KEP-4292: Add custom profiling in kubectl debug #4293

ardaguclu · 2023-10-13T08:10:14Z

One-line PR description: Add custom profiling support in kubectl debug

Issue link: Custom profile in kubectl debug #4292

Other comments:

ardaguclu · 2023-10-13T08:20:21Z

/cc @verb
could you please take a look at this proposal, when you have a chance?. Thanks.

ardaguclu · 2023-11-03T05:56:40Z

I believe this KEP is ready for review for 1.30.

bavarianbidi

just wanted to mention, that i really like the idea. I've already hacked a bit in kubectl to have volumeMounts in my ephemeral Containers.

I've also started with an inital version of an own kubectl plugin to have some kind of "profiles" (which can be shared within my team/community) to have dedicated debug profiles for different kind of applications.

My current POC make use of a config-file where i've defined multiple "profiles" which i
can refer to when i want to debug a container:

profiles:
    application-1:
        volumeMounts: # if nil, use all volume mounts from target pod
            - name: database
              mountPath: /opt/database
        container: server
        image: my-special-debug-container:v0.0.4
    application-2:
        volumeMounts: {}
        container: sidecar
        image: another-debug-container:latest

bavarianbidi · 2023-12-22T13:08:32Z

keps/sig-cli/4292-kubectl-debug-custom-profile/README.md

+
+As a restricted user, I'd be able to debug a pod to simulate the exact environment
+of the problematic pod which has resource requests and limits.
+


maybe it's also worth to mention the ability to have an ephemeral Container beside a container, build from scratch/distroless/<container without shell> where not all the handy tools (curl, wget, openssl, ...) are installed.

keps/prod-readiness/sig-cli/4292.yaml

keps/sig-cli/4292-kubectl-debug-custom-profile/kep.yaml

keps/sig-cli/4292-kubectl-debug-custom-profile/README.md

soltysh · 2024-01-16T12:40:39Z

keps/sig-cli/4292-kubectl-debug-custom-profile/README.md

+rollout. Similarly, consider large clusters and how enablement/disablement
+will rollout across nodes.
+-->
+No


A bit more details, please.

Updated. Please let me know what you think.

soltysh · 2024-01-16T12:42:02Z

keps/sig-cli/4292-kubectl-debug-custom-profile/README.md

+checking if there are objects with field X set) may be a last resort. Avoid
+logs or events for this purpose.
+-->
+By checking the value of `KUBECTL_DEBUG_CUSTOM_PROFILE` environment variable


I doubt the cluster operator can find that useful. It's more of a user setting, than a cluster one.

You can add a note, that this command uses GA-ed APIs, so it'll be hard to distinguish between this command invocations and not.

keps/sig-cli/4292-kubectl-debug-custom-profile/README.md

ardaguclu · 2024-01-22T10:14:58Z

/label tide/merge-method-squash

soltysh

/lgtm
/approve
from sig-cli pov

soltysh · 2024-01-26T11:55:10Z

keps/sig-cli/4292-kubectl-debug-custom-profile/README.md

+Copying pod and node debugging use built-in API endpoints. Ephemeral container functionality was
+promoted to stable in 1.25. Besides custom profiling feature only relies on
+`corev1.Container` type's existence differently from `kubectl debug` which is also built-in.
+It is zero probability that this feature touches unavailable API endpoints in regard to


Nit: I'd stay way from zero probability, but rather use something lighter, like very low probability, low chances, etc.
1.25 is not that old, and based on the results from past PRR surveys show that a lot of users still keep older versions of k8s. So it's possible that someone might use older than 1.25 k8s, just very small 😉

Indeed you are right. I'll update this statement based on your suggestions. Thanks.

BenTheElder

[PRR shadow]
PRR looks OK to alpha, left some minor non-blocking comments.

BenTheElder · 2024-02-06T06:10:56Z

keps/sig-cli/4292-kubectl-debug-custom-profile/README.md

+  - Condition name: 
+  - Other field: 
+- [X] Other (treat as last resort)
+  - Details: Checking the value of `KUBECTL_DEBUG_CUSTOM_PROFILE` environment variable


They can run a test debug and see if their profile is respected in the resulting container?

Thanks for review @BenTheElder. I liked your comment above ^ and have added it to this section.

BenTheElder · 2024-02-06T06:15:31Z

keps/sig-cli/4292-kubectl-debug-custom-profile/README.md

+You can take a look at one potential example of such test in:
+https://github.com/kubernetes/kubernetes/pull/97058/files#diff-7826f7adbc1996a05ab52e3f5f02429e94b68ce6bce0dc534d1be636154fded3R246-R282
+-->
+In alpha phase, all the tests can be done only after enabling this feature.


This answer sort of reads like it missed the question (?), but this feature doesn't change behavior of stored objects anyhow.

Yes, updated this answer to more align with the question. Please let me know what you think.

johnbelamaric

PRR looks good, feature looks useful :)

Many PRR questions are geared towards server side features, so, yeah, are not so applicable to CLI features.

