kubectl debug hangs on 1.21 with feature gate EphemeralContainers enabled

[dafu-wu]

What Happened?

I'm trying to run the commands:

$ kubectl run ephemeral-demo --image=k8s.gcr.io/pause:3.1 --restart=Never
pod/ephemeral-demo created. 
$ kubectl debug -it ephemeral-demo --image=busybox --target=ephemeral-demo
Defaulting debug container name to debugger-jdbtj.

$ kubectl describe pod ephemeral-demo

Name:         ephemeral-demo
Namespace:    default
Priority:     0
Node:         worker1/192.168.56.81
Start Time:   Wed, 09 Feb 2022 03:09:13 +0000
Labels:       run=ephemeral-demo
Annotations:  cni.projectcalico.org/containerID: 22bcad9793f1f551b6fb09f377c5e0b00c57b8d096fb92e2a750d92d81eb505f
              cni.projectcalico.org/podIP: 10.244.235.145/32
              cni.projectcalico.org/podIPs: 10.244.235.145/32
Status:       Running
IP:           10.244.235.145
IPs:
  IP:  10.244.235.145
Containers:
  ephemeral-demo:
    Container ID:   docker://d7b9ce2a116df3d1490f695aa6193ebc7b0cdb4406eca3acb3c0c355d3df58ad
    Image:          k8s.gcr.io/pause:3.1
    Image ID:       docker-pullable://registry.aliyuncs.com/google_containers/pause@sha256:6c3835cab3980f11b83277305d0d736051c32b17606f5ec59f1dda67c9ba3810
    Port:           <none>
    Host Port:      <none>
    State:          Running
      Started:      Wed, 09 Feb 2022 03:09:14 +0000
    Ready:          True
    Restart Count:  0
    Environment:    <none>
    Mounts:
      /var/run/secrets/kubernetes.io/serviceaccount from kube-api-access-cxgkl (ro)
Ephemeral Containers:
  debugger-jdbtj:
    Image:        busybox
    Port:         <none>
    Host Port:    <none>
    Environment:  <none>
    Mounts:       <none>
Conditions:
  Type              Status
  Initialized       True 
  Ready             True 
  ContainersReady   True 
  PodScheduled      True 
Volumes:
  kube-api-access-cxgkl:
    Type:                    Projected (a volume that contains injected data from multiple sources)
    TokenExpirationSeconds:  3607
    ConfigMapName:           kube-root-ca.crt
    ConfigMapOptional:       <nil>
    DownwardAPI:             true
QoS Class:                   BestEffort
Node-Selectors:              <none>
Tolerations:                 node.kubernetes.io/not-ready:NoExecute op=Exists for 300s
                             node.kubernetes.io/unreachable:NoExecute op=Exists for 300s
Events:
  Type    Reason     Age   From               Message
  ----    ------     ----  ----               -------
  Normal  Scheduled  11m   default-scheduler  Successfully assigned default/ephemeral-demo to worker1
  Normal  Pulled     11m   kubelet            Container image "k8s.gcr.io/pause:3.1" already present on machine
  Normal  Created    11m   kubelet            Created container ephemeral-demo
  Normal  Started    11m   kubelet            Started container ephemeral-demo

But if I try to exec into it, I get a failure:

kubectl exec -it ephemeral-demo -c debugger-g6pj6 -- bash
error: unable to upgrade connection: container not found ("debugger-jdbtj")

Am I missing something?

Attach the log file

As above

Operating System

Ubuntu

Driver

Docker

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[lyyao09]

I have the same problem, how should I solve it?

[Mr-YYM]

you need to add this line into your node kubelet config(/var/lib/kubelet/config.yaml), and restart kubelet

featureGates:
  EphemeralContainers: true