From 18b5e979a135987d7f38045f7ca511f5b9bf7fce Mon Sep 17 00:00:00 2001 From: Peter Sprygada Date: Tue, 27 Oct 2026 22:32:36 -0400 Subject: [PATCH 1/2] fix(debug): Pin the netshoot base and drop kubectl and bpftrace The final stage built FROM nicolaka/netshoot:latest, so two builds of one commit could ship different tools, and Renovate had no version to bump. It now pins v0.16 by digest, the image latest resolves to today, so the built image doesn't change. kubectl and bpftrace never worked from a node debug pod. The pod runs as its namespace's default service account, which has no RBAC, and it doesn't mount tracefs. Neither tool is in the netshoot base, and nothing in the repository runs them from this image. The README now says the image leaves them out and that kubectl runs from the operator's workstation. --- containers/galactic-debug/Dockerfile | 20 +++++++------------- containers/galactic-debug/README.md | 23 +++++++++++------------ 2 files changed, 18 insertions(+), 25 deletions(-) diff --git a/containers/galactic-debug/Dockerfile b/containers/galactic-debug/Dockerfile index 387c794b..f4ece5f1 100644 --- a/containers/galactic-debug/Dockerfile +++ b/containers/galactic-debug/Dockerfile @@ -55,28 +55,22 @@ RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} \ go install "github.com/osrg/gobgp/v4/cmd/gobgp@${GOBGP_VERSION}" \ && find "$(go env GOPATH)/bin" -name gobgp -exec cp {} /workspace/gobgp \; -FROM nicolaka/netshoot:latest +FROM nicolaka/netshoot:v0.16@sha256:b09d9b21381f47a79b3cbcb30da25266dc17186ea00ae65e99fdc51396f48e70 ARG TARGETARCH -ARG KUBECTL_VERSION=v1.34.0 ARG CRICTL_VERSION=v1.34.0 ARG YQ_VERSION=v4.44.3 -# bpftool/bpftrace: eBPF map/prog introspection, which nodes do not -# otherwise provide, for dumping galactic-cni's usid_egress and -# egress_route_table maps directly. +# bpftool: eBPF map/prog introspection, which nodes do not otherwise +# provide, for dumping galactic-cni's usid_egress and egress_route_table +# maps directly. # frr: ships vtysh, for querying fabric-router's FRR instance directly. +# No kubectl (a node debug pod has no RBAC) and no bpftrace (the pod has no +# tracefs); see the README. RUN apk add --no-cache \ bpftool \ - bpftrace \ frr -# kubectl: correlating with the EndpointSlice state that drives -# vpc-vrf-sidecar's route installs. -RUN curl -fsSL "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/${TARGETARCH}/kubectl" \ - -o /usr/local/bin/kubectl \ - && chmod +x /usr/local/bin/kubectl - -# crictl: CRI-level container/pod inspection alongside kubectl. +# crictl: CRI-level container/pod inspection. RUN curl -fsSL "https://github.com/kubernetes-sigs/cri-tools/releases/download/${CRICTL_VERSION}/crictl-${CRICTL_VERSION}-linux-${TARGETARCH}.tar.gz" \ | tar xz -C /usr/local/bin diff --git a/containers/galactic-debug/README.md b/containers/galactic-debug/README.md index e2b5886d..21567715 100644 --- a/containers/galactic-debug/README.md +++ b/containers/galactic-debug/README.md @@ -4,8 +4,11 @@ An incident-response toolbox image, built on `nicolaka/netshoot` plus the tools that debugging Galactic's datapath and routing needs and netshoot doesn't already have: `bpftool`, `vtysh` (FRR client), the `gobgp` CLI, `crictl`, `yq`, and `galactic-usid` (this repo's base62/hex uSID codec, -`cmd/galactic-usid`). The image also ships `kubectl` and `bpftrace`, which -don't work from a debug pod today (see [What doesn't work](#what-doesnt-work)). +`cmd/galactic-usid`). + +The image has no `kubectl`: a node debug pod runs as its namespace's +`default` service account, which has no RBAC. It has no `bpftrace` either, +because the pod doesn't mount