ksoclabs / kube-goat Goto Github PK

View Code? Open in Web Editor NEW

117.0 117.0 39.0 175 KB

A deliberately vulnerable Kubernetes cluster

Makefile 31.96% Shell 63.51% Dockerfile 4.54%

kube-goat's People

Contributors

Stargazers

Watchers

kube-goat's Issues

As a user I need to be able to read data on a Redis instance running inside of the cluster

Motivation

Without network policies or a service mesh it is possible to hit unwanted pods via application vuln. This challenge will expose Redis.

Acceptance

Design Ideas

As a user I am able able to pull a malicious image into the cluster

Fix kind api version in config.yaml

While trying to setup kube-goat in a kind cluster I faced this error:

ERROR: failed to create cluster: unknown apiVersion: kind.sigs.k8s.io/v1alpha3

Looking at the kind documentation, the apiVersion string in config.yaml needs to be updated to:

apiVersion: kind.x-k8s.io/v1alpha4

kind get kubeconfig-path throws an error

Following the instructions / running the bash script an error is thrown when this instruction is called:

~/dev/kube-goat/deploy/kind> kind get kubeconfig-path
ERROR: unknown command "kubeconfig-path" for "kind get"

The correct command should be:

 ~/dev/kube-goat/deploy/kind> kind get kubeconfig --name "kubegoat"

GCP Install script is outdated

Getting the following error when running the installer as per the README:


ClusterName as positional argument is deprecated and will be removed in a future version

Error: Validation failed: error building path for "gs://k8sgoat-testbed-bucket": error building GCS client: google: could not find default credentials. See https://developers.google.com/accounts/docs/application-default-credentials for more information.
I1128 14:29:38.887382   87480 featureflag.go:163] Unknown FeatureFlag "AlphaAllowGCE"

As a user I need to be able to exploit an kubelet API with no authentication

Motivation

Zero-auth on a Kubelet causes major issues. This exercise should expose a kubernetes READ port (10255) to grab a pod with the key name being the CTF key.

Acceptance

10255 is open to the internet on this cluster exposing the read-only port of the cluster

Design Ideas

Public IP Address exposure or make users hit the kubelet IP from inside of the cluster?

Implementation

Resources

https://labs.mwrinfosecurity.com/blog/attacking-kubernetes-through-kubelet/

As a user I can access the challenge token in k8s secrets

Motivation

Secrets are not secure by default. This challenge will expose the token by using kubectl to access secrets which has the token embedded

As a user I can use the default service account token to authenticate to the API

Motivation

Directory traversal / RCE / SSRF can lead to exposure of the default service account token. This challenge of web app vulns + SA token submission.

As a user I can escalate as root to host node

Motivation

This challenge will use privileged==true to escalate privileges and find the key

As a user I can access the dashboard in an anonymous way

Motivation

The dashboard can do bad things. This challenge will be to find the dashboard running and open to the internet and discover the key within.

"✗ Joining worker nodes 🚜" fails

Hi,

Whether it is on my Mac installation (last stable versions of macOS, docker, kind, kubectl) or within a Debian a Docker in Docker, I got the following error when running kind create cluster --name=kubegoat --config=config.yaml.

Feel free if you have any piece of idea / advice to solve the issue :)

Thanks.

The verbose error:

