Kubernetes: debugging with ephemeral containers

Anyone who has ever had to manipulate Kubernetes has found himself confronted with the resolution of pod errors. The methods provided for this purpose are efficient, and allow to overcome the most frequent errors. However, in some situations, these methods are limited: debugging then becomes delicate. During the Kubecon 2022 in Valencia, presented by the Cloud Native Computing Foundation, I could attend to Aaron Alpar’s presentation about a new way to debug pods in Kubernetes available in beta in its version 1.23: kubectl debug.

First, we’ll see the classic methods for debugging pods. Then, we’ll develop the notion of namespace. Finally, we’ll define what ephemeral containers are.

How to debug a pod?

Until now, after consulting the logs of a pod with kubectl log <pod>, two solutions were available to debug more deeply: exec and copy.

The first one is in the form of:

kubectl exec         \
  -it                \ #opens a command prompt
  -n <namespace_pod> \
  <pod>              \
  -c <container>     \ #allows you to specify a particular container
  -- /bin/sh           #runs a shell at the prompt

This command opens a command prompt in the target container. The extent of the user’s rights to issue commands will then…