search

pashevskii / debug-pods-lens-extension

Lens extension, which helps to debug pods
Other
50 stars 8 forks source link

Unable to run debug pod from private registry with auth #8

Open dominch opened 3 years ago

dominch commented 3 years ago

I just tried to build and upload image to private registry with some basic auth, then use that with this extension, It failed with 401 error message :(

BTW: there are already registry credentials in this namespace redy to use, just no option to run them in pod :(

pashevskii commented 3 years ago

Hi, the extension just automates kubectl command building and runs in terminal, for examle: exec kubectl run joomla-1614692531-mariadb-0-debug -n default -it --image=markeijsermans/debug --restart=Never --attach --labels=createdBy=lens-debug-extension --rm

It looks like the current namespace doesn't have a secret with docker credentials (or the password is wrong). Could you check to create a pod, based on the image from the private repo manually?

dominch commented 3 years ago

Hello, There are two options for registry credentials - first - add registry credentials to default service account (but it's not always possible) and second to add registry credentials to pod specification (secret name from current namespace as imagepullsecret section). First one require some additional permissions and it's not always possible :(

Right now plugin generates code that is timing out after some time: pod "update-force-27217770-zx6k8-debug" deleted error: timed out waiting for the condition

Missing part for second approach in command line is: --overrides='{ \"spec\": { \"imagePullSecrets\": [{\"name\": \"reg-cred-secret-name\"}] } }'

when I repeat command and add that section it works as I expected and container is running.

apopaa commented 3 years ago

Hi, the extension just automates kubectl command building and runs in terminal, for examle: exec kubectl run joomla-1614692531-mariadb-0-debug -n default -it --image=markeijsermans/debug --restart=Never --attach --labels=createdBy=lens-debug-extension --rm

It looks like the current namespace doesn't have a secret with docker credentials (or the password is wrong). Could you check to create a pod, based on the image from the private repo manually?

Uhm ... why is the extension running "kubectl run ..."? Shouldn't it be running "kubectl debug ...", as per official documentation https://kubernetes.io/docs/tasks/debug-application-cluster/debug-running-pod/#copying-a-pod-while-adding-a-new-container ?