tracefs. Published as `ghcr.io/datum-cloud/galactic-debug`. Not deployed as a standing workload: attach it on demand as a node debug pod. @@ -112,13 +115,6 @@ without changing the target pod. Some workloads (Kata, Unikraft) sit behind a tap interface: from the host you see the host-side interface, never the guest. -## What doesn't work - -| Tool | Why | Tracked in | -| ---------- | ------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------ | -| `kubectl` | The pod runs as the namespace's `default` service account, which has no RBAC. Run `kubectl` from your workstation | [#1158](https://github.com/datum-cloud/galactic/issues/1158) | -| `bpftrace` | Needs tracefs, which the pod doesn't mount. Even with `mount -t tracefs tracefs /sys/kernel/tracing` it isn't verified to work | [#1158](https://github.com/datum-cloud/galactic/issues/1158) | - ## Known caveats to re-check every time - **A service reachable through more than one region needs testing in @@ -147,6 +143,9 @@ never the guest. version `galactic-router` embeds (`go.mod`'s `github.com/osrg/gobgp/v4`). Renovate bumps both in the same pull request. -`KUBECTL_VERSION`/`CRICTL_VERSION`/`YQ_VERSION` build args pin the rest; -bump periodically, roughly tracking the Kubernetes minor version of the -Galactic edge clusters the image is used on. +The `nicolaka/netshoot` base is pinned by tag and digest, so every build of +a commit gets the same base. Renovate proposes base updates. + +`CRICTL_VERSION`/`YQ_VERSION` build args pin the rest; bump periodically, +roughly tracking the Kubernetes minor version of the Galactic edge clusters +the image is used on. From 7eaa081e2b6b582ea4b261fce97cbc59ac576f44 Mon Sep 17 00:00:00 2001 From: Peter Sprygada Date: Tue, 27 Oct 2026 22:37:18 -0400 Subject: [PATCH 2/2] docs(debug): Drop duplicate kubectl notes from galactic-debug The Dockerfile comment and the README's closing kubectl line repeated the note at the top of the README. Keep the one note in the README, next to the paragraph that explains it. --- containers/galactic-debug/Dockerfile | 2 -- containers/galactic-debug/README.md | 4 +--- 2 files changed, 1 insertion(+), 5 deletions(-) diff --git a/containers/galactic-debug/Dockerfile b/containers/galactic-debug/Dockerfile index f4ece5f1..b497331b 100644 --- a/containers/galactic-debug/Dockerfile +++ b/containers/galactic-debug/Dockerfile @@ -64,8 +64,6 @@ ARG YQ_VERSION=v4.44.3 # provide, for dumping galactic-cni's usid_egress and egress_route_table # maps directly. # frr: ships vtysh, for querying fabric-router's FRR instance directly. -# No kubectl (a node debug pod has no RBAC) and no bpftrace (the pod has no -# tracefs); see the README. RUN apk add --no-cache \ bpftool \ frr diff --git a/containers/galactic-debug/README.md b/containers/galactic-debug/README.md index 21567715..788dfaa3 100644 --- a/containers/galactic-debug/README.md +++ b/containers/galactic-debug/README.md @@ -8,7 +8,7 @@ doesn't already have: `bpftool`, `vtysh` (FRR client), the `gobgp` CLI, The image has no `kubectl`: a node debug pod runs as its namespace's `default` service account, which has no RBAC. It has no `bpftrace` either, -because the pod doesn't mount tracefs. +because the pod doesn't mount tracefs. Run `kubectl` from your workstation. Published as `ghcr.io/datum-cloud/galactic-debug`. Not deployed as a standing workload: attach it on demand as a node debug pod. @@ -51,8 +51,6 @@ kubectl -n galactic-system exec -it -- bash kubectl -n galactic-system delete pod ``` -Run `kubectl` from your workstation, not from inside the pod. - ## Inside the pod The pod sits in the host network namespace, but its filesystem is the