x
Failing Installation on WSL or Linux (missing gcc)
When installing Homebrew on WSL or Linux, you may encounter the following error:
==> Installing k8sgpt from k8sgpt-ai/k8sgpt Error: The following formula cannot be installed from a bottle and must be
built from the source. k8sgpt Install Clang or run brew install gcc.
If you install gcc as suggested, the problem will persist. Therefore, you need to install the build-essential package.
Download the latest Windows binaries of k8sgpt from the Release
tab based on your system architecture.
Extract the downloaded package to your desired location. Configure the system path variable with the binary location
Operator Installation
To install within a Kubernetes cluster please use our k8sgpt-operator with installation instructions available here
This mode of operation is ideal for continuous monitoring of your cluster and can integrate with your existing monitoring such as Prometheus and Alertmanager.
Quick Start
Currently, the default AI provider is OpenAI, you will need to generate an API key from OpenAI
You can do this by running k8sgpt generate to open a browser link to generate it
Run k8sgpt auth add to set it in k8sgpt.
You can provide the password directly using the --password flag.
Run k8sgpt filters to manage the active filters used by the analyzer. By default, all filters are executed during analysis.
Run k8sgpt analyze to run a scan.
And use k8sgpt analyze --explain to get a more detailed explanation of the issues.
You also run k8sgpt analyze --with-doc (with or without the explain flag) to get the official documentation from Kubernetes.
Analyzers
K8sGPT uses analyzers to triage and diagnose issues in your cluster. It has a set of analyzers that are built in, but
you will be able to write your own analyzers.
K8sGPT uses the chosen LLM, generative AI provider when you want to explain the analysis results using --explain flag e.g. k8sgpt analyze --explain. You can use --backend flag to specify a configured provider (it's openai by default).
You can list available providers using k8sgpt auth list:
For detailed documentation on how to configure and use each provider see here.
To set a new default provider
k8sgpt auth default -p azureopenai
Default provider set to azureopenai
Key Features
With this option, the data is anonymized before being sent to the AI Backend. During the analysis execution, k8sgpt retrieves sensitive data (Kubernetes object names, labels, etc.). This data is masked when sent to the AI backend and replaced by a key that can be used to de-anonymize the data when the solution is returned to the user.
Anonymization
Error reported during analysis:
Error: HorizontalPodAutoscaler uses StatefulSet/fake-deployment as ScaleTargetRef which does not exist.
Payload sent to the AI backend:
Error: HorizontalPodAutoscaler uses StatefulSet/tGLcCRcHa1Ce5Rs as ScaleTargetRef which does not exist.
Payload returned by the AI:
The Kubernetes system is trying to scale a StatefulSet named tGLcCRcHa1Ce5Rs using the HorizontalPodAutoscaler, but it cannot find the StatefulSet. The solution is to verify that the StatefulSet name is spelled correctly and exists in the same namespace as the HorizontalPodAutoscaler.
Payload returned to the user:
The Kubernetes system is trying to scale a StatefulSet named fake-deployment using the HorizontalPodAutoscaler, but it cannot find the StatefulSet. The solution is to verify that the StatefulSet name is spelled correctly and exists in the same namespace as the HorizontalPodAutoscaler.
Note: Anonymization does not currently apply to events.
Further Details
Anonymization does not currently apply to events.
In a few analysers like Pod, we feed to the AI backend the event messages which are not known beforehand thus we are not masking them for the time being.
The following is the list of analysers in which data is being masked:-
Statefulset
Service
PodDisruptionBudget
Node
NetworkPolicy
Ingress
HPA
Deployment
Cronjob
The following is the list of analysers in which data is not being masked:-
RepicaSet
PersistentVolumeClaim
Pod
*Events
*Note:
k8gpt will not mask the above analysers because they do not send any identifying information except Events analyser.
Masking for Events analyzer is scheduled in the near future as seen in this issue. Further research has to be made to understand the patterns and be able to mask the sensitive parts of an event like pod name, namespace etc.
The following is the list of fields which are not being masked:-
Describe
ObjectStatus
Replicas
ContainerStatus
*Event Message
ReplicaStatus
Count (Pod)
*Note:
It is quite possible the payload of the event message might have something like "super-secret-project-pod-X crashed" which we don't currently redact (scheduled in the near future as seen in this issue).
Proceed with care
The K8gpt team recommends using an entirely different backend (a local model) in critical production environments. By using a local model, you can rest assured that everything stays within your DMZ, and nothing is leaked.
If there is any uncertainty about the possibility of sending data to a public LLM (open AI, Azure AI) and it poses a risk to business-critical operations, then, in such cases, the use of public LLM should be avoided based on personal assessment and the jurisdiction of risks involved.
Configuration management
k8sgpt stores config data in the $XDG_CONFIG_HOME/k8sgpt/k8sgpt.yaml file. The data is stored in plain text, including your OpenAI key.
Config file locations:
OS
Path
MacOS
~/Library/Application Support/k8sgpt/k8sgpt.yaml
Linux
~/.config/k8sgpt/k8sgpt.yaml
Windows
%LOCALAPPDATA%/k8sgpt/k8sgpt.yaml
There may be scenarios where caching remotely is preferred.
In these scenarios K8sGPT supports AWS S3 or Azure Blob storage Integration.
Remote caching Note: You can only configure and use only one remote cache at a time
Adding a remote cache
AWS S3
As a prerequisite AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY are required as environmental variables.
K8sGPT assumes that the storage account already exist and it will create the container if it does not exist
It is the user responsibility have to grant specific permissions to their identity in order to be able to upload blob files and create SA containers (e.g Storage Blob Data Contributor)
Google Cloud Storage
As a prerequisite GOOGLE_APPLICATION_CREDENTIALS are required as environmental variables.
