$ kubectl proxy --port 8080 

{
  "paths": [
    "/api",
    "/api/v1",
    "/apis",
    "/apis/apps",
    "/apis/storage.k8s.io/v1",
    .
    .
    .
    "/healthz",
    "/healthz/ping",
    "/logs",
    "/metrics",
    "/swaggerapi/",
    "/ui/",
    "/version"
  ]
} 

{
    "apiVersion": "v1",
    "kind": "Namespace",
    "metadata": {
        "creationTimestamp": "2017-12-25T10:04:26Z",
        "name": "default",
        "resourceVersion": "4",
        "selfLink": "/api/v1/namespaces/default",
        "uid": "fd497868-e95a-11e7-adce-080027c94384"
    },
    "spec": {
        "finalizers": [
            "kubernetes"
        ]
    },
    "status": {
        "phase": "Active"
    }
} 

$ http http://localhost:8080/api/v1/services
{
    "apiVersion": "v1",
    "items": [
        {
            "metadata": {
                "creationTimestamp": "2020-06-15T05:18:30Z",
                "labels": {
                    "component": "apiserver",
                    "provider": "kubernetes"
                },
                "name": "kubernetes",
                …
            },
            "spec": {
                …
            },
            "status": {
                "loadBalancer": {}
            }
        },
        …
    ],
    "kind": "ServiceList",
    "metadata": {
        "resourceVersion": "1076",
        "selfLink": "/api/v1/services"
    }
} 

.items[].metadata.name 

$ http http://localhost:8080/api/v1/services | jq .items[].metadata.name
"kubernetes"
"kube-dns"
"kubernetes-dashboard" 

{
  "kind": "Pod",
  "apiVersion": "v1",
  "metadata":{
    "name": "nginx",
    "namespace": "default",
    "labels": {
      "name": "nginx"
    }
  },
  "spec": {
    "containers": [{
                     "name": "nginx",
                     "image": "nginx",
                     "ports": [{"containerPort": 80}]
                   }]
  }
} 

$ http POST http://localhost:8080/api/v1/namespaces/default/pods @nginx-pod.json 

$ FILTER='.items[].metadata.name,.items[].status.phase'
$ http http://localhost:8080/api/v1/namespaces/default/pods | jq $FILTER
"nginx"
"Running" 

$ pip install kubernetes 

$ python
Python 3.8.0 (default, Jun 15 2020, 16:12:10)
[Clang 10.0.1 (clang-1001.0.46.4)] on Darwin
Type "help", "copyright", "credits" or "license" for more information.
>>> 

>>> from kubernetes import client, config
>>> config.load_kube_config()
>>> v1 = client.CoreV1Api() 

>>> from kubernetes import client, config
>>> client.Configuration().host = 'http://localhost:8080'
>>> v1 = client.CoreV1Api() 

>>> attributes = [x for x in dir(v1) if not x.startswith('__')]
>>> len(attributes)
397 

>>> import random
>>> from pprint import pprint as pp
>>> pp(random.sample(attributes, 10))
['list_namespaced_secret',
 'connect_post_namespaced_pod_proxy',
 'patch_namespaced_replication_controller_with_http_info',
 'patch_node_status_with_http_info',
 'replace_persistent_volume',
 'read_namespaced_service_status',
 'read_namespaced_replication_controller_status',
 'list_namespaced_secret_with_http_info',
 'replace_namespaced_event_with_http_info',
 'replace_namespaced_resource_quota_with_http_info'] 

>>> from collections import Counter
>>> verbs = [x.split('_')[0] for x in attributes] 
>>> pp(dict(Counter(verbs))) 
{'api': 1, 
 'connect': 96, 
 'create': 36, 
 'delete': 56, 
 'get': 2, 
 'list': 56, 
 'patch': 48, 
 'read': 52, 
 'replace': 50} 

>>> help(v1.create_node)
Help on method create_node in module kubernetes.client.apis.core_v1_api:
create_node(body, **kwargs) method of kubernetes.client.apis.core_v1_api.CoreV1Api instance 
create a Node
This method makes a synchronous HTTP request by default. To make 
an asynchronous HTTP request, please pass async_req=True:
>>> thread = api.create_node(body, async_req=True)
>>> result = thread.get()
:param async_req bool
:param V1Node body: (required)
:param str pretty: If 'true', then the output is pretty printed.
:param str dry_run: When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed :param str field_manager: fieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
:return: V1Node
         If the method is called asynchronously,
         returns the request thread. 

for ns in v1.list_namespace().items:
... print(ns.metadata.name)
... 
default 
kube-public
kube-system 

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
spec:
  replicas: 3
  selector:
    matchLabels:
      app: nginx  
  template:
    metadata:
      labels:
         app: nginx
    spec:
      containers:
        - name: nginx
          image: nginx:1.17.8
          ports:
            - containerPort: 80 

$ pip install pyyaml 

from os import path
import yaml from kubernetes import client, config
def main():
# Configs can be set in Configuration class directly or using
# helper utility. If no argument provided, the config will be
# loaded from default location.
config.load_kube_config()
with open(path.join(path.dirname(__file__),
                    'nginx-deployment.yaml')) as f:
    dep = yaml.safe_load(f)
    k8s = client.AppsV1Api()
    dep = k8s.create_namespaced_deployment(body=dep,
                                           namespace="default")
    print(f"Deployment created. status='{dep.status}'")
if __name__ == '__main__': 
    main() 

from kubernetes import client, config, watch
# Configs can be set in Configuration class directly or using helper utility
config.load_kube_config()
v1 = client.CoreV1Api()
count = 3
w = watch.Watch()
for event in w.stream(v1.list_namespace, _request_timeout=60): 
    print(f"Event: {event['type']} {event['object'].metadata.name}")
    count -= 1 if count == 0: w.stop()
print('Done.') 

$ python watch_demo.py
Event: ADDED default
Event: ADDED kube-public
Event: ADDED kube-system
Done. 

>>> import subprocess 
>>> out = subprocess.check_output('kubectl').decode('utf-8')
>>> print(out[:276])
kubectl controls the Kubernetes cluster manager.
Find more information at: https://kubernetes.io/docs/reference/kubectl/overview/
Here are some basic Commands for beginners:
create          Create a resource from a file or from stdin. 
expose          Take a replication controller, servic 

from subprocess import check_output
def k(*args): 
    out = check_output(['kubectl'] + list(args))
    return out.decode('utf-8') 

>>> from k import k
>>> print(k('get', 'po'))
NAME                               READY   STATUS    RESTARTS    AGE
nginx                              1/1     Running   0           4h48m
nginx-deployment-679f9c75b-c79mv   1/1     Running   0           132m
nginx-deployment-679f9c75b-cnmvk   1/1     Running   0           132m
nginx-deployment-679f9c75b-gzfgk   1/1     Running   0           132m 

from subprocess import check_output 
import json
def k(*args, use_json=False):
    cmd = ['kubectl'] + list(args)
    if use_json:
        cmd += ['-o', 'json']
    out = check_output(cmd).decode('utf-8')
    if use_json:
        out = json.loads(out, )
return out 

>>> result = k('get', 'po', use_json=True)
>>> for r in result['items']: 
...     print(r['metadata']['name']) 
... 
nginx-deployment-679f9c75b-c79mv 
nginx-deployment-679f9c75b-cnmvk 
nginx-deployment-679f9c75b-gzfgk 

k('delete', 'deployment', 'nginx-deployment') 
while len(k('get', 'po', use_json=True)['items']) > 0: 
    print('.') print('Done.')
.
.
.
.
Done. 

apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  # name must match the spec fields below, and be in the form: <plural>.<group>
  name: candies.awesome.corp.com
spec:
  # group name to use for REST API: /apis/<group>/<version>
  group: awesome.corp.com
  # version name to use for REST API: /apis/<group>/<version>
  versions:
    - name: v1
      # Each version can be enabled/disabled by Served flag.
      served: true
      # One and only one version must be marked as the storage version.
      storage: true
      schema:
        openAPIV3Schema:
          type: object
          properties:
            spec:
              type: object
              properties:
                flavor:
                  type: string
  # either Namespaced or Cluster
  scope: Namespaced
  names:
    # plural name to be used in the URL: /apis/<group>/<version>/<plural>
    plural: candies
    # singular name to be used as an alias on the CLI and for display
    singular: candy
    # kind is normally the CamelCased singular type. Your resource manifests use this.
    kind: Candy
    # shortNames allow shorter string to match your resource on the CLI
    shortNames:
      - cn 

