Subchapter 15.7

AKS Baseline

Appservice Diagnosticsscripts

Containerapp Diagnosticsscripts

Run Igscripts

35 more in the appendix

scripts/aks-baseline.sh

Raw file

microsoft/azure-skills

scripts/aks-baseline.sh

Shell159 lines7 KB

1#!/usr/bin/env bash
2# aks-baseline.sh
3# Runs the read-only AKS cluster baseline diagnostic sweep and prints a single
4# labeled digest instead of many raw command dumps. Gathers, in order:
5#   1. Cluster provisioning state          (az aks show)
6#   2. Node pool summary                   (az aks nodepool list)
7#   3. Recent Azure activity               (az monitor activity-log list)
8#   4. Node readiness                      (kubectl get nodes)
9#   5. Unhealthy pods across namespaces    (kubectl get pods -A; not Ready, bad status, or restarting)
10#   6. kube-system health                  (kubectl get pods -n kube-system)
11#   7. Recent warning events               (kubectl get events -A)
12#   8. Namespace pod overview (optional)   (kubectl get pods -n <namespace>)
13#

aks-baseline.sh on GitHub

# All steps are READ-ONLY. Each step is guarded so a single failure (for example,

# kubectl not authenticated) prints a note and the sweep continues.

#

# Usage:

# ./aks-baseline.sh -g <resource-group> -n <cluster> [--namespace <ns>] [--subscription <id>]

#

# Examples:

# ./aks-baseline.sh -g my-rg -n my-cluster

# ./aks-baseline.sh -g my-rg -n my-cluster --namespace payments

set -uo pipefail

RESOURCE_GROUP=""

CLUSTER=""

NAMESPACE=""

SUBSCRIPTION=""

usage() {

echo "Usage: $0 -g <resource-group> -n <cluster> [--namespace <ns>] [--subscription <id>]" >&2

exit "${1:-1}"

}

require_value() {

# require_value <option-name> <remaining-arg-count>

if [ "$2" -lt 2 ]; then

echo "Missing value for $1" >&2

usage 1

fi

}

while [ $# -gt 0 ]; do

case "$1" in

-g|--resource-group) require_value "$1" "$#"; RESOURCE_GROUP="$2"; shift 2 ;;

-n|--cluster) require_value "$1" "$#"; CLUSTER="$2"; shift 2 ;;

--namespace) require_value "$1" "$#"; NAMESPACE="$2"; shift 2 ;;

--subscription) require_value "$1" "$#"; SUBSCRIPTION="$2"; shift 2 ;;

-h|--help) usage 0 ;;

*) echo "Unknown argument: $1" >&2; usage 1 ;;

esac

done

[ -z "$RESOURCE_GROUP" ] && { echo "Missing required -g/--resource-group" >&2; usage 1; }

[ -z "$CLUSTER" ] && { echo "Missing required -n/--cluster" >&2; usage 1; }

AZ_SUB_ARGS=()

[ -n "$SUBSCRIPTION" ] && AZ_SUB_ARGS=(--subscription "$SUBSCRIPTION")

section() {

echo ""

echo "=============================================================="

echo "== $1"

echo "=============================================================="

}

run() {

# run "<description>" <command...>

local desc="$1"; shift

if ! "$@"; then

echo " [!] Could not gather: $desc (command failed or unavailable)"

fi

}

echo "AKS baseline diagnostic sweep (read-only)"

echo "Resource group: $RESOURCE_GROUP"

echo "Cluster: $CLUSTER"

[ -n "$NAMESPACE" ] && echo "Namespace: $NAMESPACE"

# 1. Cluster provisioning state ------------------------------------------------

section "1. Cluster provisioning state"

run "cluster provisioning state" \

az aks show -g "$RESOURCE_GROUP" -n "$CLUSTER" ${AZ_SUB_ARGS[@]+"${AZ_SUB_ARGS[@]}"} \

