{"id":86311,"date":"2020-06-24T01:42:11","date_gmt":"2020-06-23T23:42:11","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/lomaem-klaster-kubernetes-cherez-helm-v2-tiller"},"modified":"2020-06-24T01:42:11","modified_gmt":"2020-06-23T23:42:11","slug":"lomaem-klaster-kubernetes-cherez-helm-v2-tiller","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/administrirovanie\/lomaem-klaster-kubernetes-cherez-helm-v2-tiller","title":{"rendered":"Nous cassons un cluster Kubernetes via Helm v2 tiller.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"Nous cassons un cluster Kubernetes via Helm v2 tiller.\" src=\"\/wp-content\/uploads\/2020\/06\/9fced786f84d95b0291c33eef4012828.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Helm \u2014 un gestionnaire de paquets pour Kubernetes, semblable \u00e0 <code>apt-get<\/code> Ubuntu. Dans cet article, nous allons explorer la version pr\u00e9c\u00e9dente de helm (v2) avec le service tiller install\u00e9 par d\u00e9faut, par lequel nous acc\u00e9derons au cluster.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<p>Pr\u00e9parons le cluster, pour cela, ex\u00e9cutons la commande :<\/p>\n<p><\/p>\n<pre><code class=\"plaintext\">kubectl run --rm --restart=Never -it --image=madhuakula\/k8s-goat-helm-tiller -- bash<\/code><\/pre>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Nous cassons un cluster Kubernetes via Helm v2 tiller.\" src=\"\/wp-content\/uploads\/2020\/06\/6b5ac23e43a57548ee7a0a90e0d1a3f5.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<h2 id=\"demonstraciya\">D\u00e9monstration<\/h2>\n<p><\/p>\n<ul>\n<li>Si rien n'est configur\u00e9 de mani\u00e8re suppl\u00e9mentaire, helm v2 lance le service tiller, qui a des droits RBAC avec des droits d'administrateur complets au cluster.<\/li>\n<li>Apr\u00e8s l'installation dans l'espace de noms <code>kube-system<\/code> une proposition pour couper le son de tous les onglets le reproduisant <code>tiller-deploy<\/code>, un port 44134 est \u00e9galement ouvert, li\u00e9 \u00e0 0.0.0.0. Cela peut \u00eatre v\u00e9rifi\u00e9 avec telnet.<\/li>\n<\/ul>\n<p><\/p>\n<pre><code class=\"plaintext\">$ telnet tiller-deploy.kube-system 44134<\/code><\/pre>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Nous cassons un cluster Kubernetes via Helm v2 tiller.\" src=\"\/wp-content\/uploads\/2020\/06\/9f6dccf8380ef5cba905bcd0f2785778.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<ul>\n<li>Nous pouvons maintenant nous connecter au service tiller. Nous utiliserons le binaire helm pour effectuer des op\u00e9rations lors de la communication avec le service tiller :<\/li>\n<\/ul>\n<p><\/p>\n<pre><code class=\"plaintext\">$ helm --host tiller-deploy.kube-system:44134 version<\/code><\/pre>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Nous cassons un cluster Kubernetes via Helm v2 tiller.\" src=\"\/wp-content\/uploads\/2020\/06\/34d6abdc649f21b3124b0569779e2e40.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<ul>\n<li>Essayons d'obtenir les secrets du cluster Kubernetes dans l'espace de noms <code>kube-system<\/code>:<\/li>\n<\/ul>\n<p><\/p>\n<pre><code class=\"plaintext\">$ kubectl get secrets -n kube-system<\/code><\/pre>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Nous cassons un cluster Kubernetes via Helm v2 tiller.\" src=\"\/wp-content\/uploads\/2020\/06\/7c4d24f4fb518574e2c41d51239d5466.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<ul>\n<li>Nous pouvons maintenant cr\u00e9er notre propre chart, o\u00f9 nous cr\u00e9erons un r\u00f4le avec des droits d'administrateur et attribuerons ce r\u00f4le au compte de service par d\u00e9faut. En utilisant le token de ce compte de service, nous avons obtenu un acc\u00e8s complet \u00e0 notre cluster.<\/li>\n<\/ul>\n<p><\/p>\n<pre><code class=\"plaintext\">$ helm --host tiller-deploy.kube-system:44134 install \/pwnchart<\/code><\/pre>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Nous cassons un cluster Kubernetes via Helm v2 tiller.\" src=\"\/wp-content\/uploads\/2020\/06\/103412d1497efb0370f5faf7087b66d1.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<ul>\n<li>Maintenant que <code>pwnchart<\/code> est d\u00e9ploy\u00e9, le compte de service par d\u00e9faut a un acc\u00e8s administratif complet. V\u00e9rifions \u00e0 nouveau l'obtention des secrets depuis <code>kube-system<\/code><\/li>\n<\/ul>\n<p><\/p>\n<pre><code class=\"plaintext\">$ kubectl get secrets -n kube-system<\/code><\/pre>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Nous cassons un cluster Kubernetes via Helm v2 tiller.\" src=\"\/wp-content\/uploads\/2020\/06\/58fc4da5f4e5a4d8c4117e9298e2740f.