$ kubectl create -f candy-crd.yaml
customresourcedefinition.apiextensions.k8s.io/candies.awesome.corp.com created 

$ kubectl get crd
NAME                     CREATED AT 
candies.awesome.corp.com 2020-06-15T10:19:09Z 

/apis/awesome.corp.com/v1/namespaces/<namespace>/candies/ 

apiVersion: awesome.corp.com/v1 
kind: Candy 
metadata: 
    name: chocolate 
spec: 
    flavor: sweeeeeeet 

$ k create -f chocolate.yaml 
candy.awesome.corp.com/chocolate created 

$ kubectl get candies 
NAME AGE chocolate 2m 

$ kubectl get cn -o json
{
    "apiVersion": "v1",
    "items": [
        {
            "apiVersion": "awesome.corp.com/v1",
            "kind": "Candy",
            "metadata": {
                "creationTimestamp": "2020-06-15T10:22:25Z",
                "generation": 1,
                "name": "chocolate",
                "namespace": "default",
                "resourceVersion": "1664",
                "selfLink": "/apis/awesome.corp.com/v1/namespaces/default/candies/chocolate",
                "uid": "1b04f5a9-9ae8-475d-bc7d-245042759304"
            },
            "spec": {
                "flavor": "sweeeeeeet"
            }
        }
    ],
    "kind": "List",
    "metadata": {
        "resourceVersion": "",
        "selfLink": ""
    }
} 

apiVersion: awesome.corp.com/v1 
kind: Candy 
metadata: 
    name: gummy-bear 
spec: 
    flavor: delicious 
    texture: rubbery 

$ kubectl create -f gummy-bear.yaml
error: error validating "gummy-bear.yaml": error validating data: ValidationError(Candy.spec): unknown field "texture" in com.corp.awesome.v1.Candy.spec; if you choose to ignore these errors, turn validation off with --validate=false 

$ kubectl create -f gummy-bear.yaml --validate=false 
candy.awesome.corp.com/gummy-bear created
$ kubectl get cn gummy-bear -o yaml 
apiVersion: awesome.corp.com/v1 
kind: Candy 
metadata: 
  creationTimestamp: "2020-06-15T22:02:18Z" 
  generation: 1 
  name: gummy-bear 
  namespace: default 
  resourceVersion: "93551" 
  selfLink: /apis/awesome.corp.com/v1/namespaces/default/candies/gummy-bear 
  uid: 1900b97e-55ba-4235-8366-24f469f449e3 
spec: 
  flavor: delicious 

apiVersion: awesome.corp.com/v1 
kind: Candy 
metadata: 
  name: chocolate 
  finalizers: 
  - eat-me 
  - drink-me 
spec: 
  flavor: sweeeeeeet 

$ kubectl get cn 
NAME       AGE 
chocolate  11h 
gummy-bear 16m 

apiVersion: apiextensions.k8s.io/v1 
kind: CustomResourceDefinition 
metadata: 
  name: candies.awesome.corp.com 
spec: 
  group: awesome.corp.com 
  versions: 
    - name: v1 
      ... 
      additionalPrinterColumns: 
      - name: Flavor 
        type: string 
        description: The flavor of the candy 
        jsonPath: .spec.flavor 
      - name: Age 
        type: date 
        jsonPath: .metadata.creationTimestamp 
  ... 

