You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
* - Add support for pulling debug image from IBM Cloud Repository. In IBM Cloud the secrets are stored in a JSON blob instead of the key value pair authStr:<secret>. So if we don't find an 'authStr' value we look for the JSON blob.
- Add additional logging around registry authentication + fix grammar in a log message.
- For boolean switches ( e.g. port-forward ) that had a default value of true it wasn't possible to specify a value of false in the config file. Because of a logic bug kubectl-debug would ignore the value from the config file in this case.
- kubectl-debug couldn't find the config file on Windows because it was using the wrong path separator.
* Make it ossible to 'lock' the debugger image by setting env var KCTLDBG_RESTRICT_IMAGE_TO to the uri of the image you want to have used.
* Merge auditing feature.
* Fix spelling.
Copy file name to clipboardExpand all lines: README.md
+63
Original file line number
Diff line number
Diff line change
@@ -213,6 +213,69 @@ PS: `kubectl-debug` will always override the entrypoint of the container, which
213
213
214
214
Currently, `kubectl-debug` reuse the privilege of the `pod/exec` sub resource to do authorization, which means that it has the same privilege requirements with the `kubectl exec` command.
215
215
216
+
# Auditing / Security
217
+
218
+
Some teams may want to limit what debug image users are allowed to use and to have an audit record for each command they run in the debug container.
219
+
220
+
You can use the environment variable ```KCTLDBG_RESTRICT_IMAGE_TO``` restrict the agent to using a specific container image. For example putting the following in the container spec section of your daemonset yaml will force the agent to always use the image ```docker.io/nicolaka/netshoot:latest``` regardless of what the user specifies on the kubectl-debug command line
221
+
```
222
+
env :
223
+
- name: KCTLDBG_RESTRICT_IMAGE_TO
224
+
value: docker.io/nicolaka/netshoot:latest
225
+
```
226
+
If ```KCTLDBG_RESTRICT_IMAGE_TO``` is set and as a result agent is using an image that is different than what the user requested then the agent will log to standard out a message that announces what is happening. The message will include the URI's of both images.
227
+
228
+
Auditing can be enabled by placing
229
+
```audit: true```
230
+
in the agent's config file.
231
+
232
+
There are 3 settings related to auditing.
233
+
<dl>
234
+
<dt><code>audit</code></dt>
235
+
<dd>Boolean value that indicates whether auditing should be enabled or not. Default value is <code>false</code></dd>
236
+
<dt><code>audit_fifo</code></dt>
237
+
<dd>Template of path to a FIFO that will be used to exchange audit information from the debug container to the agent. The default value is <code>/var/data/kubectl-debug-audit-fifo/KCTLDBG-CONTAINER-ID</code>. If auditing is enabled then the agent will :
238
+
<ol>
239
+
<li>Prior to creating the debug container, create a fifo based on the value of <code>audit_fifo</code>. The agent will replace <code>KCTLDBG-CONTAINER-ID</code> with the id of the debug container it is creating.</li>
240
+
<li>Create a thread that reads lines of text from the FIFO and then writes log messages to standard out, where the log messages look similar to example below <br/>
Where USERNAME is the kubernetes user as determined by the client that launched the debug container and debuggee is the container id of the container being debugged.
245
+
</li>
246
+
<li>Bind mount the fifo it creates to the debugger container. </li>
247
+
</ol>
248
+
</dd>
249
+
<dt><code>audit_shim</code>
250
+
<dd>String array that will be placed before the command that will be run in the debug container. The default value is <code>{"/usr/bin/strace", "-o", "KCTLDBG-FIFO", "-f", "-e", "trace=/exec"}</code>. The agent will replace KCTLDBG-FIFO with the fifo path ( see above ) If auditing is enabled then agent will use the concatenation of the array specified by <code>audit_shim</code> and the original command array it was going to use.</dd>
251
+
</dl>
252
+
253
+
The easiest way to enable auditing is to define a config map in the yaml you use to deploy the deamonset. You can do this by place
254
+
```
255
+
apiVersion : v1
256
+
kind: ConfigMap
257
+
metadata:
258
+
name : kubectl-debug-agent-config
259
+
data:
260
+
agent-config.yml: |
261
+
audit: true
262
+
---
263
+
```
264
+
at the top of the file, adding a ```configmap``` volume like so
265
+
```
266
+
- name: config
267
+
configMap:
268
+
name: kubectl-debug-agent-config
269
+
```
270
+
and a volume mount like so
271
+
```
272
+
- name: config
273
+
mountPath: "/etc/kubectl-debug/agent-config.yml"
274
+
subPath: agent-config.yml
275
+
```
276
+
.
277
+
278
+
216
279
# Roadmap
217
280
218
281
`kubectl-debug` is supposed to be just a troubleshooting helper, and is going be replaced by the native `kubectl debug` command when [this proposal](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/node/troubleshoot-running-pods.md) is implemented and merged in the future kubernetes release. But for now, there is still some works to do to improve `kubectl-debug`.
0 commit comments