Hi all, I am having an issue here connecting to my `kube-apiserver` pod, could y . . .

Kubernetes-Slack Discussions
#1

Disha:
Hi all,
I am having an issue here connecting to my kube-apiserver pod, could you please help/advise?

On running the following command, I get the error,

k exec kube-apiserver-xxxxxxxxxxxxxxxx -it -c kube-apiserver -- sh

error: Internal error occurred: error executing command in container: failed to exec in container: failed to start exec "xxxxxxxxxxx": OCI runtime exec failed: exec failed: container_linux.go:370: starting container process caused: exec: "sh": executable file not found in $PATH: unknown

I tried to troubleshoot it by running the following commands (following responses on Google) but all of them gave the same error as above,

k exec kube-apiserver-xxxxxxxxxxxxxxxx -it -c kube-apiserver -- bin/sh
k exec kube-apiserver-xxxxxxxxxxxxxxxx -it -c kube-apiserver -- bash/sh
k exec kube-apiserver-xxxxxxxxxxxxxxxx -it -c kube-apiserver -- ./bin/sh
k exec kube-apiserver-xxxxxxxxxxxxxxxx -it -c kube-apiserver -- ./bash/sh

Then, I tried to find details of “sh” in ./bin directory but that also failed

kubectl exec kube-apiserver-xxxxxxxxxxxxxxxx  -c kube-apiserver -- ls -l /bin/sh

error: Internal error occurred: error executing command in container: failed to exec in container: failed to start exec "xxxxxxxxxx": OCI runtime exec failed: exec failed: container_linux.go:370: starting container process caused: exec: "ls": executable file not found in $PATH: unknown

Lastly, I tried to check $PATH value by but that also threw an error,

kubectl exec kube-apiserver-xxxxxxxxxxxxxxxx -c kube-apiserver -- echo $PATH

error: Internal error occurred: error executing command in container: failed to exec in container: failed to start exec "xxxxxxxxxxxxx": OCI runtime exec failed: exec failed: container_linux.go:370: starting container process caused: exec: "echo": executable file not found in $PATH: unknown

The pod is healthy and the container logs also do not show anything weird.
Same happens when I try to connect to kube-controller-manager pod as well

Could you please help?

Thanks a lot!

#2

Alistair Mackay:
You cannot exec into the api server pod, or any of the control plane pods. For security reasons they are built without a shell or any of the standard linux commands in - for the purpose to not permit people to run commands inside the pods.

I suspect they’re built from scratch base images (distroless) meaning that the only thing inside the container is the program binary and absolutely nothing else.

1 Like
#3

Disha:
This makes sense. Thank you for the prompt response here, appreciate it.

#4

Alistair Mackay:
This is an example of how such is built. Line 11 onwards copies only the compiled binary into the distroless container from the build container that compiled it.
https://github.com/fireflycons/terminator/blob/master/Dockerfile

#5

Disha:
Thanks for sharing! :thank_you: