Remote login k8s cluster node using container escape

Li Guobao 2021-01-21 23:54:23
remote login k8s cluster node

One day ,

Some fish say they want to eat ,

therefore ......

Li Guobao : Edge of computing k8s colony SuperEdge First experience

According to the last article , My edge computing cluster has a bunch of nodes .

Each node is in a different network environment .

What they have in common is access to the intranet ,

Part of it is a cloud student host ,

Part of it is the virtual machine running in the home network environment ,

There are even some raspberry pie machines in the hypothesis .

So another thing they have in common is , There is basically no public network IP.

thus , I want to achieve remote login to some nodes when doing things ,

Only Intranet can penetrate this way .

Use frp Perform intranet penetration - The minority

There's nothing wrong with intranet penetration , I've been using this product for two years and it's stable .

It's just ...

It's just ...

It's just ...

One machine configuration at a time , To maintain a stable public network server as a bridge .

Namely ... A little bit of trouble .

Then I thought about .

Current kube superedge The edge computing cluster itself implements 4 Layer and the 7 The inner net penetration of layer ,

Theoretically, the ability to use it directly can also achieve remote login .

So I started to study how to realize it in only kubectl On the machine of the environment ,

Direct login k8s Container cluster's node node .

After a wave of searching, the first thing I found was this project .

A kubectl plugin to SSH into Kubernetes nodes using a SSH jump host Pod
Look at the description and the requirements , It's exactly what I want .

$ kubectl krew install ssh-jump
Follow the tutorial to configure the plug-in , After setting up the environment, I put it into practice .


everything goes well , It just can't connect .

The egg hurts ...

And then there was another wave , Found a Redhat Brother's blog .

A consistent, provider-agnostic way to SSH into any Kubernetes node

perfect .

That's what I want .

Look at the plug-in code .luksa/kubectl-plugins Look at the plug-in code .

#!/usr/bin/env bash
set -e
ssh_node() {
if [ "$node" = "" ]; then
node=$(kubectl get node -o name | sed 's/node\///' | tr '\n' ' ')
if [[ "$node" =~ " " ]]; then
echo "Node name must be specified. Choose one of: [$node]"
exit 1
echo "Single-node cluster detected. Defaulting to node $node"
kubectl create -o name -f - <<EOF
apiVersion: v1
kind: Pod
generateName: ssh-node-
plugin: ssh-node
nodeName: $node
- name: ssh-node
image: busybox
imagePullPolicy: IfNotPresent
command: ["chroot", "/host"]
tty: true
stdin: true
stdinOnce: true
privileged: true
- name: host
mountPath: /host
- name: host
path: /
hostNetwork: true
hostIPC: true
hostPID: true
restartPolicy: Never
deletePod() {
kubectl delete $pod --wait=false
trap deletePod EXIT
echo "Created $pod"
echo "Waiting for container to start..."
kubectl wait --for=condition=Ready $pod >/dev/null
kubectl attach -it $pod -c ssh-node
ssh_pod() {
# TODO: improve this
if [ "$1" == "" ]; then
echo "Pod name must be specified."
exit 1
kubectl exec -it "$@" bash || (
echo "Running bash in pod failed; trying with sh"
kubectl exec -it "$@" sh
print_usage() {
echo "Provider-agnostic way of opening a remote shell to a Kubernetes node."
echo "Enables you to access a node even when it doesn't run an SSH server or"
echo "when you don't have the required credentials. Also, the way you log in"
echo "is always the same, regardless of what provides the Kubernetes cluster"
echo "(e.g. Minikube, Kind, Docker Desktop, GKE, AKS, EKS, ...)"
echo "You must have cluster-admin rights to use this plugin."
echo "The primary focus of this plugin is to provide access to nodes, but it"
echo "also provides a quick way of running a shell inside a pod."
echo "Examples: "
echo " # Open a shell to node of a single-node cluster (e.g. Docker Desktop)"
echo " kubectl ssh node"
echo " # Open a shell to node of a multi-node cluster (e.g. GKE)"
echo " kubectl ssh node my-worker-node-1"
echo " # Open a shell to a pod"
echo " kubectl ssh pod my-pod"
echo "Usage:"
echo " kubectl ssh node [nodeName]"
echo " kubectl ssh pod [podName] [-n namespace] [-c container]"
exit 0
if [ "$1" == "--help" ]; then
if [[ "$1" == node/* ]]; then
ssh_node ${1:5}
elif [ "$1" == "node" ]; then
ssh_node $2
elif [[ "$1" == pod/* ]]; then
ssh_pod "$@"
elif [ "$1" == "pod" ]; then
ssh_pod "$@"

Take a serious look at the script .

Call for talents .

It's really fun Linux My brother .

It's awesome .

It's awesome .

It's so interesting .

forehead .

Talking about people .

This script uses busybox The image starts the container instance ,

adopt chroot To /host + Hang all the files of the host to the container instance ,

It realizes one-to-one communication between the container instance and the host system “Copy”( Maybe the expression is not very accurate ),

Furthermore, all resources of the host can be directly operated in this container instance .

