{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/1513","repository_url":"https://api.github.com/repos/kubernetes/kubernetes","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/1513/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/1513/comments","events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/1513/events","html_url":"https://github.com/kubernetes/kubernetes/issues/1513","id":44475173,"number":1513,"title":"Real container ssh","user":{"login":"bgrant0607","id":7725777,"avatar_url":"https://avatars.githubusercontent.com/u/7725777?v=3","gravatar_id":"","url":"https://api.github.com/users/bgrant0607","html_url":"https://github.com/bgrant0607","followers_url":"https://api.github.com/users/bgrant0607/followers","following_url":"https://api.github.com/users/bgrant0607/following{/other_user}","gists_url":"https://api.github.com/users/bgrant0607/gists{/gist_id}","starred_url":"https://api.github.com/users/bgrant0607/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bgrant0607/subscriptions","organizations_url":"https://api.github.com/users/bgrant0607/orgs","repos_url":"https://api.github.com/users/bgrant0607/repos","events_url":"https://api.github.com/users/bgrant0607/events{/privacy}","received_events_url":"https://api.github.com/users/bgrant0607/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/area/introspection","name":"area/introspection","color":"bfe5bf"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/area/security","name":"area/security","color":"d4c5f9"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/area/usability","name":"area/usability","color":"bfe5bf"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/help-wanted","name":"help-wanted","color":"006b75"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/kind/enhancement","name":"kind/enhancement","color":"c7def8"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/priority/P3","name":"priority/P3","color":"fef2c0"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/team/CSI-API%20Machinery%20SIG","name":"team/CSI-API Machinery SIG","color":"d2b48c"}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":73,"created_at":"2014-09-30T17:27:32Z","updated_at":"2016-08-08T17:52:08Z","closed_at":"2015-07-09T05:21:03Z","body":"Forking ssh off of #386.\r\n\r\nTo debug a containerized application, currently, a user can ssh to the host and then use nsenter/nsinit or docker exec to enter the container, or they could run their own sshd inside their containers or pods, which we'd like them to not need to do. For non-interactive commands they could use kubelet's RunInContainer API, but there will be cases where the user wants an interactive shell or debugging session. For that, we should facilitate ssh directly into a container.\r\n\r\nI don't think we'd implement ssh support exactly the same way, but geard implements a neat trick in order to support ssh directly to a container. I looked into how it did this a few months ago.\r\n\r\ngeard will generate ssh keys for containers upon request, and put them into `/var/lib/containers/keys`.\r\n\r\nIn addition to the keys themselves, geard injects its namespace entering command:\r\n`command=\\\"/usr/bin/switchns\\\"`\r\n\r\n`switchns` finds the container with the same name as the \"user\" and starts bash in the container using the equivalent of docker exec.\r\n\r\n`/etc/ssh/sshd_config` needs to be changed to add a geard-specific key lookup command:\r\n```\r\nAuthorizedKeysCommand /usr/sbin/gear-auth-keys-command\r\n```\r\n\r\nThis enables you to do:\r\n```\r\nssh ctr-mycontainer@myvm\r\n```\r\n\r\nThis mechanism was intended for lookup of users and their keys in remote services, such as LDAP.\r\n\r\nRelevant assumptions for our solution:\r\n* It should look like standard ssh as much as possible, as per the proposal in #386 \r\n* I assume we'll be supporting user namespaces at some point.\r\n* IP per pod\r\n* Potentially multiple containers within the pod\r\n\r\nThe problem with `ssh <user-within-namespace>@<IP-of-pod>` is that the pod could have multiple containers.\r\n\r\nI haven't done enough investigation to make a proposal as yet, but I wanted to record this feature request.\r\n\r\n/cc @smarterclayton @erictune "},"comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments/238320164","html_url":"https://github.com/kubernetes/kubernetes/issues/1513#issuecomment-238320164","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/1513","id":238320164,"user":{"login":"thockin","id":5595220,"avatar_url":"https://avatars.githubusercontent.com/u/5595220?v=3","gravatar_id":"","url":"https://api.github.com/users/thockin","html_url":"https://github.com/thockin","followers_url":"https://api.github.com/users/thockin/followers","following_url":"https://api.github.com/users/thockin/following{/other_user}","gists_url":"https://api.github.com/users/thockin/gists{/gist_id}","starred_url":"https://api.github.com/users/thockin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thockin/subscriptions","organizations_url":"https://api.github.com/users/thockin/orgs","repos_url":"https://api.github.com/users/thockin/repos","events_url":"https://api.github.com/users/thockin/events{/privacy}","received_events_url":"https://api.github.com/users/thockin/received_events","type":"User","site_admin":false},"created_at":"2016-08-08T17:52:08Z","updated_at":"2016-08-08T17:52:08Z","body":"see `kubectl exec`"}}
{"actor":{"display_login":"thockin"}}