Ephemeral container debug is not working for 8.3.x

[dddpaul]

Since Zeebe 8.3.x use non-privileged user to run zeebe process inside container - ephemeral container method became broken.

Trying with simplest busybox image:

kubectl debug -it camunda-zeebe-0 --image=busybox:1.28 --target=zeebe
Targeting container "zeebe". If you don't see processes from this container it may be because the container runtime doesn't support this feature.
Defaulting debug container name to debugger-2x7n2.
Warning: container debugger-2x7n2: container has runAsNonRoot and image will run as root (pod: "camunda-zeebe-0_default(70ff89d8-78fa-4b49-98c0-7ef4c2f59f78)", container: debugger-2x7n2)

kubectl describe pod camunda-zeebe-0:

Ephemeral Containers:
 debugger-2x7n2:
    Container ID:    
    Image:           busybox:1.28
    Image ID:        
    Port:            <none>
    Host Port:       <none>
    State:           Waiting
      Reason:        CreateContainerConfigError
    Ready:           False
    Restart Count:   0
    Environment:     <none>
    Mounts:          <none>

Definitely it's not a problem of zdb tool ) But the users should know not to use this method for 8.3 and later versions.

Maybe it will be fixed inside k8s:
kubernetes/kubernetes#110126
kubernetes/kubectl#1108

[ChrisKujawa]

PodSecurity is non-mutating. When using ephemeral containers in a namespace that is enforcing the restricted PodSecurity level, the ephemeral container must set securityContext.allowPrivilegeEscalation=false and securityContext.capabilities.drop=["ALL"]
kubernetes/kubernetes#110126 (comment)

Would be interesting whether this works.

Additionally kubernetes/kubernetes#114280

[ChrisKujawa]

There is still an open issue to implement more profiles until then this approach can likely not be used kubernetes/kubectl#1108

[ChrisKujawa]

I will remove the debug container approach from the README or put a note that this might not be possible right now.

[ChrisKujawa]

I made a note of it in the readme 401c279 thanks for reporting I will close this issue then. I see no way to fix it from here