kubectl debug 的证据黑洞：调试结束，现场消失

# 创建一个 hostPath volume 用来持久保存快照（生产环境建议用 PVC）
# 先准备快照脚本
SNAPSHOT_DIR=/var/log/debug-snapshots

kubectl debug my-app-pod -n production \
  --target=main-container \
  --image=busybox:1.36 \
  --copy-to=my-app-pod-debug \
  --share-processes \
  --command \
  -- /bin/sh -c "
    mkdir -p ${SNAPSHOT_DIR} &&
    ts=\$(date +%Y%m%d-%H%M%S) &&
    ps aux > ${SNAPSHOT_DIR}/ps-\${ts}.txt &&
    cat /proc/1/environ | tr '\0' '\n' > ${SNAPSHOT_DIR}/env-\${ts}.txt &&
    netstat -tlnp > ${SNAPSHOT_DIR}/net-\${ts}.txt 2>/dev/null ||
    ss -tlnp > ${SNAPSHOT_DIR}/net-\${ts}.txt &&
    ls -la /tmp > ${SNAPSHOT_DIR}/tmp-\${ts}.txt &&
    echo Snapshot saved at \${ts}
  "

apiVersion: v1
kind: Pod
metadata:
  name: debug-recorder
  namespace: production
spec:
  shareProcessNamespace: true
  containers:
    - name: target
      image: my-app:latest
      # ... 原有配置不变
    - name: debug-shell
      image: busybox:1.36
      command: ["/bin/sh", "-c", "sleep infinity"]
      stdin: true
      tty: true
    - name: session-recorder
      image: alpine:3.18
      command:
        - /bin/sh
        - -c
        - |
          # 用 asciinema 录制 /proc/1 的调试会话
          apk add --no-cache asciinema &&
          while ! test -S /proc/1/root/dev/pts/0; do sleep 1; done &&
          asciinema rec /recordings/debug-session.cast
      volumeMounts:
        - name: recordings
          mountPath: /recordings
  volumes:
    - name: recordings
      persistentVolumeClaim:
        claimName: debug-recordings-pvc

#!/bin/bash
# debug-capture.sh — 本地执行的证据采集脚本
POD=my-app-pod
NS=production
TS=$(date +%Y%m%d-%H%M%S)
DIR=./debug-evidence/${TS}
mkdir -p "${DIR}"

# 先注入临时容器
kubectl debug "${POD}" -n "${NS}" \
  --target=main-container \
  --image=busybox:1.36 \
  --share-processes

# 等待容器就绪
sleep 3

# 逐项采集，每条命令输出存到本地文件
kubectl exec "${POD}" -n "${NS}" -c debugger-xxxxx \
  -- ps aux > "${DIR}/ps.txt"

kubectl exec "${POD}" -n "${NS}" -c debugger-xxxxx \
  -- cat /proc/1/environ > "${DIR}/env-raw.txt"
tr '\0' '\n' < "${DIR}/env-raw.txt" > "${DIR}/env.txt"

kubectl exec "${POD}" -n "${NS}" -c debugger-xxxxx \
  -- ss -tlnp > "${DIR}/network.txt"

kubectl exec "${POD}" -n "${NS}" -c debugger-xxxxx \
  -- ls -laR /tmp > "${DIR}/tmp-files.txt"

# 最后进入交互 shell，手动继续排查
kubectl exec -it "${POD}" -n "${NS}" -c debugger-xxxxx -- /bin/sh

echo "Evidence saved to ${DIR}"

# 调试会话结束前，手动创建一条 event
kubectl create event debug-session-ended \
  --namespace=production \
  --for=pod/my-app-pod \
  --type=Warning \
  --reason=DebugSessionTerminated \
  --message="Ephemeral debug container terminated. Snapshot files saved at /var/log/debug-snapshots/. Manual exit by operator zhangwei."

# 或者用更简单的方式：在退出 shell 前写一条日志到目标容器
kubectl exec my-app-pod -n production -c main-container \
  -- /bin/sh -c "echo '[DEBUG-SESSION] Ended at $(date). Evidence in /var/log/debug-snapshots/' >> /var/log/app.log"