What are Kubernetes Ephemeral Containers for debugging?

Question

Accepted Answer

**Ephemeral Containers** — temporary containers in Pod for debugging (without restart).

**Problem:** If a container is in CrashLoopBackOff, you cannot `kubectl exec` (container is not running).

**Solution — debug container:**
```bash
# Add debug container to Pod
kubectl debug -it my-pod --image=busybox --target=my-container

# Clone Pod with debug container
kubectl debug node/my-node -it --image=busybox

# Debug with PID namespace change
kubectl debug -it my-pod --image=busybox --target=my-container --same-namespace
```

**Ephemeral Container spec:**
```yaml
apiVersion: v1
kind: Pod
metadata:
  name: my-pod
spec:
  ephemeralContainers:
    - name: debugger
      image: busybox:1.36
      command: ["sh"]
      stdin: true
      tty: true
      targetContainerName: my-container
      resources:
        requests:
          memory: "64Mi"
          cpu: "100m"
```

**Debugging CrashLoopBackOff:**
```bash
# View logs of previous container
kubectl logs my-pod --previous

# Add ephemeral container
kubectl debug -it my-pod --image=busybox --target=my-container

# Inside debug container
ls /proc/1/root/
cat /proc/1/root/etc/config.yaml
nsenter -t 1 -n ss -tlnp
```

**Advantages:** does not restart Pod, does not affect main container, access to PID namespace.

DevOps: What are Kubernetes Ephemeral Containers for debugging?