Ephemeral Containers

[verb]

Feature Description

• One-line feature description (can be used as a release note): Support advanced troubleshooting of running pods by running a new container image in shared pod namespaces.
• Kubernetes Enhancement Proposal: https://git.k8s.io/enhancements/keps/sig-node/277-ephemeral-containers
• Primary contact (assignee): @verb
• Responsible SIGs: sig-node
• Feature target (which target equals to which milestone):
  • Alpha release target (1.16)
  • Beta release target (1.23)
  • Stable release target (1.25)

Documentation

• Ephemeral Containers Overview
• Creating Ephemeral Containers using kubectl

Milestones

These are the user-visible milestones on the way towards a Kubernetes release that will support kubectl debug functionality. Those interested can follow this issue for updates. I've included estimated release targets, but these are highly dependent on reviewer availability and should not be relied upon.

• Ephemeral containers added to core API (landed 1.16)
• kubelet support for creating basic ephemeral containers (landed 1.16)
• kubectl command to launch ephemeral containers (landed 1.17)
• kubelet support for namespace targeting (landed 1.18)
• kubectl support for adding ephemeral containers (landed 1.18)
• Switch API to use Pod kind (target 1.22)
• allow setting securityContext (target 1.22)
• Beta graduation (target 1.23)

Related Enhancements and Proposals

• Configurable Pod Process Namespace Sharing #495: Process Namespace Sharing
• KEP 1441 - kubectl debug #1441: kubectl debug command

Issues & Feature Requests

Completed features

• FR: New kubectl command kubectl debug kubernetes#45922: kubectl debug command
• Ephemeral Containers: Enable container namespace targeting kubernetes#84359: Container namespace targetting
• Add integration test for disabled ephemeral containers kubernetes#98067: Integration test for disabled feature behavior
• Create kubelet metrics for ephemeral containers creation and usage kubernetes#97974: Add kubelet metrics for Ephemeral Containers
• Ephemeral Containers: Allow setting security context kubernetes#53188: Allow setting security context of Ephemeral Containers
• kubectl debug compatibility with pre-1.22 ephemeral containers API kubernetes#102008: kubectl debug compatibility with pre-1.22 ephemeral containers API

Scheduled for work in 1.23

• Create e2e tests for Ephemeral Containers kubernetes#85545: Add e2e testing of Ephemeral Containers
• Promote Ephemeral Containers to beta and enable by default kubernetes#98808: Promote Ephemeral Containers to beta and enable by default
• Update via /ephemeralcontainers validates entire PodSpec kubernetes#105241: Improve safety in ephemeral containers update validation

Scheduled for work in 1.25

• Improve tests and fix bugs in container validation kubernetes#111401
• Fix incorrect message when attaching to ephemeral containers kubernetes#111185
• Add Ephemeral Containers to node conformance tests kubernetes#111404
• Investigate exercising Ephemeral Container creation in upgrade tests kubernetes#98807
• Promote EphemeralContainers feature to GA kubernetes#111402
• Mark EphemeralContainers as GA in 1.25 website#35545

Future work, out of scope for this KEP

• Ephemeral Containers: Automatically taint pods with ephemeral containers kubernetes#84353: Automatically taint pods with ephemeral containers
• Support removing ephemeral container from pod kubernetes#84764: Allow removing ephemeral containers

Contribute to these features or help prioritize by voting for these issues.

[liggitt]

cc @kubernetes/sig-cli-feature-requests

[verb]

@dchen1107 @idvoretskyi This should move to 1.8 milestone & features.

/sig api-machinery

[idvoretskyi]

@verb thanks, updated.

[pwittrock]

@verb Is this still targeted for 1.8?

[verb]

@pwittrock No, let's bump to 1.9

[idvoretskyi]

@verb still on track for 1.9?

[verb]

@idvoretskyi yes

[verb]

/remove-sig api-machinery
/sig auth

[radu-matei]

Hi!
Is there anyone actively working on this?

I would really like to start contributing on it (realistically starting next week or so).

[verb]

@radu-matei Yes, I'm actively working on it. I have some PRs lined up but we haven't quite finalized the API yet, see kubernetes/community#1269.

