kubectl debug: Extend --keep-labels flag to Ephemeral Container

[mochizuki875]

What would you like to be added:
We have added the --keep-labels flag to Copy Pod(created by --copy-to) to control the removal of labels inherited from the original pod.(kubernetes/kubernetes#123149)
My suggestion is to extend this flag to Ephemeral Container.

Why is this needed:
In short, the purpose is it makes possible to isolate the target pod from ReplicaSet or Service and add an Ephemeral Container to it seamlessly by setting --keep-labels=false.

When we use kubectl debug to add Ephemeral Container to the target pod, Ephemeral Container will be directry added to the target pod.
However, it can sometimes be undesirable.
For example:

• Ephemeral Container can't be removed from the target pod(Support removing ephemeral container from pod kubernetes#84764)
• Adding Ephemeral Container to the target pod means directly modifying the pod itself, which can be risky serving services in production.

Additionally, when using Copy Pod instead of Ephemeral Container, the pod will be recreated and dynamic information of the target pod (e.g. in-memory information) will be lost.

For these issues, isolating the target pod by removing labels has been known as a method.

• Kubernetes Blog - Manipulate labels for debugging
• Isolating Kubernetes Pods for Debugging

By extending --keep-labels flag to Ephemeral Container and indicating --keep-labels=false, we can isolate target pod and add Ephemeral Container to it in a single operation.

[k8s-ci-robot]

This issue is currently awaiting triage.

SIG CLI takes a lead on issue triage for this repo, but any Kubernetes member can accept issues by applying the triage/accepted label.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[mochizuki875]

@ardaguclu @mpuckett159
This is the topic we discussed at Maintainer Summit during KubeCon EU 2026.

[ardaguclu]

@mochizuki875 thank you for bringing this topic here as we discussed this in KubeCon.

Labels are stored in metadata of the Pod resource not in Container spec. Ephemeral containers are added to the same Pod spec. So I'm not sure I fully understand the flow here. Would you please elaborate more?.

[mochizuki875]

@ardaguclu
Yes, as you say, labels are stored in pod.metadata.labels of target Pod.
My intention is to remove the labels(pod.metadata.labels) from the target Pod itself and add Ephemeral Container into the target Pod if --keep-labels=false flag is set.

[ardaguclu]

I think we would prefer avoiding any updates on original pod. Debugging is supposed to be ephemeral without modifying the original state. But we can discuss this in next bug scrub meeting.

[mochizuki875]

Thank you for sharing your opinion.
IMO, Debugging with an Ephemeral Container implies the possibility that the target Pod itself might be modified. And strictly speaking, adding Ephemeral Container means changing the state of the target Pod.
Due to time zone differences, I won't be able to attend the meeting, but I'll make sure to check the recording.