Multi-Replica Deployments Should Have A PodDisruptionBudget

# 1. List all Deployments and their replica counts
# Run on: any machine with kubectl access
kubectl get deploy -A -o custom-columns=NS:metadata.namespace,NAME:metadata.name,REPLICAS:spec.replicas --sort-by=.metadata.namespace

# 2. List all PodDisruptionBudgets and the selectors they use
kubectl get pdb -A -o wide

# 3. For each namespace with multi-replica Deployments, compare Deployment labels vs PDB selectors

# Example: show Deployments with replicas >= 2 in a given namespace
NAMESPACE=prod
kubectl get deploy -n "$NAMESPACE" \
  -o jsonpath='{range .items[?(@.spec.replicas>=2)]}{.metadata.name}{" => "}{.spec.selector.matchLabels}{"\n"}{end}'

# Show PDB selectors in the same namespace
kubectl get pdb -n "$NAMESPACE" \
  -o jsonpath='{range .items}{.metadata.name}{" => "}{.spec.selector.matchLabels}{"\n"}{end}'

# 4. Spot-check a specific multi-replica Deployment against existing PDBs

NAMESPACE=prod
DEPLOYMENT=my-app

# Show Deployment pod selector and replicas
kubectl get deploy "$DEPLOYMENT" -n "$NAMESPACE" -o yaml | \
  egrep "name: |replicas:|matchLabels:|  app:|  component:"

# Show PDBs that might match this Deployment (same namespace)
kubectl get pdb -n "$NAMESPACE" -o yaml | \
  egrep "name: |minAvailable:|maxUnavailable:|matchLabels:|  app:|  component:"

# 5. Verification after you add or adjust PDBs (human judgment still required)

# Re-list Deployments and PDBs
kubectl get deploy -A -o custom-columns=NS:metadata.namespace,NAME:metadata.name,REPLICAS:spec.replicas --sort-by=.metadata.namespace
kubectl get pdb -A -o wide

# For each multi-replica Deployment you care about, confirm:
# - There is at least one PDB in the same namespace
# - The PDB selector matches the Deployment's pod labels
# - The minAvailable / maxUnavailable values reflect your availability requirements

#!/usr/bin/env bash
# Report multi-replica Deployments that lack an associated PodDisruptionBudget.
# Run on: any machine with kubectl access and current context set.

set -euo pipefail

echo "Collecting multi-replica Deployments (replicas >= 2)..."
# namespace/name  replicas  matchLabels(JSON)
kubectl get deploy -A -o json \
  | jq -r '
    .items[]
    | select((.spec.replicas // 1) >= 2)
    | [.metadata.namespace,
       .metadata.name,
       (.spec.replicas // 1),
       (.spec.selector.matchLabels // {})]
    | @tsv' \
  | while IFS=$'\t' read -r ns name replicas matchlabels_json; do
      # Build a label selector from matchLabels
      if [[ "$matchlabels_json" == "{}" ]]; then
        # No matchLabels: skip, PDB matching is ambiguous and must be reviewed manually
        echo -e "WARN\t${ns}\t${name}\t${replicas}\tNO matchLabels in selector (review manually)"
        continue
      fi

      # Convert JSON object of labels to a key=value,key2=value2 selector string
      selector=$(
        jq -r 'to_entries | map("\(.key)=\(.value)") | join(",")' <<<"$matchlabels_json"
      )

      # Look for at least one PDB in the same namespace whose selector matches these labels
      pdb_count=$(kubectl get pdb -n "$ns" -o json \
        | jq --arg sel "$selector" '
            .items[]
            | select(.spec.selector != null)
            | .spec.selector.matchLabels // {}
            | to_entries
            | map("\(.key)=\(.value)")
            | join(",")
            | select(. == $sel)
            ' \
        | wc -l | tr -d '[:space:]')

      if [[ "$pdb_count" -eq 0 ]]; then
        echo -e "MISSING_PDB\t${ns}\t${name}\t${replicas}\tselector=${selector}"
      else
        echo -e "OK\t${ns}\t${name}\t${replicas}\tselector=${selector}\tPDBs=${pdb_count}"
      fi
    done