--query "{name:name, provisioningState:provisioningState, powerState:powerState.code, k8sVersion:currentKubernetesVersion, fqdn:fqdn}" \

-o table

# 2. Node pool summary ---------------------------------------------------------

section "2. Node pool summary"

run "node pool summary" \

az aks nodepool list -g "$RESOURCE_GROUP" --cluster-name "$CLUSTER" ${AZ_SUB_ARGS[@]+"${AZ_SUB_ARGS[@]}"} \

--query "[].{name:name, mode:mode, count:count, vmSize:vmSize, state:provisioningState, powerState:powerState.code, k8sVersion:orchestratorVersion}" \

-o table

# 3. Recent Azure activity -----------------------------------------------------

section "3. Recent Azure activity (last 20 events)"

run "recent activity log" \

az monitor activity-log list -g "$RESOURCE_GROUP" ${AZ_SUB_ARGS[@]+"${AZ_SUB_ARGS[@]}"} \

--max-events 20 \

--query "[].{time:eventTimestamp, operation:operationName.value, status:status.value, resource:resourceId}" \

-o table

# 4. Node readiness ------------------------------------------------------------

section "4. Node readiness"

run "node readiness" kubectl get nodes -o wide

# 5. Unhealthy pods ------------------------------------------------------------

# Filter on the READY and STATUS columns (not just pod phase) so container-level

# failures such as CrashLoopBackOff / ImagePullBackOff — which stay in phase

# "Running" — are caught. Terminal pods (Completed/Succeeded) are excluded so

# finished jobs are not falsely flagged.

section "5. Unhealthy pods (CrashLoopBackOff, not Ready, restarting, or bad status)"

ALL_PODS="$(kubectl get pods -A -o wide 2>/dev/null)"

if [ -z "$ALL_PODS" ]; then

echo " No pods reported (or cluster unreachable)."

else

UNHEALTHY="$(printf '%s\n' "$ALL_PODS" | awk 'NR>1 {

split($3, ready, "/");

status = $4;

restarts = $5 + 0;

terminalOk = (status == "Completed" || status == "Succeeded");

notReady = (status == "Running" && ready[1] != ready[2]);

badStatus = (status != "Running" && !terminalOk);

highRestarts = (!terminalOk && restarts >= 5);

if (notReady || badStatus || highRestarts) print

}')"

if [ -n "$UNHEALTHY" ]; then

printf '%s\n' "$ALL_PODS" | head -n 1

printf '%s\n' "$UNHEALTHY"

else

echo " All pods are Running/Succeeded and Ready with low restart counts."

fi

# 6. kube-system health --------------------------------------------------------

section "6. kube-system health"

run "kube-system pods" kubectl get pods -n kube-system -o wide

# 7. Recent warning events -----------------------------------------------------

section "7. Recent warning events (last 40, sorted by time)"

run "warning events" bash -c \

"set -o pipefail; kubectl get events -A --field-selector=type=Warning --sort-by=.lastTimestamp 2>/dev/null | tail -n 40"

# 8. Namespace pod overview (optional) ----------------------------------------

if [ -n "$NAMESPACE" ]; then

section "8. Pods in namespace '$NAMESPACE'"

run "pods in namespace $NAMESPACE" kubectl get pods -n "$NAMESPACE" -o wide

fi

# Summary ----------------------------------------------------------------------

section "Summary"

echo "Gathered the read-only AKS baseline for cluster '$CLUSTER' in resource group"

echo "'$RESOURCE_GROUP': Azure-side cluster/node-pool state and recent activity, then"

echo "Kubernetes-side node readiness, unhealthy pods, kube-system health, and recent"

echo "warning events. Review the sections above for anomalies (non-Succeeded"

echo "provisioning state, NotReady nodes, unhealthy or restarting pods, warning events)"

echo "before deep-diving with 'kubectl describe' / 'kubectl logs' on a specific pod."

echo ""

echo "No changes were made to any resource."