Implement kubectl debug profiles: general, baseline, and restricted

staging/src/k8s.io/kubectl/pkg/cmd/debug/debug.go

@@ -121,6 +121,7 @@ type DebugOptions struct {
 	TargetContainer string
 	TTY             bool
 	Profile         string
+	Applier         ProfileApplier
 
 	attachChanged         bool
 	shareProcessedChanged bool
@@ -129,8 +130,6 @@ type DebugOptions struct {
 
 	genericclioptions.IOStreams
 	WarningPrinter *printers.WarningPrinter
-
-	applier ProfileApplier
 }
 
 // NewDebugOptions returns a DebugOptions initialized with default values.
@@ -180,7 +179,7 @@ func addDebugFlags(cmd *cobra.Command, opt *DebugOptions) {
 	cmd.Flags().BoolVar(&opt.ShareProcesses, "share-processes", opt.ShareProcesses, i18n.T("When used with '--copy-to', enable process namespace sharing in the copy."))
 	cmd.Flags().StringVar(&opt.TargetContainer, "target", "", i18n.T("When using an ephemeral container, target processes in this container name."))
 	cmd.Flags().BoolVarP(&opt.TTY, "tty", "t", opt.TTY, i18n.T("Allocate a TTY for the debugging container."))
-	cmd.Flags().StringVar(&opt.Profile, "profile", ProfileLegacy, i18n.T("Debugging profile."))
+	cmd.Flags().StringVar(&opt.Profile, "profile", ProfileLegacy, i18n.T(`Debugging profile. Options are "legacy", "general", "baseline", or "restricted".`))
 }
 
 // Complete finishes run-time initialization of debug.DebugOptions.
@@ -226,9 +225,13 @@ func (o *DebugOptions) Complete(f cmdutil.Factory, cmd *cobra.Command, args []st
 	if o.WarningPrinter == nil {
 		o.WarningPrinter = printers.NewWarningPrinter(o.ErrOut, printers.WarningPrinterOptions{Color: term.AllowsColorOutput(o.ErrOut)})
 	}
-	o.applier, err = NewProfileApplier(o.Profile)
-	if err != nil {
-		return err
+
+	if o.Applier == nil {
+		applier, err := NewProfileApplier(o.Profile)
+		if err != nil {
+			return err
+		}
+		o.Applier = applier
 	}
 
 	return nil
@@ -536,10 +539,12 @@ func (o *DebugOptions) generateDebugContainer(pod *corev1.Pod) (*corev1.Pod, *co
 
 	copied := pod.DeepCopy()
 	copied.Spec.EphemeralContainers = append(copied.Spec.EphemeralContainers, *ec)
-	if err := o.applier.Apply(copied, name, copied); err != nil {
+	if err := o.Applier.Apply(copied, name, copied); err != nil {
 		return nil, nil, err
 	}
 
+	ec = &copied.Spec.EphemeralContainers[len(copied.Spec.EphemeralContainers)-1]
+
 	return copied, ec, nil
 }
 
@@ -593,7 +598,7 @@ func (o *DebugOptions) generateNodeDebugPod(node *corev1.Node) (*corev1.Pod, err
 		p.Spec.Containers[0].Command = o.Args
 	}
 
-	if err := o.applier.Apply(p, cn, node); err != nil {
+	if err := o.Applier.Apply(p, cn, node); err != nil {
 		return nil, err
 	}
 
@@ -614,7 +619,7 @@ func (o *DebugOptions) generatePodCopyWithDebugContainer(pod *corev1.Pod) (*core
 	copied.Spec.EphemeralContainers = nil
 	// change ShareProcessNamespace configuration only when commanded explicitly
 	if o.shareProcessedChanged {
-		copied.Spec.ShareProcessNamespace = pointer.BoolPtr(o.ShareProcesses)
+		copied.Spec.ShareProcessNamespace = pointer.Bool(o.ShareProcesses)
 	}
 	if !o.SameNode {
 		copied.Spec.NodeName = ""
@@ -647,13 +652,11 @@ func (o *DebugOptions) generatePodCopyWithDebugContainer(pod *corev1.Pod) (*core
 		if len(name) == 0 {
 			name = o.computeDebugContainerName(copied)
 		}
-		c = &corev1.Container{
+		copied.Spec.Containers = append(copied.Spec.Containers, corev1.Container{
 			Name:                     name,
 			TerminationMessagePolicy: corev1.TerminationMessageReadFile,
-		}
-		defer func() {
-			copied.Spec.Containers = append(copied.Spec.Containers, *c)
-		}()
+		})
+		c = &copied.Spec.Containers[len(copied.Spec.Containers)-1]
 	}
 
 	if len(o.Args) > 0 {
@@ -676,7 +679,7 @@ func (o *DebugOptions) generatePodCopyWithDebugContainer(pod *corev1.Pod) (*core
 	c.Stdin = o.Interactive
 	c.TTY = o.TTY
 
