[WIP] Adding windows profile to allow kubectl node debug #130807

rtkgupta · 2025-03-14T05:21:45Z

What type of PR is this?

What this PR does / why we need it:

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

This PR allows functionality to use kubectl debug to debug windows nodes using host process containers.

Example usage:

kubectl debug -it node/<windows-node-name> --image mcr.microsoft.com/oss/kubernetes/windows-host-process-containers-base-image:v1.0.0 --profile windows

Running windows profile on a linux node errors out as:

Does this PR introduce a user-facing change?

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

k8s-ci-robot · 2025-03-14T05:21:48Z

Adding the "do-not-merge/release-note-label-needed" label because no release-note block was detected, please follow our release note process to remove it.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

linux-foundation-easycla · 2025-03-14T05:21:52Z

The committers listed above are authorized under a signed CLA.

✅ login: rtkgupta / name: Ritika Gupta (5578318)

k8s-ci-robot · 2025-03-14T05:21:55Z

Welcome @rtkgupta!

It looks like this is your first PR to kubernetes/kubernetes 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes/kubernetes has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

k8s-ci-robot · 2025-03-14T05:21:55Z

Hi @rtkgupta. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

k8s-ci-robot · 2025-03-14T05:22:02Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: rtkgupta
Once this PR has been reviewed and has the lgtm label, please assign apelisse for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

staging/src/k8s.io/kubectl/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

jsturtevant · 2025-03-17T17:52:33Z

staging/src/k8s.io/kubectl/pkg/cmd/debug/profiles.go

+			c.SecurityContext.WindowsOptions = &corev1.WindowsSecurityContextOptions{}
+		}
+		c.SecurityContext.WindowsOptions.HostProcess = ptr.To(true)
+		c.SecurityContext.WindowsOptions.RunAsUserName = ptr.To("NT AUTHORITY\\SYSTEM")


can you make this configurable?

jsturtevant · 2025-03-17T17:53:07Z

/sig windows
/triage accepted

/cc @zylxjtu @marosset @aravindhp

jsturtevant · 2025-03-17T23:52:27Z

staging/src/k8s.io/kubectl/pkg/cmd/debug/profiles.go

+		if c.Name != containerName {
+			return true
+		}


Where does this pod spec come from? All the containers in a HPC pod must be configured with HostProcess, so If this pod spec has more than one container I think this wouldn't work.

Since this only used with kubectl debug node command could this just set the Hostprocess setting on the pod spec? and verify it isn't false already on any of the containers?

jsturtevant · 2025-03-17T23:58:22Z

Should there be a check somewhere that makes sure the node selected is a Windows node? We want to be able to run kubectl from a linux (or windows) machine but connect to a windows node using this feature. Maybe, ideally, it would select the proper profile according to which node is selected?

Signed-off-by: Ritika Gupta <[email protected]>

mansikulkarni96 · 2025-03-18T16:40:04Z

kubernetes/staging/src/k8s.io/kubectl/pkg/cmd/debug/debug.go

Line 214 in 5578318

    
           cmd.Flags().StringVar(&o.Profile, "profile", ProfileLegacy, i18n.T(`Options are "legacy", "general", "baseline", "netadmin", "restricted" or "sysadmin".`))

needs update to include Windows profile.

zylxjtu · 2025-03-18T18:09:03Z

A few maybe naive questions: Will a successful run of this give user a windows node access, just like logging in to a HPC pod with amdin access? and will the exit of the debug command destroy the deployed HPC pod?

rtkgupta · 2025-03-18T18:23:43Z

@zylxjtu Yep! Using this command will bring up an interactive shell which is an hpc, so you have access to host files as NT AUTHORITY\SYSTEM and when you are done debugging the hpc debug container is removed.

kubectl debug -it node/<windows-node-name> --image mcr.microsoft.com/oss/kubernetes/windows-host-process-containers-base-image:v1.0.0 --profile windows

soltysh · 2025-03-19T15:59:45Z

staging/src/k8s.io/kubectl/pkg/cmd/debug/profiles.go

@@ -56,6 +56,8 @@ const (
 	ProfileNetadmin = "netadmin"
 	// ProfileSysadmin offers elevated privileges for debugging.
 	ProfileSysadmin = "sysadmin"
+	// ProfileWindows offers elevated privileges for debugging.
+	ProfileWindows = "windows"


My only question will be, is this going to be the only one windows profile? IIUC the only thing you're setting is the host network, so maybe something like win-netadmin or something that will allow us to add additional windows profiles in the future?

