Simple kubectl plugin to take pod name, SSH onto node and spawn an nsenter shell.
โ Since we use crictl
, this plugin may only work with containerd
and not with straight Docker ..
So, I made a quick plugin for kubectl that allows to enter the network namespace of the pod to run things like netstat, tcpdump, dig, etc pp
The node (if it is a full-blown OS like Ubuntu 18.04) has all the debugging
tools needed, and so FROM scratch
containers or containers runnning as
non-root can be debugged from the host using nsenter
to join the network namespace or
the PID namespace of the container.
- Retrieve node name
- SSH onto node
- Use
crictl
to obtain pod ID - Use
crictl
to obtain container ID - Use
crictl
to obtain target PID - Use
nsenter
to join process namespace - Spawn bash as debug shell
Download, make executable, and move to PATH.
$ kubectl nsenter --help
SSH into Kubernetes nodes and nsenter into network namespace of a pod
Example:
kubectl nsenter -n goe-dev api-dev-6d94fd5c98-xqdv5 -c php
Options:
-n, --namespace='': Namespace of the pod
-c, --container='': Name of container of a pod