-	err := o.applier.Apply(copied, c.Name, pod)
+	err := o.Applier.Apply(copied, c.Name, pod)
 	if err != nil {
 		return nil, "", err
 	}

staging/src/k8s.io/kubectl/pkg/cmd/debug/debug_test.go

@@ -55,6 +55,7 @@ func TestGenerateDebugContainer(t *testing.T) {
 				Container:  "debugger",
 				Image:      "busybox",
 				PullPolicy: corev1.PullIfNotPresent,
+				Profile:    ProfileLegacy,
 			},
 			expected: &corev1.EphemeralContainer{
 				EphemeralContainerCommon: corev1.EphemeralContainerCommon{
@@ -72,6 +73,7 @@ func TestGenerateDebugContainer(t *testing.T) {
 				Image:           "busybox",
 				PullPolicy:      corev1.PullIfNotPresent,
 				TargetContainer: "myapp",
+				Profile:         ProfileLegacy,
 			},
 			expected: &corev1.EphemeralContainer{
 				EphemeralContainerCommon: corev1.EphemeralContainerCommon{
@@ -90,6 +92,7 @@ func TestGenerateDebugContainer(t *testing.T) {
 				Container:  "debugger",
 				Image:      "busybox",
 				PullPolicy: corev1.PullIfNotPresent,
+				Profile:    ProfileLegacy,
 			},
 			expected: &corev1.EphemeralContainer{
 				EphemeralContainerCommon: corev1.EphemeralContainerCommon{
@@ -109,6 +112,7 @@ func TestGenerateDebugContainer(t *testing.T) {
 				Args:       []string{"echo", "one", "two", "three"},
 				Image:      "busybox",
 				PullPolicy: corev1.PullIfNotPresent,
+				Profile:    ProfileLegacy,
 			},
 			expected: &corev1.EphemeralContainer{
 				EphemeralContainerCommon: corev1.EphemeralContainerCommon{
@@ -125,6 +129,7 @@ func TestGenerateDebugContainer(t *testing.T) {
 			opts: &DebugOptions{
 				Image:      "busybox",
 				PullPolicy: corev1.PullIfNotPresent,
+				Profile:    ProfileLegacy,
 			},
 			expected: &corev1.EphemeralContainer{
 				EphemeralContainerCommon: corev1.EphemeralContainerCommon{
@@ -140,6 +145,7 @@ func TestGenerateDebugContainer(t *testing.T) {
 			opts: &DebugOptions{
 				Image:      "busybox",
 				PullPolicy: corev1.PullIfNotPresent,
+				Profile:    ProfileLegacy,
 			},
 			pod: &corev1.Pod{
 				Spec: corev1.PodSpec{
@@ -164,6 +170,7 @@ func TestGenerateDebugContainer(t *testing.T) {
 			opts: &DebugOptions{
 				Image:      "busybox",
 				PullPolicy: corev1.PullIfNotPresent,
+				Profile:    ProfileLegacy,
 			},
 			pod: &corev1.Pod{
 				Spec: corev1.PodSpec{
@@ -196,6 +203,7 @@ func TestGenerateDebugContainer(t *testing.T) {
 			opts: &DebugOptions{
 				Image:      "busybox",
 				PullPolicy: corev1.PullIfNotPresent,
+				Profile:    ProfileLegacy,
 			},
 			pod: &corev1.Pod{
 				Spec: corev1.PodSpec{
@@ -227,6 +235,65 @@ func TestGenerateDebugContainer(t *testing.T) {
 				},
 			},
 		},
+		{
+			name: "general profile",
+			opts: &DebugOptions{
+				Image:      "busybox",
+				PullPolicy: corev1.PullIfNotPresent,
+				Profile:    ProfileGeneral,
+			},
+			expected: &corev1.EphemeralContainer{
+				EphemeralContainerCommon: corev1.EphemeralContainerCommon{
+					Name:                     "debugger-1",
+					Image:                    "busybox",
+					ImagePullPolicy:          corev1.PullIfNotPresent,
+					TerminationMessagePolicy: corev1.TerminationMessageReadFile,
+					SecurityContext: &corev1.SecurityContext{
+						Capabilities: &corev1.Capabilities{
+							Add: []corev1.Capability{"SYS_PTRACE"},
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "baseline profile",
+			opts: &DebugOptions{
+				Image:      "busybox",
+				PullPolicy: corev1.PullIfNotPresent,
+				Profile:    ProfileBaseline,
+			},
+			expected: &corev1.EphemeralContainer{
+				EphemeralContainerCommon: corev1.EphemeralContainerCommon{
+					Name:                     "debugger-1",
+					Image:                    "busybox",
+					ImagePullPolicy:          corev1.PullIfNotPresent,
+					TerminationMessagePolicy: corev1.TerminationMessageReadFile,
+				},
+			},
+		},
+		{
+			name: "restricted profile",
+			opts: &DebugOptions{
+				Image:      "busybox",
+				PullPolicy: corev1.PullIfNotPresent,
+				Profile:    ProfileRestricted,
+			},
+			expected: &corev1.EphemeralContainer{
+				EphemeralContainerCommon: corev1.EphemeralContainerCommon{
+					Name:                     "debugger-1",
+					Image:                    "busybox",
+					ImagePullPolicy:          corev1.PullIfNotPresent,
+					TerminationMessagePolicy: corev1.TerminationMessageReadFile,
+					SecurityContext: &corev1.SecurityContext{
+						RunAsNonRoot: pointer.Bool(true),
+						Capabilities: &corev1.Capabilities{
+							Drop: []corev1.Capability{"ALL"},
+						},
+					},
+				},
+			},
+		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			tc.opts.IOStreams = genericclioptions.NewTestIOStreamsDiscard()
@@ -236,11 +303,11 @@ func TestGenerateDebugContainer(t *testing.T) {
 				tc.pod = &corev1.Pod{}
 			}
 
