{"id":86311,"date":"2020-06-24T01:42:11","date_gmt":"2020-06-23T23:42:11","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/lomaem-klaster-kubernetes-cherez-helm-v2-tiller"},"modified":"2020-06-24T01:42:11","modified_gmt":"2020-06-23T23:42:11","slug":"lomaem-klaster-kubernetes-cherez-helm-v2-tiller","status":"publish","type":"post","link":"https:\/\/prohoster.info\/nl\/blog\/administrirovanie\/lomaem-klaster-kubernetes-cherez-helm-v2-tiller","title":{"rendered":"We breken een Kubernetes-cluster met Helm v2 tiller.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"We breken een Kubernetes-cluster met Helm v2 tiller.\" src=\"\/wp-content\/uploads\/2020\/06\/9fced786f84d95b0291c33eef4012828.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Helm \u2014 een pakketbeheerder voor Kubernetes, iets vergelijkbaars <code>apt-get<\/code> met Ubuntu. In dit artikel bekijken we de vorige versie van helm (v2) met de standaard ge\u00efnstalleerde tiller-service, waarmee we toegang krijgen tot het cluster.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<p>Laten we het cluster voorbereiden, hiervoor voeren we het volgende commando uit:<\/p>\n<p><\/p>\n<pre><code class=\"plaintext\">kubectl run --rm --restart=Never -it --image=madhuakula\/k8s-goat-helm-tiller -- bash<\/code><\/pre>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"We breken een Kubernetes-cluster met Helm v2 tiller.\" src=\"\/wp-content\/uploads\/2020\/06\/6b5ac23e43a57548ee7a0a90e0d1a3f5.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<h2 id=\"demonstraciya\">Demonstratie<\/h2>\n<p><\/p>\n<ul>\n<li>Als er verder niets wordt ingesteld, start helm v2 de tiller-service, die RBAC met volledige administratieve rechten voor het cluster heeft.<\/li>\n<li>Na de installatie in de namespace <code>kube-system<\/code> verschijnt <code>tiller-deploy<\/code>, wordt ook poort 44134 geopend, verbonden met 0.0.0.0. Dit kan worden gecontroleerd met telnet.<\/li>\n<\/ul>\n<p><\/p>\n<pre><code class=\"plaintext\">$ telnet tiller-deploy.kube-system 44134<\/code><\/pre>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"We breken een Kubernetes-cluster met Helm v2 tiller.\" src=\"\/wp-content\/uploads\/2020\/06\/9f6dccf8380ef5cba905bcd0f2785778.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<ul>\n<li>Nu kunnen we verbinding maken met de tiller-service. We zullen de helm-binary gebruiken voor operaties tijdens de communicatie met de tiller-service:<\/li>\n<\/ul>\n<p><\/p>\n<pre><code class=\"plaintext\">$ helm --host tiller-deploy.kube-system:44134 version<\/code><\/pre>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"We breken een Kubernetes-cluster met Helm v2 tiller.\" src=\"\/wp-content\/uploads\/2020\/06\/34d6abdc649f21b3124b0569779e2e40.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<ul>\n<li>Laten we proberen de geheimen van het Kubernetes-cluster op te halen uit de namespace <code>kube-system<\/code>:<\/li>\n<\/ul>\n<p><\/p>\n<pre><code class=\"plaintext\">$ kubectl get secrets -n kube-system<\/code><\/pre>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"We breken een Kubernetes-cluster met Helm v2 tiller.\" src=\"\/wp-content\/uploads\/2020\/06\/7c4d24f4fb518574e2c41d51239d5466.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<ul>\n<li>Nu kunnen we onze eigen chart maken, waarin we een rol met administratieve rechten cre\u00ebren en deze rol toewijzen aan het standaard serviceaccount. Met de token van dit serviceaccount hebben we volledige toegang tot ons cluster.<\/li>\n<\/ul>\n<p><\/p>\n<pre><code class=\"plaintext\">$ helm --host tiller-deploy.kube-system:44134 install \/pwnchart<\/code><\/pre>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"We breken een Kubernetes-cluster met Helm v2 tiller.\" src=\"\/wp-content\/uploads\/2020\/06\/103412d1497efb0370f5faf7087b66d1.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<ul>\n<li>Nu, wanneer <code>pwnchart<\/code> is uitgerold, heeft het standaard serviceaccount volledige administratieve toegang. Laten we nogmaals de geheimen ophalen uit <code>kube-system<\/code><\/li>\n<\/ul>\n<p><\/p>\n<pre><code class=\"plaintext\">kubectl get secrets -n kube-system<\/code><\/pre>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"We breken een Kubernetes-cluster met Helm v2 tiller.\" src=\"\/wp-content\/uploads\/2020\/06\/58fc4da5f4e5a4d8c4117e9298e2740f.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Het succes van dit scenario hangt af van hoe tiller is uitgerold, soms rollen beheerders het uit in een aparte namespace met andere privileges. Helm 3 is niet onderhevig aan dergelijke kwetsbaarheden, omdat het geen tiller bevat.