Git Product home page Git Product logo

Comments (3)

gberche-orange avatar gberche-orange commented on May 24, 2024 1

Note that this feature is being worked on in kubectl debug as part of kubernetes/kubectl#1108 through a --profile option: Debugging profile. Options are "legacy", "general", "baseline", or "restricted".

from kubectl-netshoot.

nilic avatar nilic commented on May 24, 2024 1

Since the plugin is basically a thin layer over kubectl, I would wait for the --profile option to be supported in kubectl debug.

from kubectl-netshoot.

mochizuki875 avatar mochizuki875 commented on May 24, 2024 1

Hi, debugging profile has been released at Kubernetes v1.27.

Added "general", "baseline", and "restricted" debugging profiles for kubectl debug. (kubernetes/kubernetes#114280, @sding3) [SIG CLI]

Added "netadmin" debugging profiles for kubectl debug. (kubernetes/kubernetes#115712, @wedaly) [SIG CLI]

However:

  1. Some lack of securityContext settings were in the restricted profile. It has been fixed and will be released at v1.28.

  2. There seems to be lack of CAP_NET_RAW in the netadmin profile. It's disscussed here and I try to fix it.

In addition, custom profile are also being considered here.

FYI:
I actually made a PoC to be able to apply securityContext custom profiles to EphemeralContainer like this:

$ kubectl debug -it nginx --image=ubuntu --target=nginx --security-context='{"capabilities":{"add":["NET_BIND_SERVICE"],"drop":["all"]}}' -- /bin/bash                                    
Targeting container "nginx". If you don't see processes from this container it may be because the container runtime doesn't support this feature.
Defaulting debug container name to debugger-5sgx7.
If you don't see a command prompt, try pressing enter.
root@nginx:/# 
root@nginx:/# grep Cap /proc/$$/status
CapInh:	0000000000000000
CapPrm:	0000000000000400
CapEff:	0000000000000400
CapBnd:	0000000000000400
CapAmb:	0000000000000000
$ kubectl get po nginx -oyaml                                                                                                                                                                                                                    
apiVersion: v1
kind: Pod
...
  ephemeralContainers:
  - command:
    - /bin/bash
    image: ubuntu
    imagePullPolicy: Always
    name: debugger-5sgx7
    resources: {}
    securityContext:
      capabilities:
        add:
        - NET_BIND_SERVICE
        drop:
        - all
...

https://github.com/kubernetes/kubernetes/compare/master...mochizuki875:kubernetes:ec-custom-security-context?expand=1#diff-e961c6c329b92e6595113a179583cddc9192bcf00d3ee2ad721b029aff6957bc

However, they seem to be targeting a broader scope than just securityContext.

Thanks.

from kubectl-netshoot.

Related Issues (3)

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.