Powered by Open Source
Four tools, one workflow: Query with Steampipe, report with Powerpipe, act with Flowpipe, analyze logs with Tailpipe.
select name, namespace, phase, creation_timestamp, pod_ip from kubernetes_pod;
+-----------------------------------------+-------------+-----------+---------------------+-----------+ | name | namespace | phase | creation_timestamp | pod_ip | +-----------------------------------------+-------------+-----------+---------------------+-----------+ | metrics-server-86cbb8457f-bf8dm | kube-system | Running | 2021-06-11 14:21:48 | 10.42.0.5 | | coredns-7448499f4d-klb8l | kube-system | Running | 2021-06-11 14:21:48 | 10.42.0.6 | | helm-install-traefik-crd-hb87d | kube-system | Succeeded | 2021-06-11 14:21:48 | 10.42.0.3 | +-----------------------------------------+-------------+-----------+---------------------+-----------+
Query Kubernetes with SQL
The Kubernetes plugin provides 39 tables covering pods, deployments, services, namespaces, roles, and more. Query live clusters, local manifest files, or Helm charts - all with familiar SQL. Connect multiple clusters via kubeconfig contexts with support for OIDC auth, service accounts, and CRDs.
Learn more →
Compliance & Security Benchmarks
The Kubernetes Compliance mod includes 790 benchmarks covering CIS v1.7.0 and NSA/CISA Kubernetes Hardening Guidance. Run compliance scans against your clusters in minutes with interactive dashboards to visualize your security posture.
Learn more →
Inventory & Relationship Graphs
The Kubernetes Insights mod visualizes how your resources interconnect. See namespace hierarchies, deployment relationships, service mappings, and pod configurations at a glance - more than kubectl through interactive relationship graphs and detailed dashboards.
pipeline "notify_privileged_containers" {
step "query" "find_privileged" {
database = connection.steampipe.default
sql = <<-EOQ
select namespace, pod_name, name
from kubernetes_pod_container
where security_context ->> 'privileged' = 'true'
EOQ
}
step "http" "notify_slack" {
url = "https://hooks.slack.com/..."
method = "POST"
body = jsonencode({ text = "Found privileged containers" })
}
}
Automate Kubernetes Operations
Build workflows that respond to your Kubernetes data. Use the query step to connect to Steampipe - when a query returns results, Flowpipe can notify your team, create tickets, or use HTTP steps to call the Kubernetes API directly.
Learn more →partition "kubernetes_pod_log" "cluster_logs" {
source "file" {
paths = ["/var/log/pods/**/*.log"]
file_layout = "%{NAMESPACE}_%{POD}_%{CONTAINER}/%{NUMBER}.log"
patterns = {
"NAMESPACE" = "[a-z0-9-]+"
"POD" = "[a-z0-9-]+"
}
}
}
Analyze Kubernetes Logs
Tailpipe is an open source SIEM for instant log insights. Use the file source to collect and parse Kubernetes pod logs with custom Grok patterns, then query millions of events with SQL. Interested in a dedicated Kubernetes plugin? We welcome OSS contributions or reach out to discuss.
Learn more →
Bring It Together in Turbot Pipes
Turbot Pipes is the hosted platform for Steampipe, Powerpipe, Flowpipe, and Tailpipe. Run dashboards and benchmarks on a schedule, collaborate with your team, and share snapshots - without managing infrastructure.
At the moment, the Kubernetes plugin and mods are not supported in Pipes. Connect with us over email or the #pipes channel in the Turbot Community if you're interested.
Learn more →