shareProcessNamespace在k8s集群中不起作用

Question

问题描述：

❯ kubectl version --short
Flag --short has been deprecated, and will be removed in the future. The --short output will become the default.
Client Version: v1.24.2
Kustomize Version: v4.5.4
Server Version: v1.23.4

cri是码头

docker version
Client: Docker Engine - Community
Version:           20.10.17
API version:       1.41
Go version:        go1.17.11
Git commit:        100c701
Built:             Mon Jun  6 23:02:57 2022
OS/Arch:           linux/amd64
Context:           default
Experimental:      true
Server: Docker Engine - Community
Engine:
Version:          20.10.17
API version:      1.41 (minimum version 1.12)
Go version:       go1.17.11
Git commit:       a89b842
Built:            Mon Jun  6 23:01:03 2022
OS/Arch:          linux/amd64
Experimental:     false
containerd:
Version:          1.6.6
GitCommit:        10c12954828e7c7c9b6e0ea9b0c02b01407d3ae1
runc:
Version:          1.1.2
GitCommit:        v1.1.2-0-ga916309
docker-init:
Version:          0.19.0
GitCommit:        de40ad0

我尝试使用temporal pod来调试以下命令的coredns pod，但失败了

❯ kubectl debug -it ephemeral-demo --image=busybox:1.28 --target=coredns-64897985d-2xgd6
Targeting container "coredns-64897985d-2xgd6". If you don't see processes from this container it may be because the container runtime doesn't support this feature.
Error from server (NotFound): pods "ephemeral-demo" not found

ps

我发现podShareProcessNamespace的功能在1.17之后默认启用我还可以完成https://kubernetes.io/docs/tasks/debug/debug-application/debug-running-pod/#ephemeral-包含以下详细信息的集装箱

❯ kubectl debug -it ephemeral-demo --image=busybox:1.28 --target=ephemeral-demo
Targeting container "ephemeral-demo". If you don't see processes from this container it may be because the container runtime doesn't support this feature.
Defaulting debug container name to debugger-mqth2.
If you don't see a command prompt, try pressing enter.
/ #

Answer 1

实际上，该功能是功能性的。这是误解了博士的意思https://kubernetes.io/docs/tasks/debug/debug-application/debug-running-pod/#ephemeral-集装箱。

我们可以使用以下两个步骤来使用使用临时容器进行调试的功能。

1. 使用以下命令修补您的部署

kubectl patch deployment coredns --patch '
spec:
template:
spec:
shareProcessNamespace: true'

2. 启动一个临时容器以使用调试工具进行调试

kubectl debug -it -c debug coredns-7f96c4ccc7-pfhxj --image busybox:latest

---

但是错误升级(如果你没有看到来自这个容器的进程，可能是因为容器运行时不支持这个功能。(有点令人困惑。

以及--target参数针对文档中另一个容器的进程命名空间的描述https://kubernetes.io/docs/tasks/debug/debug-application/debug-running-pod/#ephemeral-容器也可能有点混乱。

---

通过阅读这篇文章，我可能知道目标可以分配什么，可以是吊舱规范中容器的名称。