Skip to content

fix(debug): Pin the netshoot base and drop kubectl and bpftrace #1174

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
privateip merged 2 commits into from
Oct 28, 2026
Merged

fix(debug): Pin the netshoot base and drop kubectl and bpftrace #1174

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
18b5e97
fix(debug): Pin the netshoot base and drop kubectl and bpftrace
privateip Oct 28, 2026
7eaa081
docs(debug): Drop duplicate kubectl notes from galactic-debug
privateip Oct 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 5 additions & 13 deletions containers/galactic-debug/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,28 +55,20 @@ RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} \
go install "github.com/osrg/gobgp/v4/cmd/gobgp@${GOBGP_VERSION}" \
&& find "$(go env GOPATH)/bin" -name gobgp -exec cp {} /workspace/gobgp \;

FROM nicolaka/netshoot:latest
FROM nicolaka/netshoot:v0.16@sha256:b09d9b21381f47a79b3cbcb30da25266dc17186ea00ae65e99fdc51396f48e70
ARG TARGETARCH
ARG KUBECTL_VERSION=v1.34.0
ARG CRICTL_VERSION=v1.34.0
ARG YQ_VERSION=v4.44.3

# bpftool/bpftrace: eBPF map/prog introspection, which nodes do not
# otherwise provide, for dumping galactic-cni's usid_egress and
# egress_route_table maps directly.
# bpftool: eBPF map/prog introspection, which nodes do not otherwise
# provide, for dumping galactic-cni's usid_egress and egress_route_table
# maps directly.
# frr: ships vtysh, for querying fabric-router's FRR instance directly.
RUN apk add --no-cache \
bpftool \
bpftrace \
frr

# kubectl: correlating with the EndpointSlice state that drives
# vpc-vrf-sidecar's route installs.
RUN curl -fsSL "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/${TARGETARCH}/kubectl" \
-o /usr/local/bin/kubectl \
&& chmod +x /usr/local/bin/kubectl

# crictl: CRI-level container/pod inspection alongside kubectl.
# crictl: CRI-level container/pod inspection.
RUN curl -fsSL "https://github.com/kubernetes-sigs/cri-tools/releases/download/${CRICTL_VERSION}/crictl-${CRICTL_VERSION}-linux-${TARGETARCH}.tar.gz" \
| tar xz -C /usr/local/bin

Expand Down
25 changes: 11 additions & 14 deletions containers/galactic-debug/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,11 @@ An incident-response toolbox image, built on `nicolaka/netshoot` plus the
tools that debugging Galactic's datapath and routing needs and netshoot
doesn't already have: `bpftool`, `vtysh` (FRR client), the `gobgp` CLI,
`crictl`, `yq`, and `galactic-usid` (this repo's base62/hex uSID codec,
`cmd/galactic-usid`). The image also ships `kubectl` and `bpftrace`, which
don't work from a debug pod today (see [What doesn't work](#what-doesnt-work)).
`cmd/galactic-usid`).

The image has no `kubectl`: a node debug pod runs as its namespace's
`default` service account, which has no RBAC. It has no `bpftrace` either,
because the pod doesn't mount tracefs. Run `kubectl` from your workstation.

Published as `ghcr.io/datum-cloud/galactic-debug`. Not deployed as a
standing workload: attach it on demand as a node debug pod.
Expand Down Expand Up @@ -48,8 +51,6 @@ kubectl -n galactic-system exec -it <debug-pod> -- bash
kubectl -n galactic-system delete pod <debug-pod>
```

Run `kubectl` from your workstation, not from inside the pod.

## Inside the pod

The pod sits in the host network namespace, but its filesystem is the
Expand Down Expand Up @@ -112,13 +113,6 @@ without changing the target pod. Some workloads (Kata, Unikraft) sit
behind a tap interface: from the host you see the host-side interface,
never the guest.

## What doesn't work

| Tool | Why | Tracked in |
| ---------- | ------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------ |
| `kubectl` | The pod runs as the namespace's `default` service account, which has no RBAC. Run `kubectl` from your workstation | [#1158](https://github.com/datum-cloud/galactic/issues/1158) |
| `bpftrace` | Needs tracefs, which the pod doesn't mount. Even with `mount -t tracefs tracefs /sys/kernel/tracing` it isn't verified to work | [#1158](https://github.com/datum-cloud/galactic/issues/1158) |

## Known caveats to re-check every time

- **A service reachable through more than one region needs testing in
Expand Down Expand Up @@ -147,6 +141,9 @@ never the guest.
version `galactic-router` embeds (`go.mod`'s `github.com/osrg/gobgp/v4`).
Renovate bumps both in the same pull request.

`KUBECTL_VERSION`/`CRICTL_VERSION`/`YQ_VERSION` build args pin the rest;
bump periodically, roughly tracking the Kubernetes minor version of the
Galactic edge clusters the image is used on.
The `nicolaka/netshoot` base is pinned by tag and digest, so every build of
a commit gets the same base. Renovate proposes base updates.

`CRICTL_VERSION`/`YQ_VERSION` build args pin the rest; bump periodically,
roughly tracking the Kubernetes minor version of the Galactic edge clusters
the image is used on.
Loading