$ kubectl create -f candy-with-flavor-crd.yaml
customresourcedefinition.apiextensions.k8s.io/candies.awesome.corp.com created
$ kubectl create -f chocolate.yaml 
candy.awesome.corp.com/chocolate created
$ kubectl create -f gummy-bear.yaml --validate=false 
candy.awesome.corp.com/gummy-bear created
$ kubectl get candies 
NAME        FLAVOR      AGE 
chocolate   sweeeeeeet  64s 
gummy-bear  delicious   59s 

apiVersion: v1
kind: Pod 
metadata: 
name: some-pod-manual-scheduling 
spec: 
containers: 
- name: some-container 
image: gcr.io/google_containers/pause:2.0 
nodeName: k3d-k3s-default-worker-1 
schedulerName: no-such-scheduler 

$ kubectl describe po some-pod-manual-scheduling 
Name: some-pod-manual-scheduling 
Node: k3d-k3s-default-worker-1/172.19.0.4 
Status: Running 
  ... 
Containers: 
  ... 
Conditions: 
  Type             Status 
  Initialized      True 
  Ready            True 
  ContainersReady  True 
  PodScheduled     True 
Events:      <none> 

from kubernetes import client, config, watch
def schedule_pod(cli, name): 
    target = client.V1ObjectReference() 
    target.kind = 'Node' 
    target.apiVersion = 'v1' 
    target.name = 'k3d-k3s-default-worker-1' 
    meta = client.V1ObjectMeta() 
    meta.name = name 
    body = client.V1Binding(metadata=meta, target=target) 
    return cli.create_namespaced_binding('default', body)
def main(): 
    config.load_kube_config() 
    cli = client.CoreV1Api() 
    w = watch.Watch() 
    for event in w.stream(cli.list_namespaced_pod, 'default'): 
        o = event['object'] 
        if o.status.phase != 'Pending' or o.spec.scheduler_name != 'custom-scheduler': 
            continue

        schedule_pod(cli, o.metadata.name)
if __name__ == '__main__': 
    main() 

if o.status.phase != 'Pending' or o.spec.scheduler_name != 'custom-scheduler':
    continue 

apiVersion: v1
kind: Pod
metadata: 
  name: some-pod-with-custom-scheduler
spec:
  containers:
    - name: some-container
    image: gcr.io/google_containers/pause:2.0
  schedulerName: custom-scheduler 

$ kubectl create -f some-pod-with-custom-scheduler.yaml
pod/some-pod-with-custom-scheduler created
$ kubectl get po
NAME                            READY  STATUS   RESTARTS  AGE
some-pod-manual-scheduling      1/1    Running  0         23h
some-pod-with-custom-scheduler  0/1    Pending  0         25s 

$ python custom_scheduler.py
Waiting for pods to schedule
Scheduling pod some-pod-with-custom-scheduler 

$ kubectl get pod -o wide
NAME                            READY  STATUS   IP         NODE
some-pod-manual-scheduling      1/1    Running  10.42.0.5  k3d-k3s-default-worker-1
some-pod-with-custom-scheduler  1/1    Running  10.42.0.8  k3d-k3s-default-worker-1 

$ kubectl describe po some-pod | grep Events: -A 10
Events:
  Type    Reason     Age        From                               Message
  ----    ------     ----       ----                               -------
  Normal  Scheduled  <unknown>  default-scheduler                  Successfully assigned default/some-pod to k3d-k3s-default-worker-0
  Normal  Pulled     12m        kubelet, k3d-k3s-default-worker-0  Container image "gcr.io/google_containers/pause:2.0" already present on machine
  Normal  Created    12m        kubelet, k3d-k3s-default-worker-0  Created container some-container
  Normal  Started    12m        kubelet, k3d-k3s-default-worker-0  Started container some-container 

$ k describe po some-pod-with-custom-scheduler | grep Events: -A 10 
Events:
  Type    Reason   Age   From                               Message
  ----    ------   ----  ----                               -------
  Normal  Pulled   22m   kubelet, k3d-k3s-default-worker-1  Container image "gcr.io/google_containers/pause:2.0" already present on machine
  Normal  Created  22m   kubelet, k3d-k3s-default-worker-1  Created container some-container
  Normal  Started  22m   kubelet, k3d-k3s-default-worker-1  Started container some-container 

$ k krew
  krew is the kubectl plugin manager.
  You can invoke krew through kubectl: "kubectl krew [command]..."
  Usage: 
    krew [command]
Available Commands: 
  help       Help about any command 
  info       Show information about a kubectl plugin 
  install    Install kubectl plugins 
  list       List installed kubectl plugins 
  search     Discover kubectl plugins 
  uninstall  Uninstall plugins 
  update     Update the local copy of the plugin index 
  upgrade    Upgrade installed plugins to newer versions 
  version    Show krew version and diagnostics
Flags: 
  -h, --help help for krew 
  -v, --v Level number for the log level verbosity
Use "krew [command] --help" for more information about a command. 

