Honor kubectl.kubernetes.io/default-container across container actions (kubectl/k9s parity)

[Korel]

AI disclosure: An AI assistant drafted this discussion. A human reviewed it before submitting. The k9s and sofka references were checked against both codebases.

What problem are you trying to solve?

Pods with sidecars (Istio, log shippers, proxies) have one container I actually care about. Kubernetes has a standard way to say which one: the kubectl.kubernetes.io/default-container annotation (KEP-2227, stable since v1.27). kubectl uses it for logs, exec, attach and cp. Istio's injector sets it, and so do other operators and manifests.

sofka applies it inconsistently:

• Shell, attach and file transfer from a pod row reach the annotated container, but only because they run kubectl without -c. sofka doesn't know which container it opened, so prompts and titles can't name it.
• Logs (l) stream every container, so sidecar output is mixed in.
• Previous logs (p) and the bundle's log section use the first container in the spec, which is often not the annotated one.
• The container picker lists containers in spec order, so the main container can be buried.

Proposed solution

Resolve the default container in one place and use it for every action that works on a single container. Resolution order: the annotation (only if it names a container in spec.containers), then the only container if there is just one, then today's behavior.

• Logs (l), on pods and on workloads through their pod template: stream the default container. A key (k9s uses a) toggles to all containers.
• Previous logs (p) and bundle logs: use the default container instead of the first one.
• Shell, attach, transfer: pass -c <default> explicitly so behavior doesn't depend on the kubectl version, and show the container in the title or prompt (for example Download from pod:app).
• Container picker: list the default container first and pre-select it.
• :debug from a pod row: prefill --target with the default container. This is optional; kubectl doesn't do it automatically.
• If the annotation names a container that doesn't exist, ignore it and fall back (k9s logs a warning and does the same).

k9s references:

• dao/helpers.go#GetDefaultContainer
• view/logs_extender.go#podLogOptions
• view/pod.go#containerShellIn / fetchContainers
• dao/log_options.go#ToggleAllContainers

Alternatives considered

• Opening the container picker before every action. It works, but adds a step each time.
• Filtering sidecar prefixes such as [istio-proxy] in the logs view. That only hides lines, the sidecar is still streamed, and it's specific to Istio.
• Relying on kubectl's own handling. That covers shell, attach and cp, but not logs, previous logs, the bundle or the picker, which sofka handles itself.

[nklmilojevic]

Thanks for the write-up, agreed with a narrower scope!

Two corrections on the current state first:

• Shell from a pod row already resolves the annotation itself and passes -c (exec_into in src/app/actions.rs), it doesn't rely on kubectl. Attach and transfer are the ones that go without -c.
• The container picker sorts names alphabetically, not in spec order. Putting the default first still makes sense.

Agreed scope:

• One resolver: the annotation if it names a container in spec.containers, otherwise the first container. exec_into and the restart check in log_follow.rs both have their own copy of this today, they should use it too.
• p and the bundle use the default container. These are bugs, so I'll fix them myself in a separate PR, which also adds the resolver.
• l on a pod streams only the default container when the annotation is set. Without the annotation, keep streaming every container so nothing changes for most pods. a in the logs view toggles to all containers (it's free there).
• Attach and transfer pass -c explicitly and name the container in the prompt or title.
• Container picker lists the default container first and pre-selects it.

Out of scope for now:

• Workload l through the pod template. Workload logs go through a label selector, so this needs its own design - follow-up if someone needs it.
• Prefilling :debug --target. --target shares the target's process namespace, that should stay an explicit pick from the container picker, not a default.

Once the bug fix lands, feel free to open an issue for the rest linking this discussion and go for it :)