<\/p>\n<p><\/p>\n<p><em><strong>Opmerking van de vertaler:<\/strong> het gebruik van netwerkpolicies om verkeer in het cluster te filteren helpt te beschermen tegen dit soort kwetsbaarheden. <\/em><\/p>\n<p>Bron: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/southbridge\/blog\/507656\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>Helm \u2014 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u0439 \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440 \u0434\u043b\u044f Kubernetes, \u0447\u0442\u043e-\u0442\u043e \u0432\u0440\u043e\u0434\u0435 apt-get \u0434\u043b\u044f Ubuntu. \u0412 \u044d\u0442\u043e\u0439 \u0437\u0430\u043c\u0435\u0442\u043a\u0435 \u043c\u044b \u0443\u0432\u0438\u0434\u0438\u043c \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e helm (v2) \u0441 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u043c tiller, \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u043c \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, \u0447\u0435\u0440\u0435\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u043b\u0443\u0447\u0438\u043c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0443. \u041f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u0438\u043c \u043a\u043b\u0430\u0441\u0442\u0435\u0440, \u0434\u043b\u044f \u044d\u0442\u043e\u0433\u043e \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u043c \u043a\u043e\u043c\u0430\u043d\u0434\u0443: kubectl run &#8212;rm &#8212;restart=Never -it &#8212;image=madhuakula\/k8s-goat-helm-tiller &#8212; bash \u0414\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0430\u0446\u0438\u044f \u0415\u0441\u043b\u0438 \u043d\u0438\u0447\u0435\u0433\u043e \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u043d\u0435 \u043d\u0430\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0442\u044c, helm v2 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":86312,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-86311","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"Helm \u2014 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u0439 \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440 \u0434\u043b\u044f.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/nl\/blog\/administrirovanie\/lomaem-klaster-kubernetes-cherez-helm-v2-tiller\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"nl_NL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041b\u043e\u043c\u0430\u0435\u043c \u043a\u043b\u0430\u0441\u0442\u0435\u0440 Kubernetes \u0447\u0435\u0440\u0435\u0437 Helm v2 tiller | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"Helm \u2014 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u0439 \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440 \u0434\u043b\u044f.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/nl\/blog\/administrirovanie\/lomaem-klaster-kubernetes-cherez-helm-v2-tiller\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-06-23T23:42:11+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-06-23T23:42:11+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47We breken het Kubernetes-cluster met Helm v2 tiller | ProHoster","description":"Helm \u2014 een pakketbeheerder voor.","canonical_url":"https:\/\/prohoster.info\/nl\/blog\/administrirovanie\/lomaem-klaster-kubernetes-cherez-helm-v2-tiller","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"nl_NL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041b\u043e\u043c\u0430\u0435\u043c \u043a\u043b\u0430\u0441\u0442\u0435\u0440 Kubernetes \u0447\u0435\u0440\u0435\u0437 Helm v2 tiller | ProHoster","og:description":"Helm \u2014 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u0439 \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440 \u0434\u043b\u044f.","og:url":"https:\/\/prohoster.info\/nl\/blog\/administrirovanie\/lomaem-klaster-kubernetes-cherez-helm-v2-tiller","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-23T23:42:11+00:00","article:modified_time":"2020-06-23T23:42:11+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"86311","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 14:18:32","updated":"2022-10-06 22:09:25","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts\/86311","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/comments?post=86311"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts\/86311\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/media\/86312"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/media?parent=86311"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/categories?post=86311"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/tags?post=86311"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}