K8s集群shareProcessNamespace异常及临时容器调试CoreDNS失败

环境信息 #

Kubernetes版本 #

❯ kubectl version --short
Flag --short has been deprecated, and will be removed in the future. The --short output will become the default.
Client Version: v1.24.2
Kustomize Version: v4.5.4
Server Version: v1.23.4

容器运行时（Docker）版本 #

docker version
Client: Docker Engine - Community
 Version:           20.10.17
 API version:       1.41
 Go version:        go1.17.11
 Git commit:        100c701
 Built:             Mon Jun  6 23:02:57 2022
 OS/Arch:           linux/amd64
 Context:           default
 Experimental:      true

Server: Docker Engine - Community
 Engine:
  Version:          20.10.17
  API version:      1.41 (minimum version 1.12)
  Go version:       go1.17.11
  Git commit:       a89b842
  Built:            Mon Jun  6 23:01:03 2022
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.6.6
  GitCommit:        10c12954828e7c7c9b6e0ea9b0c02b01407d3ae1
 runc:
  Version:          1.1.2
  GitCommit:        v1.1.2-0-ga916309
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0

问题现象 #

尝试使用临时容器调试CoreDNS Pod时，执行以下命令失败：

❯ kubectl debug -it ephemeral-demo --image=busybox:1.28 --target=coredns-64897985d-2xgd6
Targeting container "coredns-64897985d-2xgd6". If you don't see processes from this container it may be because the container runtime doesn't support this feature.
Error from server (NotFound): pods "ephemeral-demo" not found

补充说明 #

已知K8s 1.17版本后podShareProcessNamespace特性默认启用，且能够成功调试自定义的ephemeral-demo Pod，执行命令及结果如下：

❯ kubectl debug -it ephemeral-demo --image=busybox:1.28 --target=ephemeral-demo

Targeting container "ephemeral-demo". If you don't see processes from this container it may be because the container runtime doesn't support this feature.
Defaulting debug container name to debugger-mqth2.
If you don't see a command prompt, try pressing enter.
/ #

内容的提问来源于stack exchange，提问作者xiaojueguan