-			applier, err := NewProfileApplier(ProfileLegacy)
+			applier, err := NewProfileApplier(tc.opts.Profile)
 			if err != nil {
-				t.Fatalf("fail to create %s profile", ProfileLegacy)
+				t.Fatalf("failed to create profile applier: %s: %v", tc.opts.Profile, err)
 			}
-			tc.opts.applier = applier
+			tc.opts.Applier = applier
 
 			_, debugContainer, err := tc.opts.generateDebugContainer(tc.pod)
 			if err != nil {
@@ -814,7 +881,7 @@ func TestGeneratePodCopyWithDebugContainer(t *testing.T) {
 							TerminationMessagePolicy: corev1.TerminationMessageReadFile,
 						},
 					},
-					ShareProcessNamespace: pointer.BoolPtr(true),
+					ShareProcessNamespace: pointer.Bool(true),
 				},
 			},
 		},
@@ -1017,7 +1084,7 @@ func TestGeneratePodCopyWithDebugContainer(t *testing.T) {
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			var err error
-			tc.opts.applier, err = NewProfileApplier(ProfileLegacy)
+			tc.opts.Applier, err = NewProfileApplier(ProfileLegacy)
 			if err != nil {
 				t.Fatalf("Fail to create legacy profile: %v", err)
 			}
@@ -1212,7 +1279,7 @@ func TestGenerateNodeDebugPod(t *testing.T) {
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			var err error
-			tc.opts.applier, err = NewProfileApplier(ProfileLegacy)
+			tc.opts.Applier, err = NewProfileApplier(ProfileLegacy)
 			if err != nil {
 				t.Fatalf("Fail to create legacy profile: %v", err)
 			}
@@ -1236,7 +1303,7 @@ func TestCompleteAndValidate(t *testing.T) {
 	cmpFilter := cmp.FilterPath(func(p cmp.Path) bool {
 		switch p.String() {
 		// IOStreams contains unexported fields
-		case "IOStreams":
+		case "IOStreams", "Applier":
 			return true
 		}
 		return false
@@ -1572,7 +1639,6 @@ func TestCompleteAndValidate(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			opts := NewDebugOptions(ioStreams)
 			var gotError error
-
 			cmd := &cobra.Command{
 				Run: func(cmd *cobra.Command, args []string) {
 					gotError = opts.Complete(tf, cmd, args)
@@ -1599,7 +1665,7 @@ func TestCompleteAndValidate(t *testing.T) {
 			}
 
 			if diff := cmp.Diff(tc.wantOpts, opts, cmpFilter, cmpopts.IgnoreFields(DebugOptions{},
-				"attachChanged", "shareProcessedChanged", "podClient", "WarningPrinter", "applier")); diff != "" {
+				"attachChanged", "shareProcessedChanged", "podClient", "WarningPrinter", "Applier")); diff != "" {
 				t.Error("CompleteAndValidate unexpected diff in generated object: (-want +got):\n", diff)
 			}
 		})