Debugging Production Clusters

Prerequisites: completion of Deployments, Services, and Ingress, and ConfigMaps and Secrets.

Version note: verified against kubernetes.io/docs/tasks/debug docs, July 2026. Ephemeral containers, the mechanism behind most of kubectl debug's running-pod features, have been stable/GA since Kubernetes 1.25 — no feature gate needed on any currently supported version (1.34+).

The instinct when something's broken in production is to kubectl exec in and poke around — but that assumes the container has a shell and debugging tools, which minimal or distroless production images deliberately don't have (that's the point of them: smaller attack surface). And if the container is crash-looping, there may be nothing running to exec into at all.

kubectl debug solves both problems without editing the original workload: it can inject a temporary, fully-tooled ephemeral container into a running Pod, or spin up a copy of a broken Pod with a different image/command so you can investigate a crash-loop in isolation. Neither approach touches the original Deployment's manifest or disrupts the Pods still serving traffic. This project builds the triage habits and the exact commands for both.