in my default pods that coredns pod is already present with image: rancher/coredns-coredns:1.8.3. I understand that it comes default with k3s.

PS: I have already explored calico and other external (third party) network policy but they are not fulfilling my requirement.

How can I use use coredns acl plugin for the domain based access [blocking/allowing] the egress calls ? As per my use case I want to control the outgoing calls from my pod.
something like this :

. {
    acl {
        allow net stackoverflow.com
        block net google.com
    }
}

Note: I see in my default pods that coredns pod is already present with image: rancher/coredns-coredns:1.8.3. I understand that it comes default with k3s.

PS: I have already explored calico and other network policy but they are not fulfilling my requirement.

Can I use Kubernetes dns service to whitelist the domains for my pods? I want to restrict the outgoing (egress) calls using Kubernetes dns service. if I can achieve this, can someone let me know the steps required to implement this.
Note: I see in my default pods that coredns pod is already present with image: rancher/coredns-coredns:1.8.3. I understand that it comes default with k3s.

PS: I have already explored calico and other network policy but they are not fulfilling my requirement.

I have an application running with kubernetes orchestrator. I want to implement calico network policy based on domain name or wildcard characters so that domain names (FQDN/DNS) can be used to allow access from a pod or set of pods (via label selector).

I came across calico doc which says the same thing, but not sure if this is free or paid ? Can someone confirm this? also where I can get example of this?

I have a application running with kubernetes orchestrator. I want to implement calico network policy based on domain name Regex matching. I am seeing in calico doc that they are using ip range(CIDR) to control incoming and outgoing calls.
Can same thing be done using domain name regex matching instead of CIDR ? Some example would be helpful.

For instance I want my calico network policy to allow ingress call for domain:

"^.+\\.app\\.ubuntu\\.net$ ^.+\\.aws-tools.org$ ^local\\.aws-tools\\.org$"

I have a .net framework application written in C# running in K8s orchestration. I simply want to check in fixed interval (lets say in every 300sec) that my application which is running inside pod is responding or not.

Can someone let me know how to do this?