Exec commands on kubernetes pods with root access

I have one pod running with name 'jenkins-app-2843651954-4zqdp'. I want to install few softwares temporarily on this pod. How can I do this?

I am trying this- kubectl exec -it jenkins-app-2843651954-4zqdp -- /bin/bash and then running apt-get install commands but since the user I am accessing with doesn't have sudo access I am not able to run commands

• Use kubectl describe pod ... to find the node running your Pod and the container ID (docker://...)
• SSH into the node
• run docker exec -it -u root ID /bin/bash

There are some plugins for kubectl that may help you achieve this: https://github.com/jordanwilson230/kubectl-plugins

One of the plugins called, 'ssh', will allow you to exec as root user by running (for example) kubectl ssh -u root -p nginx-0

Building on @jordanwilson230's answer he also developed a bash-script called exec-as which uses Docker-in-Docker to accomplish this: https://github.com/jordanwilson230/kubectl-plugins/blob/krew/kubectl-exec-as

When installed via kubectl plugin manager krew → kubectl krew install exec-as you can simply

kubectl exec-as -u <username> <podname> -- /bin/bash

This only works in Kubernetes clusters which allow priviledged containers.

Just in case you come across to look for an answer for minikube, the minikube ssh command can actually work with docker command together here, which makes it fairly easy:

1. Find the container ID:

   $ minikube ssh docker container ls
   

2. Add the -u 0 option to docker command (quote is necessary for the whole docker command):

   $ minikube ssh "docker container exec -it -u 0 <Container ID> /bin/bash"
   

NOTE: this is NOT for Kubernetes in general, it works for minikube only. While I feel we need the root access quit a lot in local development environment, it's worth to mention it in this thread.

For my case, I was in need for root access (or sudo) to container to give the chown permission to a specific mount path.

I cannot SSH to machine because I designed my infrastructure to be fully automated with Terraform without any manual access.

Instead, I found that initContainers does the job:

  initContainers:
    - name: volume-prewarming
      image: busybox
      command: ["sh", "-c", "chown -R 1000:0 {{ .Values.persistence.mountPath }}"]
      volumeMounts:
      - name: {{ .Chart.Name }}
        mountPath: {{ .Values.persistence.mountPath }}

I've also created a whole course about Production grade running kubernetes on AWS using EKS

In case anyone is working on AKS, follow these steps:

• Identify the pod that is running the container
• Identity the node that is running that pod (kubectl describe pod -n <namespace> <pod_name> | grep "Node:", or look for it on Azure portal)
• SSH to AKS the cluster node

Once you are inside a node, perform these commands to get into the container:

• sudo su (you must get root access to use docker commands)
• docker exec -it -u root ID /bin/bash (to get the container id, use docker container ps)

To login as different i use exec-as plugin in kubernetes here are the steps you can follow

> Make sure git is installed

Step : 1 Install Krew plugin

  begin
  set -x; set temp_dir (mktemp -d); cd "$temp_dir" &&
  set OS (uname | tr '[:upper:]' '[:lower:]') &&
  set ARCH (uname -m | sed -e 's/x86_64/amd64/' -e 's/\(arm\)\(64\)\?.*/\1\2/' -e 's/aarch64$/arm64/') &&
  set KREW krew-$OS"_"$ARCH &&
  curl -fsSLO "https://github.com/kubernetes-sigs/krew/releases/latest/download/$KREW.tar.gz" &&
  tar zxvf $KREW.tar.gz &&
  ./$KREW install krew &&
  set -e KREW; set -e temp_dir
end

Step : 2 Install exec-as

kubectl krew install exec-as

Step : 3 Try with root or different user

kubectl exec-as -u root frontend-deployment-977b8fd4c-tb5pz

> WARNING: You installed plugin "prompt" from the krew-index plugin repository. These plugins are not audited for security by the Krew maintainers. Run them at your own risk.

• docker container ls to find container ID
• docker exec -it -u root ID /bin/bash

We can exec into kubernetes pod through the following command.

kubectl exec --stdin --tty pod-name -n namespace-name -- /bin/bash