Creating cluster "kubegoat" ...
 ✓ Ensuring node image (kindest/node:v1.18.2) 🖼
 ✓ Preparing nodes 📦 📦  
 ✓ Writing configuration 📜 
 ✓ Starting control-plane 🕹️ 
 ✓ Installing CNI 🔌 
 ✓ Installing StorageClass 💾 
 ✗ Joining worker nodes 🚜 
ERROR: failed to create cluster: failed to join node with kubeadm: command "docker exec --privileged kubegoat-worker kubeadm join --config /kind/kubeadm.conf --ignore-preflight-errors=all --v=6" failed with error: exit status 1
Command Output: W0730 12:20:29.853736     374 join.go:346] [preflight] WARNING: JoinControlPane.controlPlane settings will be ignored when control-plane flag is not set.
I0730 12:20:29.853812     374 join.go:371] [preflight] found NodeName empty; using OS hostname as NodeName
I0730 12:20:29.853834     374 joinconfiguration.go:74] loading configuration from "/kind/kubeadm.conf"
I0730 12:20:29.856929     374 preflight.go:90] [preflight] Running general checks
[preflight] Running pre-flight checks
I0730 12:20:29.857383     374 checks.go:249] validating the existence and emptiness of directory /etc/kubernetes/manifests
I0730 12:20:29.857453     374 checks.go:286] validating the existence of file /etc/kubernetes/kubelet.conf
I0730 12:20:29.857481     374 checks.go:286] validating the existence of file /etc/kubernetes/bootstrap-kubelet.conf
I0730 12:20:29.857515     374 checks.go:102] validating the container runtime
I0730 12:20:29.923826     374 checks.go:376] validating the presence of executable crictl
I0730 12:20:29.923941     374 checks.go:335] validating the contents of file /proc/sys/net/bridge/bridge-nf-call-iptables
	[WARNING FileContent--proc-sys-net-bridge-bridge-nf-call-iptables]: /proc/sys/net/bridge/bridge-nf-call-iptables does not exist
I0730 12:20:29.924112     374 checks.go:335] validating the contents of file /proc/sys/net/ipv4/ip_forward
I0730 12:20:29.924194     374 checks.go:649] validating whether swap is enabled or not
	[WARNING Swap]: running with swap on is not supported. Please disable swap
I0730 12:20:29.924334     374 checks.go:376] validating the presence of executable conntrack
I0730 12:20:29.926041     374 checks.go:376] validating the presence of executable ip
I0730 12:20:29.926154     374 checks.go:376] validating the presence of executable iptables
I0730 12:20:29.926187     374 checks.go:376] validating the presence of executable mount
I0730 12:20:29.926239     374 checks.go:376] validating the presence of executable nsenter
I0730 12:20:29.926297     374 checks.go:376] validating the presence of executable ebtables
I0730 12:20:29.926481     374 checks.go:376] validating the presence of executable ethtool
I0730 12:20:29.926575     374 checks.go:376] validating the presence of executable socat
I0730 12:20:29.926618     374 checks.go:376] validating the presence of executable tc
I0730 12:20:29.926664     374 checks.go:376] validating the presence of executable touch
I0730 12:20:29.926736     374 checks.go:520] running all checks
I0730 12:20:29.933609     374 checks.go:406] checking whether the given node name is reachable using net.LookupHost
I0730 12:20:29.935854     374 checks.go:618] validating kubelet version
I0730 12:20:30.003623     374 checks.go:128] validating if the service is enabled and active
I0730 12:20:30.014532     374 checks.go:201] validating availability of port 10250
I0730 12:20:30.014700     374 checks.go:286] validating the existence of file /etc/kubernetes/pki/ca.crt
I0730 12:20:30.014797     374 checks.go:432] validating if the connectivity type is via proxy or direct
I0730 12:20:30.014833     374 join.go:441] [preflight] Discovering cluster-info
I0730 12:20:30.014866     374 token.go:78] [discovery] Created cluster-info discovery client, requesting info from "kubegoat-control-plane:6443"
I0730 12:20:30.025318     374 round_trippers.go:443] GET https://kubegoat-control-plane:6443/api/v1/namespaces/kube-public/configmaps/cluster-info?timeout=10s 401 Unauthorized in 7 milliseconds
I0730 12:20:30.025670     374 token.go:215] [discovery] Failed to request cluster-info, will try again: Unauthorized
I0730 12:20:30.026551     374 round_trippers.go:443] GET https://kubegoat-control-plane:6443/api/v1/namespaces/kube-public/configmaps/cluster-info?timeout=10s 401 Unauthorized in 0 milliseconds
I0730 12:20:30.026666     374 token.go:215] [discovery] Failed to request cluster-info, will try again: Unauthorized
I0730 12:20:36.058535     374 round_trippers.go:443] GET https://kubegoat-control-plane:6443/api/v1/namespaces/kube-public/configmaps/cluster-info?timeout=10s 401 Unauthorized in 0 milliseconds
I0730 12:20:36.058681     374 token.go:215] [discovery] Failed to request cluster-info, will try again: Unauthorized
