nilic / kubectl-netshoot Goto Github PK

Thanks for sharing this great plugin with the community !

As a kubectl-netshoot user,
In order to inspect mounted volumes in a pod, such as secrets, configmaps or volumes that can be mounted more than once,
I need an kubectl-netshoot option to craft the ephemeral container with volumeMounts from the pod

See kubernetes/kubectl#1071 (comment)

I started crafting some bash + jq script to do so, see WIP at https://github.com/orange-cloudfoundry/paas-templates/issues/1949#issuecomment-1549714130 but this feels snowflake. This seems much better located into kubectl-netshoot

Hi,

netshoot is such a timesaver and also your plugin, it would be really nice if you could add the plugin to krew which basically only needs writing a manifest file to add it to the krew plugin index.

https://krew.sigs.k8s.io/docs/developer-guide/distributing-with-krew/

i can also give it a shot because with all the plugins it's much nicer to have a system to automatically update all the plugins, and with hundrets of them already in krew it would be a huge benefit, because imho netshoot is the best debug image out there :)!

As a kubectl-netshoot user,
In order to use strace to debug a program (e.g. infering data sent over an encrypted connection)
I need an kubectl-netshoot option to craft the ephemeral container with a security context such as "securityContext": {"capabilities": {"add": ["SYS_PTRACE"]}},or

More background into
https://betterprogramming.pub/debugging-kubernetes-pods-deep-dive-d6b2814cd8ce

Unfortunately, I didn’t find a way to pass extra permissions to the ephemeral container from kubectl command. So we will construct and send an HTTP request to kube API server without the use of kubectl command.

curl -v -XPATCH -H "Content-Type: application/json-patch+json" \
'http://127.0.0.1:8001/api/v1/namespaces/default/pods/nginx-8f458dc5b-wkvq4/ephemeralcontainers' \
--data-binary @- << EOF
[{
"op": "add", "path": "/spec/ephemeralContainers/-",
"value": {
"command":[ "/bin/sh" ],
"stdin": true, "tty": true,
"image": "nicolaka/netshoot",
"name": "debug-strace",
"securityContext": {"capabilities": {"add": ["SYS_PTRACE"]}},
"targetContainerName": "nginx" }}]
EOF

Now, You can strace without getting permission denied.