NAME¶

glab-cluster-graph - Queries the Kubernetes object graph, using the GitLab Agent for Kubernetes. (EXPERIMENTAL)

SYNOPSIS¶

glab cluster graph [flags]

DESCRIPTION¶

This command starts a web server that shows a live view of the Kubernetes object graph in a browser. It uses the GitLab Agent for Kubernetes running in the cluster. It requires:

• Version 18.1 or later of GitLab and the GitLab Agent.
• At least the Developer role in the agent project.
• This command requires a personal access token or project access token for authentication. The token must have the read_api and k8s_proxy scopes.

Leave feedback in issue 7900 ⟨https://gitlab.com/gitlab-org/cli/-/issues/7900⟩.

OPTIONS¶

-a, --agent=0 The numerical Agent ID to connect to.

--apps[=false] Watch deployments, replicasets, daemonsets, and statefulsets in apps/v1 group.

--batch[=false] Watch jobs and cronjobs in the batch/v1 group.

--cluster-rbac[=false] Watch clusterroles and clusterrolebindings in the rbac.authorization.k8s.io/v1 group.

--core[=false] Watch pods, secrets, configmaps, and serviceaccounts in the core/v1 group

--crd[=false] Watch customresourcedefinitions in the apiextensions.k8s.io/v1 group.

--ignore-arc-direction[=false] Ignore arc direction when evaluating roots connectivity. GitLab and agent 18.3+ required.

--listen-addr="localhost:0" Address to listen on.

--listen-net="tcp" Network on which to listen for connections.

--log-watch-request[=false] Log watch request to stdout. Helpful for debugging.

-n, --namespace=[] Namespaces to watch. If not specified, all namespaces are watched with label and field selectors filtering.

--ns-expression="" CEL expression to select namespaces. Evaluated before a namespace is watched and on any updates for the namespace object.

--ns-field-selector="" Field selector to select namespaces.

--ns-label-selector="" Label selector to select namespaces.

--rbac[=false] Watch roles, and rolebindings in the rbac.authorization.k8s.io/v1 group.

-r, --resource=[] A list of resources to watch. You can see the list of resources your cluster supports by running 'kubectl api-resources'.

--root-expression=[] CEL expression to select root objects. GitLab and agent 18.3+ required.

--stdin[=false] Read watch request from standard input.

OPTIONS INHERITED FROM PARENT COMMANDS¶

-h, --help[=false] Show help for this command.

-R, --repo="" Select another repository. Can use either OWNER/REPO or GROUP/NAMESPACE/REPO format. Also accepts full URL or Git URL.

EXAMPLE¶

# Run the default query for agent 123
$ glab cluster graph -R user/project -a 123
# Show common resources from the core and RBAC groups
$ glab cluster graph -R user/project -a 123 --core --rbac
# Show certain resources
$ glab cluster graph -R user/project -a 123 --resource=pods --resource=configmaps
# Same as above, but more compact
$ glab cluster graph -R user/project -a 123 -r={pods,configmaps}
# Select a certain namespace
$ glab cluster graph -R user/project -a 123 -n={my-ns,my-stuff}
# Select all namespaces that have a certain annotation
$ glab cluster graph -R user/project -a 123 --ns-expression='"my-annotation" in annotations'
# Advanced usage - pass the full query directly via stdin.
# The query below watches service accounts in all namespaces except for the kube-system.
$ Q='{"queries":[{"include":{"resource_selector_expression":"resource == \"serviceaccounts\""}}],"namespaces":{"object_selector_expression":"name != \"kube-system\""}}'
$ echo -n "$Q" | glab cluster graph -R user/project -a 123 --stdin
# Roots filtering
$ glab cluster graph -R user/project -a 123 --root-expression 'group == "" && resource == "pods"'

SEE ALSO¶

glab-cluster(1)