From today's sig-cli call @brianpursley pointed that win-sysadmin might be a better name. Still to be confirmed with sig-windows TLs.

+1 for win-sysadmin or winadmin

k8s-triage-robot · 2025-06-27T22:41:51Z

The Kubernetes project currently lacks enough contributors to adequately respond to all PRs.

This bot triages PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

Mark this PR as fresh with /remove-lifecycle stale
Close this PR with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

k8s-ci-robot added do-not-merge/needs-kind Indicates a PR lacks a `kind/foo` label and requires one. do-not-merge/needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. labels Mar 14, 2025

k8s-ci-robot added needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. needs-priority Indicates a PR lacks a `priority/foo` label and requires one. labels Mar 14, 2025

k8s-ci-robot requested review from brianpursley and soltysh March 14, 2025 05:22

k8s-ci-robot added area/kubectl sig/cli Categorizes an issue or PR as relevant to SIG CLI. labels Mar 14, 2025

github-project-automation bot added this to SIG CLI Mar 14, 2025

k8s-ci-robot removed the do-not-merge/needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. label Mar 14, 2025

github-project-automation bot moved this to Needs Triage in SIG CLI Mar 14, 2025

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. and removed cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. labels Mar 14, 2025

rtkgupta force-pushed the rtkgupta/windows-profile branch from 2ce2462 to 508c9ab Compare March 15, 2025 19:44

jsturtevant reviewed Mar 17, 2025

View reviewed changes

k8s-ci-robot requested review from aravindhp, marosset and zylxjtu March 17, 2025 17:53

k8s-ci-robot added the sig/windows Categorizes an issue or PR as relevant to SIG Windows. label Mar 17, 2025

k8s-ci-robot added triage/accepted Indicates an issue or PR is ready to be actively worked on. and removed needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. labels Mar 17, 2025

jsturtevant reviewed Mar 17, 2025

View reviewed changes

Adding windows profile to allow kubectl node debug

5578318

Signed-off-by: Ritika Gupta <[email protected]>

rtkgupta force-pushed the rtkgupta/windows-profile branch from 508c9ab to 5578318 Compare March 18, 2025 01:46

soltysh reviewed Mar 19, 2025

View reviewed changes

k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jun 27, 2025

[WIP] Adding windows profile to allow kubectl node debug #130807

Are you sure you want to change the base?

[WIP] Adding windows profile to allow kubectl node debug #130807

Uh oh!

Conversation

rtkgupta commented Mar 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What type of PR is this?

What this PR does / why we need it:

Which issue(s) this PR fixes:

Special notes for your reviewer:

Does this PR introduce a user-facing change?

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

Uh oh!

k8s-ci-robot commented Mar 14, 2025

Uh oh!

linux-foundation-easycla bot commented Mar 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

k8s-ci-robot commented Mar 14, 2025

Uh oh!

k8s-ci-robot commented Mar 14, 2025

Uh oh!

k8s-ci-robot commented Mar 14, 2025

Uh oh!

jsturtevant Mar 17, 2025

Choose a reason for hiding this comment

Uh oh!

jsturtevant commented Mar 17, 2025

Uh oh!

jsturtevant Mar 17, 2025

Choose a reason for hiding this comment

Uh oh!

jsturtevant commented Mar 17, 2025

Uh oh!

mansikulkarni96 commented Mar 18, 2025

Uh oh!

zylxjtu commented Mar 18, 2025

Uh oh!

rtkgupta commented Mar 18, 2025

Uh oh!

soltysh Mar 19, 2025

Choose a reason for hiding this comment

Uh oh!

soltysh Mar 19, 2025

Choose a reason for hiding this comment

Uh oh!

aravindhp Mar 29, 2025

Choose a reason for hiding this comment

Uh oh!

k8s-triage-robot commented Jun 27, 2025

Uh oh!

Uh oh!

rtkgupta commented Mar 14, 2025 •

edited

Loading

linux-foundation-easycla bot commented Mar 14, 2025 •

edited

Loading