/approve

johnbelamaric · 2024-02-06T19:30:13Z

keps/sig-cli/4292-kubectl-debug-custom-profile/kep.yaml

+# The milestone at which this feature was, or is targeted to be, at each stage.
+milestone:
+  alpha: "v1.30"
+  beta: "TBD"


I think you can just leave out the "TBD" ones.

k8s-ci-robot · 2024-02-06T19:46:57Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ardaguclu, johnbelamaric, soltysh

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~keps/prod-readiness/OWNERS~~ [johnbelamaric]
~~keps/sig-cli/OWNERS~~ [johnbelamaric,soltysh]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

soltysh · 2024-02-07T09:30:56Z

/lgtm

ardaguclu marked this pull request as draft October 13, 2023 08:10

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. kind/kep Categorizes KEP tracking issues and PRs modifying the KEP directory labels Oct 13, 2023

k8s-ci-robot requested review from natasha41575 and soltysh October 13, 2023 08:10

k8s-ci-robot added sig/cli Categorizes an issue or PR as relevant to SIG CLI. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. labels Oct 13, 2023

ardaguclu mentioned this pull request Oct 13, 2023

Custom profile in kubectl debug #4292

Closed

12 tasks

ardaguclu force-pushed the debug-custom-profile branch from 6fd4682 to d1b6afc Compare October 13, 2023 08:19

k8s-ci-robot requested a review from verb October 13, 2023 08:20

This was referenced Oct 20, 2023

debug: ability to copy environment variables from source container (or specify envFrom=<configMap>) kubernetes/kubectl#1486

Closed

kubectl debug: add optional CLI argument to specify an imagePullSecret kubernetes/kubectl#1506

Closed

ardaguclu marked this pull request as ready for review November 3, 2023 05:56

k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Nov 3, 2023

ardaguclu force-pushed the debug-custom-profile branch 2 times, most recently from 2d2da9e to a370516 Compare November 3, 2023 06:08

bavarianbidi reviewed Dec 22, 2023

View reviewed changes

KEP-4292: Add custom profiling in kubectl debug

944d657

ardaguclu force-pushed the debug-custom-profile branch from a370516 to 944d657 Compare January 5, 2024 08:23

ardaguclu mentioned this pull request Jan 16, 2024

KEP 1441 - kubectl debug #1441

Closed

4 tasks

soltysh reviewed Jan 16, 2024

View reviewed changes

ardaguclu added 4 commits January 17, 2024 09:24

Typos, explanation and refactorings

93f2eb7

Add correct feature gate

794d4c5

Add more details in KEP after review

45069e4

Gofmt to code example

cd3dffe

k8s-ci-robot added the tide/merge-method-squash Denotes a PR that should be squashed by tide when it merges. label Jan 22, 2024

dlipovetsky mentioned this pull request Jan 24, 2024

Support the "ephemeralcontainers" subresource in edit, get, patch, and replace kubernetes/kubernetes#117490

Closed

soltysh approved these changes Jan 26, 2024

View reviewed changes

k8s-ci-robot assigned soltysh Jan 26, 2024

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jan 26, 2024

BenTheElder reviewed Feb 6, 2024

View reviewed changes

Make changes based on PRR review

912663c

k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Feb 6, 2024

johnbelamaric reviewed Feb 6, 2024

View reviewed changes

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Feb 6, 2024

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Feb 7, 2024

k8s-ci-robot merged commit 866854e into kubernetes:master Feb 7, 2024
4 checks passed

k8s-ci-robot added this to the v1.30 milestone Feb 7, 2024

ardaguclu deleted the debug-custom-profile branch February 7, 2024 09:43

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

KEP-4292: Add custom profiling in kubectl debug #4293

KEP-4292: Add custom profiling in kubectl debug #4293

ardaguclu commented Oct 13, 2023

ardaguclu commented Oct 13, 2023

ardaguclu commented Nov 3, 2023

bavarianbidi left a comment

bavarianbidi Dec 22, 2023

soltysh Jan 16, 2024

soltysh Jan 19, 2024

ardaguclu Jan 22, 2024

soltysh Jan 16, 2024

soltysh Jan 16, 2024

ardaguclu commented Jan 22, 2024

soltysh left a comment

soltysh Jan 26, 2024

ardaguclu Jan 26, 2024

BenTheElder left a comment

BenTheElder Feb 6, 2024

ardaguclu Feb 6, 2024

BenTheElder Feb 6, 2024

ardaguclu Feb 6, 2024

johnbelamaric left a comment

johnbelamaric Feb 6, 2024

k8s-ci-robot commented Feb 6, 2024

soltysh commented Feb 7, 2024


		As a restricted user, I'd be able to debug a pod to simulate the exact environment
		of the problematic pod which has resource requests and limits.

KEP-4292: Add custom profiling in kubectl debug #4293

KEP-4292: Add custom profiling in kubectl debug #4293

Conversation

ardaguclu commented Oct 13, 2023

ardaguclu commented Oct 13, 2023

ardaguclu commented Nov 3, 2023

bavarianbidi left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ardaguclu commented Jan 22, 2024

soltysh left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

BenTheElder left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

johnbelamaric left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

k8s-ci-robot commented Feb 6, 2024

soltysh commented Feb 7, 2024