{"id":86311,"date":"2020-06-24T01:42:11","date_gmt":"2020-06-23T23:42:11","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/lomaem-klaster-kubernetes-cherez-helm-v2-tiller"},"modified":"2020-06-24T01:42:11","modified_gmt":"2020-06-23T23:42:11","slug":"lomaem-klaster-kubernetes-cherez-helm-v2-tiller","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/lomaem-klaster-kubernetes-cherez-helm-v2-tiller","title":{"rendered":"Bryter ett Kubernetes-kluster genom Helm v2 tiller","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"Bryter ett Kubernetes-kluster genom Helm v2 tiller\" src=\"\/wp-content\/uploads\/2020\/06\/9fced786f84d95b0291c33eef4012828.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Helm - en paketmanager f\u00f6r Kubernetes, ungef\u00e4r som <code>apt-get<\/code> f\u00f6r Ubuntu. I denna anteckning kommer vi att se den tidigare versionen av helm (v2) med tj\u00e4nsten tiller installerad som standard, genom vilken vi f\u00e5r tillg\u00e5ng till klustret.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<p>L\u00e5t oss f\u00f6rbereda klustret genom att k\u00f6ra kommandot:<\/p>\n<p><\/p>\n<pre><code class=\"plaintext\">kubectl run --rm --restart=Never -it --image=madhuakula\/k8s-goat-helm-tiller -- bash<\/code><\/pre>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Bryter ett Kubernetes-kluster genom Helm v2 tiller\" src=\"\/wp-content\/uploads\/2020\/06\/6b5ac23e43a57548ee7a0a90e0d1a3f5.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<h2 id=\"demonstraciya\">Demonstration<\/h2>\n<p><\/p>\n<ul>\n<li>Om inget ytterligare konfigureras k\u00f6r helm v2 tj\u00e4nsten tiller, som har RBAC med fullst\u00e4ndiga administrativa r\u00e4ttigheter till klustret.<\/li>\n<li>Efter installationen i namespace <code>kube-system<\/code> dyker upp <code>tiller-deploy<\/code>, \u00f6ppnas ocks\u00e5 port 44134, som \u00e4r bunden till 0.0.0.0. Detta kan kontrolleras med telnet.<\/li>\n<\/ul>\n<p><\/p>\n<pre><code class=\"plaintext\">$ telnet tiller-deploy.kube-system 44134<\/code><\/pre>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Bryter ett Kubernetes-kluster genom Helm v2 tiller\" src=\"\/wp-content\/uploads\/2020\/06\/9f6dccf8380ef5cba905bcd0f2785778.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<ul>\n<li>Nu kan vi koppla upp oss mot tj\u00e4nsten tiller. Vi kommer att anv\u00e4nda helm-bin\u00e4ren f\u00f6r att utf\u00f6ra operationer n\u00e4r vi kommunicerar med tj\u00e4nsten tiller:<\/li>\n<\/ul>\n<p><\/p>\n<pre><code class=\"plaintext\">$ helm --host tiller-deploy.kube-system:44134 version<\/code><\/pre>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Bryter ett Kubernetes-kluster genom Helm v2 tiller\" src=\"\/wp-content\/uploads\/2020\/06\/34d6abdc649f21b3124b0569779e2e40.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<ul>\n<li>Vi f\u00f6rs\u00f6ker h\u00e4mta hemligheterna fr\u00e5n Kubernetes-klustret i namespace <code>kube-system<\/code>:<\/li>\n<\/ul>\n<p><\/p>\n<pre><code class=\"plaintext\">$ kubectl get secrets -n kube-system<\/code><\/pre>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Bryter ett Kubernetes-kluster genom Helm v2 tiller\" src=\"\/wp-content\/uploads\/2020\/06\/7c4d24f4fb518574e2c41d51239d5466.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<ul>\n<li>Nu kan vi skapa v\u00e5r egen chart, d\u00e4r vi skapar en roll med administrat\u00f6rsr\u00e4ttigheter och tilldelar denna roll till standardtj\u00e4nstekontot. Genom att anv\u00e4nda token fr\u00e5n detta tj\u00e4nstekonto har vi f\u00e5tt full tillg\u00e5ng till v\u00e5rt kluster.<\/li>\n<\/ul>\n<p><\/p>\n<pre><code class=\"plaintext\">$ helm --host tiller-deploy.kube-system:44134 install \/pwnchart<\/code><\/pre>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Bryter ett Kubernetes-kluster genom Helm v2 tiller\" src=\"\/wp-content\/uploads\/2020\/06\/103412d1497efb0370f5faf7087b66d1.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<ul>\n<li>Nu n\u00e4r <code>pwnchart<\/code> \u00e4r distribuerad, har standard tj\u00e4nstekontot fullst\u00e4ndig administrativ tillg\u00e5ng. Vi kontrollerar \u00e5terigen h\u00e4mtningen av hemligheter fr\u00e5n <code>kube-system<\/code><\/li>\n<\/ul>\n<p><\/p>\n<pre><code class=\"plaintext\">kubectl get secrets -n kube-system<\/code><\/pre>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Bryter ett Kubernetes-kluster genom Helm v2 tiller\" src=\"\/wp-content\/uploads\/2020\/06\/58fc4da5f4e5a4d8c4117e9298e2740f.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Att detta skript lyckas beror p\u00e5 hur tiller har distribuerats, ibland distribuerar administrat\u00f6rerna det i ett separat namespace med andra privilegier. Helm 3 \u00e4r inte s\u00e5rbart f\u00f6r s\u00e5dana s\u00e5rbarheter, eftersom det inte har tiller.