Should be worrying about ephemeral containers

[vaikas]

Question While I was looking at the #809 thought about how we might want to handle ephemeral containers. Just wanted to jot this down and see what folks thought about this. Seems like something to at least think about.

https://kubernetes.io/docs/concepts/workloads/pods/ephemeral-containers/

[developer-guy]

hello @vaikas, this is an interesting case nice !! I found this, it might be useful for us: 👉 https://github.com/kubernetes/kubernetes/issues/92557

[dlorenc]

Yes!

[developer-guy]

Hello, kindly ping here 🙋🏻‍♂️ We can use ephemeral containers sub resource definition in the rules section of Validating/MutatingWebhookConfiguration as follows 👇

rules:
  - apiGroups:
    - ""
    apiVersions:
    - v1
    operations:
    - CREATE
    - UPDATE
    - DELETE
    resources:
    - pods/ephemeralcontainers

[github-actions[bot]]

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 5 days.

[vaikas]

We should add these in to the list that we care about, utilizing this: https://github.com/knative/pkg/pull/2547

Of course, we also need to validate them in the actual webhook.

[github-actions[bot]]

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 5 days.

[hectorj2f]

Closing this issue! Yes, we have to worry about ephemeral containers. We also added support for those in the sigstore/policy-controller.