Find Top 10 Restarting Kubernetes Containers

Identify the most unstable containers across all namespaces in a Kubernetes cluster by sorting their restart counts.

$ kubectl get pods -A -o json | jq -r '.items[] | select(.status.containerStatuses != null) | .metadata.namespace as $ns | .metadata.name as $pod | .status.containerStatuses[] | "\(.restartCount)\t\($ns)\t\($pod)\t\(.name)"' | sort -rn | head -n 10

1. [01] kubectlkubectl get pods -A -o json
   Fetches all pods across all namespaces and outputs the raw data in JSON format.
2. [02] jqjq -r '.items[] | select(.status.containerStatuses != null)'
   Filters out pods that haven't scheduled or don't have container status information yet.
3. [03] jq.metadata.namespace as $ns | .metadata.name as $pod
   Saves the namespace and pod name into variables to include them alongside the container data.
4. [04] jq.status.containerStatuses[] | "\(.restartCount)\t\($ns)\t\($pod)\t\(.name)"
   Iterates over each container, formatting a tab-separated string with restarts, namespace, pod, and container name.
5. [05] sortsort -rn
   Sorts the output numerically in reverse order so the highest restart counts appear first.
6. [06] headhead -n 10
   Limits the output to the top 10 worst offending containers.

342	kube-system	calico-node-z9q2w	calico-node
128	monitoring	prometheus-adapter-5b5f5c	prometheus-adapter
45	default	flaky-app-deployment-848	backend
12	ingress-nginx	ingress-nginx-controller	controller
3	kube-system	coredns-5d78c9869d-x2j	coredns

• Fetching all pods as JSON in very large clusters (10,000+ pods) can consume significant memory and API server bandwidth, potentially causing timeouts.
• Requires cluster-wide read permissions (`get pods` at the cluster scope) which may be restricted by RBAC policies.