I'd love to have some help here, of course. Was there a particular area to which you'd like to contribute?

[radu-matei]

@verb I probably can work on kubectl right away, but I would also very much want to understand the API server and kubelet.

[Priyankasaggu11929]

/milestone v1.25

[parul5sahoo]

Hello @verb 👋, 1.25 Enhancements team here.

Just checking in as we approach enhancements freeze on 18:00 PST on Thursday June 16, 2022.

For note, This enhancement is targeting for stage stable for 1.25 (correct me, if otherwise)

Here's where this enhancement currently stands:

• KEP file using the latest template has been merged into the k/enhancements repo.
• KEP status is marked as implementable
• KEP has a updated detailed test plan section filled out
• KEP has up to date graduation criteria
• KEP has a production readiness review that has been completed and merged into k/enhancements.

Looks like for this one, we would just need to update the following:

• update the test plan section in the KEP README.md according to the latest template
• Get the PRR for 1.25 milestone

Open PR #3384 is addressing above ^

For note, the status of this enhancement is marked as at risk. Please keep the issue description up-to-date with appropriate stages as well. Thank you! #

[verb]

Hi @dchen1107, my only concern is that due to the release lag of cloud providers a portion of users haven't had an opportunity to try the feature and provide feedback. For example, 1.23 only became available in GKE's rapid channel last month. I was going to push graduation in the 1.26 cycle.

That being said, afaik we're feature complete, we have graduation criteria to measure some real-world usage, and 1.23 should have at least a couple of months in GKE's regular channel (I don't know about other providers) before code freeze. You're probably getting more feedback than I am. I support GA if you think it's time, and I'm available to work on it.

[Priyankasaggu11929]

Hello, @verb 👋 I'm the lead for 1.25 Enhancements team.

Following the above comment #277 (comment), just a quick note that I'm updating the label to stage/stable for this 1.25 enhancement. Thank you so much! 🙂

[liggitt]

For example, 1.23 only became available in GKE's rapid channel last month.

1.23 was available in January. 1.24 was available in May.

[parul5sahoo]

Hello @verb 👋, just a quick check-in again, as we approach the 1.25 enhancements freeze.

Please plan to get the PR with PRR and updated test plan merged before enhancements freeze on Thursday, June 23, 2022 at 18:00 PM PT.

For note, the current status of the enhancement is at-risk and will be marked tracked as soon as the PR gets merged . Thank you!

[parul5sahoo]

Thank you @verb for updating the test plan, the enhancement has been marked as tracked and is ready for Enhancements Freeze.

[Priyankasaggu11929]

Hi @verb 👋

Checking in once more as we approach 1.25 code freeze at 01:00 UTC on Wednesday, 3rd August 2022.

Please ensure the following items are completed:

• All PRs to the Kubernetes repo that are related to your enhancement are linked in the above issue description (for tracking purposes).
• All PRs are fully merged by the code freeze deadline.
  • Improve tests and fix bugs in container validation kubernetes#111401
  • Fix incorrect message when attaching to ephemeral containers kubernetes#111185
  • Add Ephemeral Containers to node conformance tests kubernetes#111404
  • Promote EphemeralContainers feature to GA kubernetes#111402

(updated)I was unable to find out any k/k PRs promoting Ephermeral Containers KEP to stable. Could you please point me,if any related PRs are currently open or confirm if they're yet to be raised?

The status of the enhancement is currently marked as at-risk.

Please also update the issue description with the relevant links for tracking purpose. Thank you so much!

[verb]

Hi @Priyankasaggu11929, thanks for following up. I've opened PRs and updated the description with links.

[Priyankasaggu11929]

With all k/k code PRs merged now, the enhancement is ready for the 1.25 Code Freeze.

The status is now marked as tracked. Thank you so much! 🙂

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[verb]

With GA in 1.25, I'm happy to consider this KEP fully implemented. Thanks everyone! 🎉

I know there are still improvements we want to make for ephemeral containers, but let's track these with new KEPs. I'll send a PR to mark this implemented. 👍

/remove-lifecycle stale

[pacoxu]

EphemeralContainers feature gate was removed in kubernetes/kubernetes#114410 for v1.27.