I0730 12:20:41.158518     374 round_trippers.go:443] GET https://kubegoat-control-plane:6443/api/v1/namespaces/kube-public/configmaps/cluster-info?timeout=10s 401 Unauthorized in 0 milliseconds
I0730 12:20:41.158677     374 token.go:215] [discovery] Failed to request cluster-info, will try again: Unauthorized
I0730 12:20:46.405262     374 round_trippers.go:443] GET https://kubegoat-control-plane:6443/api/v1/namespaces/kube-public/configmaps/cluster-info?timeout=10s 401 Unauthorized in 1 milliseconds
I0730 12:20:46.406533     374 token.go:215] [discovery] Failed to request cluster-info, will try again: Unauthorized
I0730 12:20:51.553262     374 round_trippers.go:443] GET https://kubegoat-control-plane:6443/api/v1/namespaces/kube-public/configmaps/cluster-info?timeout=10s 401 Unauthorized in 0 milliseconds
I0730 12:20:51.553484     374 token.go:215] [discovery] Failed to request cluster-info, will try again: Unauthorized
I0730 12:20:56.973276     374 round_trippers.go:443] GET https://kubegoat-control-plane:6443/api/v1/namespaces/kube-public/configmaps/cluster-info?timeout=10s 401 Unauthorized in 1 milliseconds
I0730 12:20:56.973475     374 token.go:215] [discovery] Failed to request cluster-info, will try again: Unauthorized
I0730 12:21:02.751754     374 round_trippers.go:443] GET https://kubegoat-control-plane:6443/api/v1/namespaces/kube-public/configmaps/cluster-info?timeout=10s 401 Unauthorized in 1 milliseconds
I0730 12:21:02.752027     374 token.go:215] [discovery] Failed to request cluster-info, will try again: Unauthorized
I0730 12:21:08.974865     374 round_trippers.go:443] GET https://kubegoat-control-plane:6443/api/v1/namespaces/kube-public/configmaps/cluster-info?timeout=10s 401 Unauthorized in 1 milliseconds
I0730 12:21:08.975058     374 token.go:215] [discovery] Failed to request cluster-info, will try again: Unauthorized
I0730 12:21:14.297922     374 round_trippers.go:443] GET https://kubegoat-control-plane:6443/api/v1/namespaces/kube-public/configmaps/cluster-info?timeout=10s 401 Unauthorized in 0 milliseconds
I0730 12:21:14.298071     374 token.go:215] [discovery] Failed to request cluster-info, will try again: Unauthorized
I0730 12:21:19.870965     374 round_trippers.go:443] GET https://kubegoat-control-plane:6443/api/v1/namespaces/kube-public/configmaps/cluster-info?timeout=10s 401 Unauthorized in 1 milliseconds
I0730 12:21:19.871122     374 token.go:215] [discovery] Failed to request cluster-info, will try again: Unauthorized
I0730 12:21:25.316414     374 round_trippers.go:443] GET https://kubegoat-control-plane:6443/api/v1/namespaces/kube-public/configmaps/cluster-info?timeout=10s 401 Unauthorized in 1 milliseconds
I0730 12:21:25.316601     374 token.go:215] [discovery] Failed to request cluster-info, will try again: Unauthorized
I0730 12:21:31.021326     374 round_trippers.go:443] GET https://kubegoat-control-plane:6443/api/v1/namespaces/kube-public/configmaps/cluster-info?timeout=10s 401 Unauthorized in 0 milliseconds
I0730 12:21:31.021451     374 token.go:215] [discovery] Failed to request cluster-info, will try again: Unauthorized
I0730 12:21:36.447836     374 round_trippers.go:443] GET https://kubegoat-control-plane:6443/api/v1/namespaces/kube-public/configmaps/cluster-info?timeout=10s 401 Unauthorized in 1 milliseconds
I0730 12:21:36.448020     374 token.go:215] [discovery] Failed to request cluster-info, will try again: Unauthorized
I0730 12:21:41.889369     374 round_trippers.go:443] GET https://kubegoat-control-plane:6443/api/v1/namespaces/kube-public/configmaps/cluster-info?timeout=10s 401 Unauthorized in 1 milliseconds
I0730 12:21:41.889602     374 token.go:215] [discovery] Failed to request cluster-info, will try again: Unauthorized
I0730 12:21:47.910038     374 round_trippers.go:443] GET https://kubegoat-control-plane:6443/api/v1/namespaces/kube-public/configmaps/cluster-info?timeout=10s 401 Unauthorized in 0 milliseconds
I0730 12:21:47.910219     374 token.go:215] [discovery] Failed to request cluster-info, will try again: Unauthorized
I0730 12:21:54.609647     374 round_trippers.go:443] GET https://kubegoat-control-plane:6443/api/v1/namespaces/kube-public/configmaps/cluster-info?timeout=10s 401 Unauthorized in 1405 milliseconds
I0730 12:21:54.610081     374 token.go:215] [discovery] Failed to request cluster-info, will try again: Unauthorized
I0730 12:22:00.468375     374 round_trippers.go:443] GET https://kubegoat-control-plane:6443/api/v1/namespaces/kube-public/configmaps/cluster-info?timeout=10s 401 Unauthorized in 1 milliseconds
I0730 12:22:00.468551     374 token.go:215] [discovery] Failed to request cluster-info, will try again: Unauthorized
