You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
`kubectl-debug` is an out-of-tree solution for [troubleshooting running pods](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/node/troubleshoot-running-pods.md), which allows you to run a new container in running pods for debugging purpose. The new container will join the `pid`, `network`, `user` and `ipc` namespaces of the target container, so you can use arbitrary trouble-shooting tools without pre-install them in your production container image.
11
13
12
-
> Compatibility: I've tested `kubectl-debug` with kubectl v1.13.1 and kubernetes v1.9.1. I don't have an environment to test more versions but I suppose that `kubectl-debug` is compatible with all versions of kubernetes and kubectl 1.12.0+. Please [file an issue](https://github.com/aylei/kubectl-debug/issues/new) if you find `kubectl-debug` do not work.
14
+
-[demo](#demo)
15
+
-[quick start](#quick-start)
16
+
-[build from source](#build-from-source)
17
+
-[default image and entrypoints](#default-image-and-entrypoint)
18
+
-[future works](#future-works)
19
+
-[implementation details](#details)
20
+
-[contribute](#contribute)
21
+
22
+
# Demo
23
+
24
+

13
25
14
26
# Quick Start
15
27
28
+
`kubectl-debug` is pretty simple, give it a try!
29
+
16
30
Install the debug agent DaemonSet in your cluster, which is responsible to run the "new container":
> Compatibility: I've tested `kubectl-debug` with kubectl v1.13.1 and kubernetes v1.9.1. I don't have an environment to test more versions but I suppose that `kubectl-debug` is compatible with all versions of kubernetes and kubectl 1.12.0+. Please [file an issue](https://github.com/aylei/kubectl-debug/issues/new) if you find `kubectl-debug` do not work.
57
+
42
58
# Build from source
43
59
44
60
Clone this repo and:
@@ -54,10 +70,6 @@ go build -o debug-agent ./cmd/agent
`kubectl-debug` use [nicolaka/netshoot](https://github.com/nicolaka/netshoot) as the default image to run debug container, and use `bash` as default entrypoint.
@@ -74,6 +86,13 @@ command:
74
86
75
87
PS: `kubectl-debug` will always override the entrypoint of the container, which is by design to avoid users running an unwanted service by mistake(of course you can always do this explicitly).
76
88
89
+
# Future works
90
+
91
+
`kubectl-debug`is supposed to be just a troubleshooting helper, and is going be replaced by the native `kubectl debug` command when [this proposal](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/node/troubleshoot-running-pods.md) is implemented and merged in the future kubernetes release. But for now, there is still some works to do to improve `kubectl-debug`.
92
+
93
+
- [ ] Security. `kubectl-debug` runs privileged agent on every node, and client talks to the agent directly. A possible solution is introducing a central apiserver to do RBAC, which integrates to the kube apiserver using [aggregation layer](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/apiserver-aggregation/)
94
+
- [ ] Protocol. `kubectl-debug` vendor the SPDY wrapper from `client-go`. SPDY is deprecated now, websockets maybe a better choice
0 commit comments