I am troubleshooting application issues on pods/containers deployed using Fargate into an EKS cluster. Using kubectl exec works ok for some things, but it only appears to work as normal/default user, and I need rooty things like listing users/PIDs throughout the system (collecting lsof, netstat type info).
Does anyone know if AWS's new ECS Exec is supposed to be able to access ANY container running on Fargate, even those deployed to EKS clusters (as opposed to ECS). The docs for ecs exec don't mention EKS at all and are quite ambiguous on this question. Except for the following excerpt from the aforelinked docs:
Server-side requirements (AWS Fargate)
If the ECS task and its container(s) are running on Fargate, there is nothing you need to do because Fargate already includes all the infrastructure software requirements to enable this ECS capability. Because the Fargate software stack is managed through so called “Platform Versions” (read this blog if you want have an AWS Fargate Platform Versions primer), you only need to make sure that you are using PV 1.4 (which is the most recent version and ships with the ECS Exec prerequisites).
I'm guessing that it might work, but don't want to waste time if it's not. Anyone know?
If not, how to you do root-level debugging on Fargate-managed containers deployed to EKS?
Are you required to install ssh server/user/creds in the container to do this? This feels like a worst-practice in terms of security.