#!/usr/bin/env python3
import sh
def main():
    """ """
    o = "-o custom-columns='NAME:.metadata.name,DEPLOYMENT:.metadata.ownerReferences[0].name,REPLICAS:.spec.replicas"
    all_rs = sh.kubectl.get.rs(o.split()).stdout.decode('utf-8').split('\n')
    all_rs = [r.split() for r in all_rs if r]
    results = ((name, deployment) for (name, deployment, replicas) in all_rs[1:] if replicas == '0')
    for name, deployment in results:
        print(name, deployment)
if __name__ == '__main__':
    main() 

$ chmod +x kubectl-show-stale_replica_sets
$ kubectl show stale-replica-sets
cool-app-559f7bd67c cool-app 
cool-app-55dc8c5949 cool-app 
mice-app-5bd847f99c nice-app 

$ k show stale-replica-sets 
exec format error 

$ kubectl get stale-replica-sets 
error: the server doesn't have a resource type "stale-replica-sets" 

# Kubernetes API version
apiVersion: v1
# kind of the API object
kind: Config
# clusters refers to the remote service.
clusters:
  - name: name-of-remote-authn-service
    cluster:
      certificate-authority: /path/to/ca.pem         # CA for verifying the remote service.
      server: https://authn.example.com/authenticate # URL of remote service to query. Must use 'https'.
# users refers to the API server's webhook configuration.
users:
  - name: name-of-api-server
    user:
      client-certificate: /path/to/cert.pem # cert for the webhook plugin to use       client-key: /path/to/key.pem          # key matching the cert
# kubeconfig files require a context. Provide one for the API server.
current-context: webhook
contexts:
- context:
    cluster: name-of-remote-authn-service
    user: name-of-api-sever
  name: webhook 

{
  "apiVersion": "authentication.k8s.io/v1beta1",
  "kind": "TokenReview",
  "spec": {
    "token": "<bearer token from original request headers>"
  }
} 

{
  "apiVersion": "authentication.k8s.io/v1beta1",
  "kind": "TokenReview",
  "status": {
    "authenticated": true,
    "user": {
      "username": "gigi@gg.com",
      "uid": "42",
      "groups": [
        "developers",
      ],
      "extra": {
        "extrafield1": [
          "extravalue1",
          "extravalue2"
        ]
      }
    }
  }
} 

{
  "apiVersion": "authentication.k8s.io/v1beta1",
  "kind": "TokenReview",
  "status": {
    "authenticated": false
  }
} 

--authorization-webhook-config-file=<configuration filename> 

{
  "apiVersion": "authorization.k8s.io/v1beta1",
  "kind": "SubjectAccessReview",
  "spec": {
    "resourceAttributes": {
      "namespace": "awesome-namespace",
      "verb": "get",
      "group": "awesome.example.org",
      "resource": "pods"
    },
    "user": "gigi@gg.com",
    "group": [
      "group1",
      "group2"
    ]
  }
} 

{
  "apiVersion": "authorization.k8s.io/v1beta1",
  "kind": "SubjectAccessReview",
  "status": {
    "allowed": true
  }
} 

{
  "apiVersion": "authorization.k8s.io/v1beta1",
  "kind": "SubjectAccessReview",
  "status": {
    "allowed": false,
    "reason": "user does not have read access to the namespace"
  }
} 

{
  "apiVersion": "authorization.k8s.io/v1beta1",
  "kind": "SubjectAccessReview",
  "spec": {
    "nonResourceAttributes": {
      "path": "/logs",
      "verb": "get"
    },
    "user": "gigi@gg.com",
    "group": [
      "group1",
      "group2"
    ]
  }
} 

$ kubectl auth can-i create deployments
yes 

$ kubectl auth can-i create deployments --as default
no 

--admission-control=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota 

apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
...
webhooks:
- name: admission-webhook.example.com
  rules:
  - operations: ["CREATE", "UPDATE"]
    apiGroups: ["apps"]
    apiVersions: ["v1", "v1beta1"]
    resources: ["deployments", "replicasets"]
    scope: "Namespaced"
  ... 

