Repository navigation
fix(sentry-kube): Make debug containers usable for getsentry pods - #262
Merged
Merged
Conversation
Several subPath mounts of the same volume into the same directory were rewritten to identical mountPaths, which Kubernetes rejects for the ephemeral container. Add each resulting mount only once. Without a command, kubectl debug ran the image entrypoint, which fails because the subPath files are not linked in place yet, so the debug container exited immediately. Start sh by default instead. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The target container usually runs as a non-root user, so root in the debug container got "Permission denied" on /proc/<pid>/root and could not browse the target's filesystem. Add SYS_PTRACE by default instead of requiring a fully privileged container via -p. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
oioki
marked this pull request as ready for review
October 16, 2026 13:54
tnt-sentry
approved these changes
Oct 16, 2026
3 tasks done
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes three problems that made
sentry-kube debugunusable on getsentry pods such asgetsentry-web-symbols-production-canary.Duplicate mount paths. Ephemeral containers can't use
subPathmounts, sodebugmounts each whole volume under/subPathMounts/<volume><dir>. When severalsubPathmounts of the same volume go into the same directory (e.g.k8s_regionsilo_ops.py,kafka_topic_to_cluster.yamlandkafka_cluster_to_brokers.yamlfrom thegetsentryvolume), they were all rewritten to the samemountPath, and the API rejected the pod withmountPath: ... must be unique. Each resulting mount is now added only once.Container exited immediately. With no command,
kubectl debugran the image entrypoint. Sentry then failed to importgetsentry.conf.settings.k8s_regionsilo_ops, because thesubPathfiles aren't at their original paths in the debug container, and the container exited before it could be attached.debugnow startsshwhen no command is given.shis used rather thanbashso that alpine/busybox images work too; pass-- bashexplicitly if needed.No access to the target's filesystem. The target container usually runs as a non-root user, so root in the debug container got
Permission deniedon/proc/<pid>/root. The debug container now getsSYS_PTRACEby default. You can then use a tool image (e.g.--image debian) and still read the app container's real files, mounts included, under/proc/1/root/.... Making the container privileged by default was considered and rejected, since that grants node-level access for every routine debug session;-pstill does that when needed.🤖 Generated with Claude Code