Yes , All resources .

Yes , All resources .

Yes , All resources .

Here you can see the progress of other programs directly ,

Password free direct operation of other users' data .

So-called ,

This is the container escape .

then ....

Our goal has indeed been achieved .

In this way, you can log in to any computer directly k8s node node ,

No more passwords and Authorization .

summary .

It's fun .

There's a real risk of an unknown image .

The world has never been safe .

Reference material :

docker Container escape vulnerability (CVE-2020-15257) Risk announcement

Overview of vessel escape Technology -

rambo1412: Overview of vessel escape Technology

本文为[Li Guobao]所创,转载请带上原文链接,感谢

  1. 【计算机网络 12(1),尚学堂马士兵Java视频教程
  2. 【程序猿历程,史上最全的Java面试题集锦在这里
  3. 【程序猿历程(1),Javaweb视频教程百度云
  4. Notes on MySQL 45 lectures (1-7)
  5. [computer network 12 (1), Shang Xuetang Ma soldier java video tutorial
  6. The most complete collection of Java interview questions in history is here
  7. [process of program ape (1), JavaWeb video tutorial, baidu cloud
  8. Notes on MySQL 45 lectures (1-7)
  9. 精进 Spring Boot 03:Spring Boot 的配置文件和配置管理,以及用三种方式读取配置文件
  10. Refined spring boot 03: spring boot configuration files and configuration management, and reading configuration files in three ways
  11. 精进 Spring Boot 03:Spring Boot 的配置文件和配置管理,以及用三种方式读取配置文件
  12. Refined spring boot 03: spring boot configuration files and configuration management, and reading configuration files in three ways
  13. 【递归,Java传智播客笔记
  14. [recursion, Java intelligence podcast notes
  15. [adhere to painting for 386 days] the beginning of spring of 24 solar terms
  16. K8S系列第八篇(Service、EndPoints以及高可用kubeadm部署)
  17. K8s Series Part 8 (service, endpoints and high availability kubeadm deployment)
  18. 【重识 HTML (3),350道Java面试真题分享
  19. 【重识 HTML (2),Java并发编程必会的多线程你竟然还不会
  20. 【重识 HTML (1),二本Java小菜鸟4面字节跳动被秒成渣渣
  21. [re recognize HTML (3) and share 350 real Java interview questions
  22. [re recognize HTML (2). Multithreading is a must for Java Concurrent Programming. How dare you not
  23. [re recognize HTML (1), two Java rookies' 4-sided bytes beat and become slag in seconds
  24. 造轮子系列之RPC 1:如何从零开始开发RPC框架
  25. RPC 1: how to develop RPC framework from scratch
  26. 造轮子系列之RPC 1:如何从零开始开发RPC框架
  27. RPC 1: how to develop RPC framework from scratch
  28. 一次性捋清楚吧,对乱糟糟的,Spring事务扩展机制
  29. 一文彻底弄懂如何选择抽象类还是接口,连续四年百度Java岗必问面试题
  30. Redis常用命令
  31. 一双拖鞋引发的血案,狂神说Java系列笔记
  32. 一、mysql基础安装
  33. 一位程序员的独白:尽管我一生坎坷,Java框架面试基础
  34. Clear it all at once. For the messy, spring transaction extension mechanism
  35. A thorough understanding of how to choose abstract classes or interfaces, baidu Java post must ask interview questions for four consecutive years
  36. Redis common commands
  37. A pair of slippers triggered the murder, crazy God said java series notes
  38. 1、 MySQL basic installation
  39. Monologue of a programmer: despite my ups and downs in my life, Java framework is the foundation of interview
  40. 【大厂面试】三面三问Spring循环依赖,请一定要把这篇看完(建议收藏)
  41. 一线互联网企业中,springboot入门项目
  42. 一篇文带你入门SSM框架Spring开发,帮你快速拿Offer
  43. 【面试资料】Java全集、微服务、大数据、数据结构与算法、机器学习知识最全总结,283页pdf
  44. 【leetcode刷题】24.数组中重复的数字——Java版
  45. 【leetcode刷题】23.对称二叉树——Java版
  46. 【leetcode刷题】22.二叉树的中序遍历——Java版
  47. 【leetcode刷题】21.三数之和——Java版
  48. 【leetcode刷题】20.最长回文子串——Java版
  49. 【leetcode刷题】19.回文链表——Java版
  50. 【leetcode刷题】18.反转链表——Java版
  51. 【leetcode刷题】17.相交链表——Java&python版
  52. 【leetcode刷题】16.环形链表——Java版
  53. 【leetcode刷题】15.汉明距离——Java版
  54. 【leetcode刷题】14.找到所有数组中消失的数字——Java版
  55. 【leetcode刷题】13.比特位计数——Java版
  56. oracle控制用户权限命令
  57. 三年Java开发,继阿里,鲁班二期Java架构师
  58. Oracle必须要启动的服务
  59. 万字长文!深入剖析HashMap,Java基础笔试题大全带答案
  60. 一问Kafka就心慌?我却凭着这份,图灵学院vip课程百度云