How to set up k9s in a notebook

Why k9s?

K9s is a command-line interface (CLI) tool that provides a rich, interactive way to explore the Kubernetes cluster. It allows users to easily navigate, monitor, and manage their Kubernetes workloads. K9s provides a convenient way to view and manage Kubeflow resources, such as notebook servers, pipeline steps, and KServe endpoints. With K9s, users can quickly identify and resolve issues in their Kubeflow namespace, improving productivity and reducing downtime.

How to install

To install K9s for Linux in a Kubeflow notebook server, follow these steps:

Open the terminal in your notebook
Create a temporary directory where you can install:
```
cd $(mktemp -d)
```
Use the following command to download the K9s binary:
```
wget <https://github.com/derailed/k9s/releases/download/v0.27.4/k9s_Linux_amd64.tar.gz>
```
You can find newer versions on k9s’ releases page
Use the following command to extract the K9s binary:
```
tar -xf k9s_Linux_amd64.tar.gz
```
Finally, move it into the home directory of your notebook:
```
mkdir -p ~/bin
mv ./k9s ~/bin
```
If you don’t already have ~/bin in your $PATH, feel free to update your ~/.bashrc file to add:
```
export PATH="$PATH:$HOME/bin"
```

If everything works, you should be able to run k9s version and see a success:

(base) jovyan@main-0:~$ k9s version
 ____  __.________       
|    |/ _/   __   \\______
|      < \\____    /  ___/
|    |  \\   /    /\\___ \\ 
|____|__ \\ /____//____  >
        \\/            \\/ 

Version:    v0.27.4
Commit:     f4543e9bd2f9e2db922d12ba23363f6f7db38f9c
Date:       2023-05-07T16:55:34Z

Configuring ~/.kube/config

By default, k9s will attempt to read your ~/.kube/config file to get the credentials it needs to connect to the Kubernetes API server. Because we are running in a notebook pod, no such file exists and kubectl will instead try to use the credentials from your notebook pod’s ServiceAccount to authenticate.

As of September 2023, k9s is not able to infer the correct namespace to use for Kubernetes API calls using the same credential path that kubectl uses. If you try to run k9s without configuring your ~/.kube/config file, you will get this error:

(base) jovyan@main-0:~$ k9s
Error: [list watch] access denied on resource "default":"v1/pods"

To fix this, simply run this command:

cat >~/.kube/config <<'EOF'
apiVersion: v1
kind: Config
clusters:
- cluster:
    certificate-authority: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
    server: <https://172.20.0.1>
  name: default
contexts:
- context:
    cluster: default
    namespace:
    exec:
      command: "cat"
      args:
      - "/var/run/secrets/kubernetes.io/serviceaccount/namespace"
    user: default
  name: default
current-context: default
users:
- name: default
  user:
    exec:
      command: "sh"
      args:
      - "-c"
      - "echo '{ \\"kind\\": \\"ExecCredential\\", \\"apiVersion\\": \\"client.authentication.k8s.io/v1beta1\\", \\"status\\": { \\"token\\": \\"'$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)'\\" } }'"
      apiVersion: "client.authentication.k8s.io/v1beta1"
EOF

Then, you should be able to get k9s working with the following command:

k9s -n $(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)

After you run that command once, you should just be able to use k9s