{
  "apiVersion": "admission.k8s.io/v1",
  "kind": "AdmissionReview",
  "request": {
    "uid": "705ab4f5-6393-11e8-b7cc-42010a800002",
    "kind": {"group":"autoscaling","version":"v1","kind":"Scale"},
    "resource": {"group":"apps","version":"v1","resource":"deployments"},
    "subResource": "scale",
    "requestKind": {"group":"autoscaling","version":"v1","kind":"Scale"},
    "requestResource": {"group":"apps","version":"v1","resource":"deployments"},
    "requestSubResource": "scale",
    "name": "cool-deployment",
    "namespace": "cool-namespace",
    "operation": "UPDATE",
    "userInfo": {
      "username": "admin",
      "uid": "014fbff9a07c",
      "groups": ["system:authenticated","my-admin-group"],
      "extra": {
        "some-key":["some-value1", "some-value2"]
      }
    },
    "object": {"apiVersion":"autoscaling/v1","kind":"Scale",...},
    "oldObject": {"apiVersion":"autoscaling/v1","kind":"Scale",...},
    "options": {"apiVersion":"meta.k8s.io/v1","kind":"UpdateOptions",...},
    "dryRun": false
  }
} 

{
  "apiVersion": "admission.k8s.io/v1",
  "kind": "AdmissionReview",
  "response": {
    "uid": "<value from request.uid>",
    "allowed": true
  }
} 

{
  "apiVersion": "admission.k8s.io/v1",
  "kind": "AdmissionReview",
  "response": {
    "uid": "<value from request.uid>",
    "allowed": false,
    "status": {
      "code": 403,
      "message": "You cannot do this because I say so!!!!"
    }
  }
} 

type CustomMetricsProvider interface {
    // GetMetricByName fetches a particular metric for a particular object.
    // The namespace will be empty if the metric is root-scoped.
    GetMetricByName(name types.NamespacedName, 
                    info CustomMetricInfo, 
                    metricSelector labels.Selector) (*custom_metrics.MetricValue, error)
    // GetMetricBySelector fetches a particular metric for a set of objects matching
    // the given label selector.  The namespace will be empty if the metric is root-scoped.
    GetMetricBySelector(namespace string, selector labels.Selector, info CustomMetricInfo, metricSelector labels.Selector) (*custom_metrics.MetricValueList, error)
    // ListAllMetrics provides a list of all available metrics at
    // the current time.  Note that this is not allowed to return
    // an error, so it is reccomended that implementors cache and
    // periodically update this list, instead of querying every time.
    ListAllMetrics() []CustomMetricInfo
} 

service Controller {
  rpc CreateVolume (CreateVolumeRequest)
    returns (CreateVolumeResponse) {}
  rpc DeleteVolume (DeleteVolumeRequest)
    returns (DeleteVolumeResponse) {}
  rpc ControllerPublishVolume (ControllerPublishVolumeRequest)
    returns (ControllerPublishVolumeResponse) {}
  rpc ControllerUnpublishVolume (ControllerUnpublishVolumeRequest)
    returns (ControllerUnpublishVolumeResponse) {}
  rpc ValidateVolumeCapabilities (ValidateVolumeCapabilitiesRequest)
    returns (ValidateVolumeCapabilitiesResponse) {}
  rpc ListVolumes (ListVolumesRequest)
    returns (ListVolumesResponse) {}
  rpc GetCapacity (GetCapacityRequest)
    returns (GetCapacityResponse) {}
  rpc ControllerGetCapabilities (ControllerGetCapabilitiesRequest)
    returns (ControllerGetCapabilitiesResponse) {}  
}