k8s如何执行distroless容器

Question

我想从 cronJob 删除特定文件到以下容器，问题是当我运行 exec 时出现错误，如何 exec 到 distroless 容器（k8s v1.22.5）并从 cronJob 删除文件，哪个选项我们是否有？

这是部署

apiVersion: apps/v1
kind: Deployment
metadata:
  name: distro
  labels:
    app: distro
spec:
  replicas: 1
  selector:
    matchLabels:
      app: distro
  template:
    metadata:
      labels:
        app: distro
    spec:
      containers:
        - name: edistro
          image: timberio/vector:0.21.X-distroless-libc
          ports:
            - containerPort: 80

我尝试过的是

apiVersion: apps/v1
kind: Deployment
metadata:
  name: distro
  labels:
    app: distro
spec:
  replicas: 1
  selector:
    matchLabels:
      app: distro
  template:
    metadata:
      labels:
        app: distro
    spec:
      containers:
        - name: edistro
          image: timberio/vector:0.21.X-distroless-libc
          ports:
            - containerPort: 80

错误是：

kubectl exec -i -t -n apits aor-agent-zz -c tor "--" sh -c "clear; (bash || ash || sh)"

我尝试了如下

error: Internal error occurred: error executing command in container: failed to exec in container: failed to start exec

并得到错误：

Targeting container "edistro". If you don't see processes from this container it may be because the container runtime doesn't support this feature. Defaulting debug container name to debugger-fvfxs. error: ephemeral containers are disabled for this cluster (error from server: "the server could not find the requested resource").

我猜测（不确定）我们的容器运行时不支持它，我们有哪个选项？

下面的答案没有解决问题，我需要一种从distroless pod 外部访问并删除那里的特定文件的方法，我该怎么做？

Answer 1

使用的目的distro-less是在镜像中打包最少数量的工具/软件。shell这意味着从图像中删除不必要的工具。

您可以使用它，但这可能取决于您的目标：

kubectl debug -it <POD_TO_DEBUG> --image=<helper-image> --target=<CONTAINER_TO_DEBUG> --share-processes

例如：

kubectl debug -it distro-less-pod   --image=ubuntu --target=edistro  --share-processes