kubectl debug: allow users to specify debugging profile

[knight42]

This is the tracking issue for the implementation of debugging profile feature of kubectl debug.
Ref: https://github.com/kubernetes/enhancements/tree/master/keps/sig-cli/1441-kubectl-debug#debugging-profiles

There are multiple profiles that we need to handle, and I plan to file a single PR for each profile:

• legacy: refactor(kubectl): add ProfileApplier interface for kubectl-debug kubernetes#105008
• general: kubectl-debug: add more debugging profiles kubernetes#110526
• baseline: kubectl-debug: add more debugging profiles kubernetes#110526
• restricted: kubectl-debug: add more debugging profiles kubernetes#110526
• sysadmin
• netadmin
• auto

/assign

[knight42]

@verb I am not certain about what isolated namespaces and private namespaces actually means, could you please elaborate more on them? What is the difference between them?

[verb]

/triage accepted
/cc @verb

@knight42 I like that you're planning on implementing the profiles incrementally. iirc the namespaces are referring to shareProcessNamespace.

[verb]

/assign

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[verb]

/remove-lifecycle stale

[verb]

@knight42 what's your availability to work on the general profile? I have some time to start working on it, too.

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[alexku7]

/remove-lifecycle stale

[alexku7]

any update on that issue? The ability to attach the debug container with elevated capabilities is very very welcome :)

[wedaly]

I created a branch that implements the "netadmin" profile, but it depends on changes in kubernetes/kubernetes#114280, so I'll wait until that one is merged before opening a PR.

The branch is here: kubernetes/kubernetes@master...wedaly:kubernetes:kubectl-netadmin-debug-profile (netadmin implemented in the last commit)

[sding3]

I created a branch that implements the "netadmin" profile, but it depends on changes in kubernetes/kubernetes#114280, so I'll wait until that one is merged before opening a PR.

The branch is here: kubernetes/kubernetes@master...wedaly:kubernetes:kubectl-netadmin-debug-profile (netadmin implemented in the last commit)

@wedaly - 114280 has merged.

[mochizuki875]

Is there any reason why sysadmin has not be implemented?
If no reason, I'll try to do it.

[mochizuki875]

I've created PR that implements auto profile.
kubernetes/kubernetes#120687