HackBlue

Tools · Containers and Kubernetes security · 23 / 23

The kubectl context is the cluster you asked

The current context names which cluster and user the command used. A pod list from a lab context is not a prod list. Write the context on the paste. A screenshot that cropped it does not identify the cluster.

9 min read · practice only with authorization

The context selects the API

kubectl uses the current context unless the command names another one. That context is a cluster, a user, and sometimes a namespace in your kubeconfig. The objects you got back came from that API. They did not come from every cluster in the file.

A context named lab-kind is the lab cluster that name points at. The word lab in the name is a label you chose. The note still needs the context string, not a guess about prod.

A cropped paste loses the cluster

If the screenshot shows pods and not the context, write “context not in the paste.” Do not assign the list to prod because the meeting was about prod. Someone can rerun the get with the context printed.

Two contexts can have a pod with the same name. The name without the context is not one pod.

What to write down

File the context, the namespace, and the objects. If you used --context on the command, file that flag. If the context was current and you did not print it, say it was not printed.

Lab: a lab list filed as prod

The shell’s current context is lab-kind. kubectl get pods -n team-a shows lab-web. The screenshot used in the review crops the context line. A draft says prod is running lab-web.

The note says the saved context was lab-kind and the paste used in the review does not show it. Prod was not queried. lab-web is recorded for lab-kind, namespace team-a. The prod sentence is removed.

Snippet
current-context: lab-kind
command: kubectl get pods -n team-a
pod: lab-web
review screenshot: context cropped
prod: not queried
write: lab-kind, team-a, lab-web
not: prod is running lab-web

Diagram

A named context and a cropped list

The objects belong to the API you actually called.

Context recorded

Says. Which cluster and user were used

A pod list. Can be filed for that cluster

Same pod name elsewhere. Still a different context

Context cropped

Says. Nothing about the cluster

A pod list. Cannot be filed as prod

Write. Context not in the paste

Check yourself

1. The current context is lab-kind and get pods shows lab-web. Which cluster was asked?

2. The screenshot has pods and no context. What do you write?

3. Two contexts each have a pod named lab-web. What are they?