-
-
Notifications
You must be signed in to change notification settings - Fork 0
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add support for setting security context into ephemeral container specs #9
Comments
Note that this feature is being worked on in |
Since the plugin is basically a thin layer over kubectl, I would wait for the |
Hi, debugging profile has been released at Kubernetes v1.27.
However:
In addition, custom profile are also being considered here. FYI: $ kubectl debug -it nginx --image=ubuntu --target=nginx --security-context='{"capabilities":{"add":["NET_BIND_SERVICE"],"drop":["all"]}}' -- /bin/bash
Targeting container "nginx". If you don't see processes from this container it may be because the container runtime doesn't support this feature.
Defaulting debug container name to debugger-5sgx7.
If you don't see a command prompt, try pressing enter.
root@nginx:/#
root@nginx:/# grep Cap /proc/$$/status
CapInh: 0000000000000000
CapPrm: 0000000000000400
CapEff: 0000000000000400
CapBnd: 0000000000000400
CapAmb: 0000000000000000 $ kubectl get po nginx -oyaml
apiVersion: v1
kind: Pod
...
ephemeralContainers:
- command:
- /bin/bash
image: ubuntu
imagePullPolicy: Always
name: debugger-5sgx7
resources: {}
securityContext:
capabilities:
add:
- NET_BIND_SERVICE
drop:
- all
... However, they seem to be targeting a broader scope than just securityContext. Thanks. |
As a kubectl-netshoot user,
In order to use strace to debug a program (e.g. infering data sent over an encrypted connection)
I need an kubectl-netshoot option to craft the ephemeral container with a security context such as
"securityContext": {"capabilities": {"add": ["SYS_PTRACE"]}},
orMore background into
https://betterprogramming.pub/debugging-kubernetes-pods-deep-dive-d6b2814cd8ce
The text was updated successfully, but these errors were encountered: