Skip to content

Kubernetes

Kubernetes Guides

Guide Use it for
Clusters & Access Cluster inventory, onboarding requirements, login, and access validation
Network Design Ingress and egress traffic paths between WxCDI and Kubed
Application Lifecycle Source, image, chart, configuration, and deployment flow
Deployment Strategy Namespaces, segmentation, dedicated Prometheus, and blast-radius controls
Kubernetes How-To ECR onboarding, cluster login, chart versions, AppRole, and manual-push procedures
Useful Commands Approved diagnostic kubectl and Helm commands
Deployment MoP Exporter rollout, validation, and rollback procedure

Old-to-New Page Mapping

Original page New destination
docs/tools/kubernetes/index.md Kubernetes Overview
docs/tools/kubernetes/clusters.md Clusters & Access
docs/tools/kubernetes/info.md Clusters & Access
docs/tools/kubernetes/onboarding.md Clusters & Access
docs/tools/kubernetes/Network_kubed_wxcdi.md Network Design
docs/tools/kubernetes/Application_Lifecycle.md Application Lifecycle
docs/tools/kubernetes/Deployment_Strategy.md Deployment Strategy
docs/tools/kubernetes/how-to.md Kubernetes How-To
docs/tools/kubernetes/useful_commands.md Useful Commands
docs/tools/kubernetes/Deployment MoP.md Deployment MoP

Role in the Platform

Webex Kubed hosts the WxCDI observability workloads, including exporters, Prometheus instances, Telegraf receivers, syslog forwarding services, and supporting components. Production workloads are documented in the DFW (us-txwcdip1) and SJC (us-cawcdip1) clusters; confirm the current target in the deployment repository before making a change.

Deployment Model

Exporters use namespace and workload isolation to reduce blast radius. The established pattern is:

  • a dedicated namespace, normally o11y-<exporter-name>;
  • one or more exporter deployments segmented by customer set;
  • a dedicated Prometheus deployment for isolated scrape and remote-write behavior;
  • central storage in Mimir;
  • source-controlled charts and environment configuration.
graph LR
    subgraph Cluster["Webex Kubed Cluster"]
        E1["Exporter Segment A"] --> P["Dedicated Prometheus"]
        E2["Exporter Segment B"] --> P
    end
    P -->|"remote_write"| M["Mimir"]
    M --> G["Grafana"]

Customer segmentation allows teams to tune resources and contain failures without removing visibility for every customer served by an exporter.

Network Paths

The Shared Management Firewall provides access control and address translation between the WxCDI management network and Kubed. Inbound telemetry also traverses the managed load-balancing path before reaching a Kubernetes Service.

Direction Use case Destination port
WxCDI to Kubed Syslog UDP/514
WxCDI to Kubed SNMP traps UDP/162
WxCDI to Kubed SFTP transfers TCP/22
WxCDI to Kubed Expressway collectd UDP/25826
Kubed to WxCDI HTTPS APIs TCP/443
Kubed to WxCDI PerfMon API TCP/8443
Kubed to WxCDI SSH collection TCP/22
Kubed to WxCDI SNMP polling UDP/161

Treat this as the expected traffic model, not a firewall request. Validate the destination, source range, protocol, and current design before requesting a rule change.

See Kubernetes Network Design for the complete flow and design references.

Access

Cluster access requires the approved Webex Kubed group/persona, Keeper authentication, and the supported kubectl-wbx3 login workflow. Follow the current Webex Kubed documentation for installation and login because helper versions and identity requirements change.

Never place Keeper tokens, generated certificates, kubeconfig files, or AppRole Secret IDs in tickets, terminal recordings, or this repository.

See Clusters & Access and Kubernetes How-To for the complete onboarding and login procedures.

Safe Operational Commands

Set and verify the context before every investigation:

kubectl config get-contexts
kubectl config current-context
kubectl config use-context <cluster>

Inspect a namespace without changing it:

kubectl get deployments,pods,services -n <namespace>
kubectl get events -n <namespace> --sort-by=.lastTimestamp
kubectl describe deployment <deployment> -n <namespace>
kubectl logs <pod> -n <namespace> --all-containers --since=30m
kubectl rollout status deployment/<deployment> -n <namespace>
kubectl rollout history deployment/<deployment> -n <namespace>

Prefer source-controlled changes through the managed deployment workflow. Do not create production Services or Secrets manually unless an approved emergency procedure explicitly requires it.

See Useful Commands for the expanded diagnostic command reference.

Troubleshooting

Symptom Check first Then check
Pod is pending Events, requests/limits, scheduling constraints Cluster capacity and quota
Crash loop Previous container logs and mounted config Secret references, probes, image compatibility
Metrics missing Exporter health and Prometheus targets Network path, inventory revision, remote write
Traps or syslog missing Service endpoints and receiver logs Load balancer, firewall path, downstream forwarder
Wrong version running Deployment image digest/tag Chart version and environment values
One customer segment failing Segment-specific deployment/config Shared dependency only after segment checks

Internal References