<p>I have a Kubernetes 1.20 cluster with kubectl 1.20 and the <code>EphemeralContainers</code> feature gate enabled.</p>
<p>I'm trying to run the commands in the <a href="https://kubernetes.io/docs/tasks/debug-application-cluster/debug-running-pod/#ephemeral-container-example" rel="nofollow noreferrer">kubectl debug documentation</a>, but they don't seem to be working correctly. I can start a pod with:</p>
<pre><code>$ kubectl run ephemeral-demo --image=k8s.gcr.io/pause:3.1 --restart=Never
pod/ephemeral-demo created
</code></pre>
<p>And when I try to attach a debug container to it:</p>
<pre><code>$ kubectl debug -it ephemeral-demo --image=busybox --target=ephemeral-demo
Defaulting debug container name to debugger-g6pj6.
</code></pre>
<p>I never get a command line, no matter how long I wait or how many times I hit &lt;enter&gt;. If I examine the pod I can see the debug container is present:</p>
<pre><code>$ kubectl describe pod ephemeral-demo
Name:         ephemeral-demo
Namespace:    nextcloud
Priority:     0
Node:         k8s-htz-worker-02/78.47.15.149
Start Time:   Tue, 15 Dec 2020 06:36:30 -0600
Labels:       run=ephemeral-demo
Annotations:  cni.projectcalico.org/podIP: 10.244.2.186/32
              cni.projectcalico.org/podIPs: 10.244.2.186/32
Status:       Running
IP:           10.244.2.186
IPs:
  IP:  10.244.2.186
Containers:
  ephemeral-demo:
    Container ID:   docker://b6d3ffa3d2ee8eb6a51a3b5ba823392cf57ed836833830510a2625788f8789d6
    Image:          k8s.gcr.io/pause:3.1
    Image ID:       docker-pullable://k8s.gcr.io/pause@sha256:f78411e19d84a252e53bff71a4407a5686c46983a2c2eeed83929b888179acea
    Port:           &lt;none&gt;
    Host Port:      &lt;none&gt;
    State:          Running
      Started:      Tue, 15 Dec 2020 06:36:32 -0600
    Ready:          True
    Restart Count:  0
    Environment:    &lt;none&gt;
    Mounts:
      /var/run/secrets/kubernetes.io/serviceaccount from default-token-btnzm (ro)
Ephemeral Containers:
  debugger-g6pj6:
    Image:        busybox
    Port:         &lt;none&gt;
    Host Port:    &lt;none&gt;
    Environment:  &lt;none&gt;
    Mounts:       &lt;none&gt;
Conditions:
  Type              Status
  Initialized       True 
  Ready             True 
  ContainersReady   True 
  PodScheduled      True 
Volumes:
  default-token-btnzm:
    Type:        Secret (a volume populated by a Secret)
    SecretName:  default-token-btnzm
    Optional:    false
QoS Class:       BestEffort
Node-Selectors:  &lt;none&gt;
Tolerations:     node.kubernetes.io/not-ready:NoExecute op=Exists for 300s
                 node.kubernetes.io/unreachable:NoExecute op=Exists for 300s
Events:
  Type    Reason     Age   From               Message
  ----    ------     ----  ----               -------
  Normal  Scheduled  55s   default-scheduler  Successfully assigned nextcloud/ephemeral-demo to k8s-htz-worker-02
  Normal  Pulled     53s   kubelet            Container image &quot;k8s.gcr.io/pause:3.1&quot; already present on machine
  Normal  Created    53s   kubelet            Created container ephemeral-demo
  Normal  Started    53s   kubelet            Started container ephemeral-demo
</code></pre>
<p>But if I try to <code>exec</code> into it, I get a failure:</p>
<pre><code>$ kc exec -it ephemeral-demo -c debugger-g6pj6 -- bash
error: unable to upgrade connection: container not found (&quot;debugger-g6pj6&quot;)
</code></pre>
<p>Am I missing something?</p>

<p>The solution turned out to be that while I enabled the feature gate on the master node (<code>/etc/kubernetes/manifests/kube-apiserver.yaml</code>), the change didn't propogate to the worker nodes in the cluster (<code>/var/lib/kubelet/config.yaml</code>). Manually applying the changes to the worker nodes and restarting <code>kubelet</code> (<code>systemctl restart kubelet.service</code>) resolved the issue.</p>