<\/p>\n<p><\/p>\n<p><em><strong>\u00d6vers\u00e4ttarens anm\u00e4rkning:<\/strong> anv\u00e4ndning av n\u00e4tverkspolicyer f\u00f6r att filtrera trafik i kluster hj\u00e4lper till att skydda mot s\u00e5dana s\u00e5rbarheter. <\/em><\/p>\n<p>K\u00e4lla: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/southbridge\/blog\/507656\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>Helm \u2014 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u0439 \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440 \u0434\u043b\u044f Kubernetes, \u0447\u0442\u043e-\u0442\u043e \u0432\u0440\u043e\u0434\u0435 apt-get \u0434\u043b\u044f Ubuntu. \u0412 \u044d\u0442\u043e\u0439 \u0437\u0430\u043c\u0435\u0442\u043a\u0435 \u043c\u044b \u0443\u0432\u0438\u0434\u0438\u043c \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e helm (v2) \u0441 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u043c tiller, \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u043c \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, \u0447\u0435\u0440\u0435\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u043b\u0443\u0447\u0438\u043c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0443. \u041f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u0438\u043c \u043a\u043b\u0430\u0441\u0442\u0435\u0440, \u0434\u043b\u044f \u044d\u0442\u043e\u0433\u043e \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u043c \u043a\u043e\u043c\u0430\u043d\u0434\u0443: kubectl run &#8212;rm &#8212;restart=Never -it &#8212;image=madhuakula\/k8s-goat-helm-tiller &#8212; bash \u0414\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0430\u0446\u0438\u044f \u0415\u0441\u043b\u0438 \u043d\u0438\u0447\u0435\u0433\u043e \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u043d\u0435 \u043d\u0430\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0442\u044c, helm v2 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":86312,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-86311","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"Helm \u2014 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u0439 \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440 \u0434\u043b\u044f.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/lomaem-klaster-kubernetes-cherez-helm-v2-tiller\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sv_SE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041b\u043e\u043c\u0430\u0435\u043c \u043a\u043b\u0430\u0441\u0442\u0435\u0440 Kubernetes \u0447\u0435\u0440\u0435\u0437 Helm v2 tiller | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"Helm \u2014 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u0439 \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440 \u0434\u043b\u044f.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/lomaem-klaster-kubernetes-cherez-helm-v2-tiller\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-06-23T23:42:11+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-06-23T23:42:11+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vi bryter Kubernetes-klustret med Helm v2 tiller | ProHoster","description":"Helm - en paketmanager f\u00f6r.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/lomaem-klaster-kubernetes-cherez-helm-v2-tiller","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041b\u043e\u043c\u0430\u0435\u043c \u043a\u043b\u0430\u0441\u0442\u0435\u0440 Kubernetes \u0447\u0435\u0440\u0435\u0437 Helm v2 tiller | ProHoster","og:description":"Helm \u2014 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u0439 \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440 \u0434\u043b\u044f.","og:url":"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/lomaem-klaster-kubernetes-cherez-helm-v2-tiller","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-23T23:42:11+00:00","article:modified_time":"2020-06-23T23:42:11+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"86311","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 14:18:32","updated":"2022-10-06 22:09:25","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/86311","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=86311"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/86311\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media\/86312"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=86311"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=86311"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=86311"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}