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>L'ex\u00e9cution r\u00e9ussie de ce sc\u00e9nario d\u00e9pend de la mani\u00e8re dont tiller a \u00e9t\u00e9 d\u00e9ploy\u00e9, parfois les administrateurs le d\u00e9ploient dans un espace de noms s\u00e9par\u00e9 avec d'autres privil\u00e8ges. Helm 3 n'est pas sujet \u00e0 de telles vuln\u00e9rabilit\u00e9s, car il n'inclut pas tiller.<\/p>\n<p><\/p>\n<p><em><strong>Note du traducteur :<\/strong> l'utilisation de politiques r\u00e9seau pour filtrer le trafic dans le cluster aide \u00e0 se prot\u00e9ger contre des vuln\u00e9rabilit\u00e9s de ce type. <\/em><\/p>\n<p>Source : <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/southbridge\/blog\/507656\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>Helm \u2014 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u0439 \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440 \u0434\u043b\u044f Kubernetes, \u0447\u0442\u043e-\u0442\u043e \u0432\u0440\u043e\u0434\u0435 apt-get \u0434\u043b\u044f Ubuntu. \u0412 \u044d\u0442\u043e\u0439 \u0437\u0430\u043c\u0435\u0442\u043a\u0435 \u043c\u044b \u0443\u0432\u0438\u0434\u0438\u043c \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e helm (v2) \u0441 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u043c tiller, \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u043c \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, \u0447\u0435\u0440\u0435\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u043b\u0443\u0447\u0438\u043c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0443. \u041f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u0438\u043c \u043a\u043b\u0430\u0441\u0442\u0435\u0440, \u0434\u043b\u044f \u044d\u0442\u043e\u0433\u043e \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u043c \u043a\u043e\u043c\u0430\u043d\u0434\u0443: kubectl run &#8212;rm &#8212;restart=Never -it &#8212;image=madhuakula\/k8s-goat-helm-tiller &#8212; bash \u0414\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0430\u0446\u0438\u044f \u0415\u0441\u043b\u0438 \u043d\u0438\u0447\u0435\u0433\u043e \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u043d\u0435 \u043d\u0430\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0442\u044c, helm v2 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":86312,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-86311","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"description\" content=\"Helm \u2014 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u0439 \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440 \u0434\u043b\u044f.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/fr\/blog\/administrirovanie\/lomaem-klaster-kubernetes-cherez-helm-v2-tiller\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"fr_FR\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041b\u043e\u043c\u0430\u0435\u043c \u043a\u043b\u0430\u0441\u0442\u0435\u0440 Kubernetes \u0447\u0435\u0440\u0435\u0437 Helm v2 tiller | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"Helm \u2014 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u0439 \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440 \u0434\u043b\u044f.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/fr\/blog\/administrirovanie\/lomaem-klaster-kubernetes-cherez-helm-v2-tiller\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-06-23T23:42:11+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-06-23T23:42:11+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Exploiter le cluster Kubernetes via Helm v2 tiller | ProHoster","description":"Helm \u2014 un gestionnaire de paquets pour.","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/administrirovanie\/lomaem-klaster-kubernetes-cherez-helm-v2-tiller","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041b\u043e\u043c\u0430\u0435\u043c \u043a\u043b\u0430\u0441\u0442\u0435\u0440 Kubernetes \u0447\u0435\u0440\u0435\u0437 Helm v2 tiller | ProHoster","og:description":"Helm \u2014 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u0439 \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440 \u0434\u043b\u044f.","og:url":"https:\/\/prohoster.info\/fr\/blog\/administrirovanie\/lomaem-klaster-kubernetes-cherez-helm-v2-tiller","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-23T23:42:11+00:00","article:modified_time":"2020-06-23T23:42:11+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"86311","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 14:18:32","updated":"2022-10-06 22:09:25","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/86311","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=86311"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/86311\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media\/86312"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=86311"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=86311"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=86311"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}