datus-k8s-plugin

A Datus plugin for inspecting and operating namespace-scoped Kubernetes data workloads through datus k8s. Its command surface follows familiar kubectl verbs while using the Kubernetes Python client rather than a kubectl binary.

Install

datus plugin install src:./datus-k8s-plugin

Configure

For a managed Kubernetes cluster, configure the cloud plugin once and reference it from a small k8s profile. Profiles with the same name are linked automatically; allowed_namespaces defaults to the selected namespace:

agent:
  plugins:
    eks:
      datus-dev:
        default: true
        cluster: datus-dev-eks-cluster
        region: us-east-1
        role_arn: arn:aws:iam::123456789012:role/datus-operator
    k8s:
      datus-dev:
        default: true
        provider: eks
        namespace: analytics
        allowed_namespaces: analytics,analytics-staging

The k8s plugin asks datus eks --profile datus-dev for the EKS endpoint, CA, and a short-lived credential. It never runs the cloud CLI and never persists complete kubeconfig or bearer tokens. Providers may return a client certificate/private key through the standard Kubernetes ExecCredential contract; those are held in owner-only temporary files and removed when the datus k8s process exits. provider_profile defaults to the k8s profile name. Set it only when the two profile names differ. When the provider profile is loaded with a non-default --config, set provider_config to that agent.yml path so nested calls resolve the same config.

Kubeconfig-backed clusters remain supported:

agent:
  plugins:
    k8s:
      prod:
        default: true
        kubeconfig: ./conf/kubeconfig.yaml
        # context is optional; current-context is used when omitted
        context: prod
        namespace: analytics
        allowed_namespaces: analytics,analytics-staging

Relative kubeconfig paths resolve from the directory where Datus is started and cannot escape it. Absolute paths and ${KUBECONFIG} are also accepted. Credentials remain inside kubeconfig.

Commands

Read-only:

datus k8s get pods -n analytics
datus k8s logs pod-name -n analytics --tail 200 --all-containers
datus k8s events -n analytics
datus k8s top pod -n analytics
datus k8s rollout status deployment/worker -n analytics

Tables are shaped per kind, so a failure is visible without fetching the object: pods carry READY/RESTARTS and report Init:CrashLoopBackOff rather than the bare phase, events carry TYPE/REASON/MESSAGE, and any other resource falls back to the conventional status fields (phase, state, lifecycleState) with status.error in the MESSAGE column under -o wide. To read one field, ask for it:

datus k8s get flinkdeployment orders -n analytics -o 'jsonpath={.status.jobStatus.state}'

The plugin intentionally has no generic blocking wait command. Re-check asynchronous resources with bounded get calls so each observation can inspect the resource's actual status, error, pods, and events before continuing.

State-changing commands (create, apply, delete, patch, scale, rollout restart, label, and annotate) always require agent confirmation. So does exec, which runs one non-interactive command in a pod so a diagnostic probe can read what a running process actually sees:

datus k8s exec fe-0 -n analytics -c fe -- sh -c 'ls -1 /opt/lib/*.jar'

stdin and TTY are always disabled and the pod's exit code is propagated, so exec cannot be used as a shell.

This is a deliberate kubectl-style subset. It does not support cluster-scoped resources, -A, interactive exec, attach/cp, port-forward/proxy, Kustomize, kubeconfig mutation, Go templates, custom-columns, or kubectl plugins. The JSONPath output via -o jsonpath= accepts .field and [index] steps only; filters, wildcards, and ranges are rejected rather than silently mis-evaluated.

Develop

uv run --package datus-k8s-plugin pytest datus-k8s-plugin

The package never imports datus; its complete plugin contract is declared in datus_k8s_plugin/datus-plugin.yml.