I0730 12:22:06.763886     374 round_trippers.go:443] GET https://kubegoat-control-plane:6443/api/v1/namespaces/kube-public/configmaps/cluster-info?timeout=10s 401 Unauthorized in 0 milliseconds
I0730 12:22:06.764049     374 token.go:215] [discovery] Failed to request cluster-info, will try again: Unauthorized
I0730 12:22:12.205210     374 round_trippers.go:443] GET https://kubegoat-control-plane:6443/api/v1/namespaces/kube-public/configmaps/cluster-info?timeout=10s 401 Unauthorized in 0 milliseconds
I0730 12:22:12.205374     374 token.go:215] [discovery] Failed to request cluster-info, will try again: Unauthorized
I0730 12:22:17.652205     374 round_trippers.go:443] GET https://kubegoat-control-plane:6443/api/v1/namespaces/kube-public/configmaps/cluster-info?timeout=10s 401 Unauthorized in 0 milliseconds
I0730 12:22:17.652320     374 token.go:215] [discovery] Failed to request cluster-info, will try again: Unauthorized
I0730 12:22:23.748061     374 round_trippers.go:443] GET https://kubegoat-control-plane:6443/api/v1/namespaces/kube-public/configmaps/cluster-info?timeout=10s 401 Unauthorized in 0 milliseconds
I0730 12:22:23.748328     374 token.go:215] [discovery] Failed to request cluster-info, will try again: Unauthorized
I0730 12:22:29.059743     374 round_trippers.go:443] GET https://kubegoat-control-plane:6443/api/v1/namespaces/kube-public/configmaps/cluster-info?timeout=10s 401 Unauthorized in 0 milliseconds
I0730 12:22:29.059873     374 token.go:215] [discovery] Failed to request cluster-info, will try again: Unauthorized
I0730 12:22:35.362006     374 round_trippers.go:443] GET https://kubegoat-control-plane:6443/api/v1/namespaces/kube-public/configmaps/cluster-info?timeout=10s 401 Unauthorized in 3 milliseconds
I0730 12:22:35.362759     374 token.go:215] [discovery] Failed to request cluster-info, will try again: Unauthorized
I0730 12:22:41.409960     374 round_trippers.go:443] GET https://kubegoat-control-plane:6443/api/v1/namespaces/kube-public/configmaps/cluster-info?timeout=10s 401 Unauthorized in 1 milliseconds
I0730 12:22:41.410835     374 token.go:215] [discovery] Failed to request cluster-info, will try again: Unauthorized
I0730 12:22:47.197680     374 round_trippers.go:443] GET https://kubegoat-control-plane:6443/api/v1/namespaces/kube-public/configmaps/cluster-info?timeout=10s 401 Unauthorized in 0 milliseconds
I0730 12:22:47.197960     374 token.go:215] [discovery] Failed to request cluster-info, will try again: Unauthorized
I0730 12:22:52.241638     374 round_trippers.go:443] GET https://kubegoat-control-plane:6443/api/v1/namespaces/kube-public/configmaps/cluster-info?timeout=10s 401 Unauthorized in 0 milliseconds
I0730 12:22:52.241806     374 token.go:215] [discovery] Failed to request cluster-info, will try again: Unauthorized
I0730 12:22:57.446637     374 round_trippers.go:443] GET https://kubegoat-control-plane:6443/api/v1/namespaces/kube-public/configmaps/cluster-info?timeout=10s 401 Unauthorized in 1 milliseconds
I0730 12:22:57.446851     374 token.go:215] [discovery] Failed to request cluster-info, will try again: Unauthorized
I0730 12:23:03.359738     374 round_trippers.go:443] GET https://kubegoat-control-plane:6443/api/v1/namespaces/kube-public/configmaps/cluster-info?timeout=10s 401 Unauthorized in 1 milliseconds
I0730 12:23:03.360029     374 token.go:215] [discovery] Failed to request cluster-info, will try again: Unauthorized
I0730 12:23:09.825676     374 round_trippers.go:443] GET https://kubegoat-control-plane:6443/api/v1/namespaces/kube-public/configmaps/cluster-info?timeout=10s 401 Unauthorized in 1 milliseconds
I0730 12:23:09.825924     374 token.go:215] [discovery] Failed to request cluster-info, will try again: Unauthorized
I0730 12:23:14.946323     374 round_trippers.go:443] GET https://kubegoat-control-plane:6443/api/v1/namespaces/kube-public/configmaps/cluster-info?timeout=10s 401 Unauthorized in 0 milliseconds
I0730 12:23:14.946621     374 token.go:215] [discovery] Failed to request cluster-info, will try again: Unauthorized
I0730 12:23:20.841070     374 round_trippers.go:443] GET https://kubegoat-control-plane:6443/api/v1/namespaces/kube-public/configmaps/cluster-info?timeout=10s 401 Unauthorized in 1 milliseconds
I0730 12:23:20.841275     374 token.go:215] [discovery] Failed to request cluster-info, will try again: Unauthorized
I0730 12:23:25.911940     374 round_trippers.go:443] GET https://kubegoat-control-plane:6443/api/v1/namespaces/kube-public/configmaps/cluster-info?timeout=10s 401 Unauthorized in 16 milliseconds
I0730 12:23:25.912201     374 token.go:215] [discovery] Failed to request cluster-info, will try again: Unauthorized
I0730 12:23:31.174222     374 round_trippers.go:443] GET https://kubegoat-control-plane:6443/api/v1/namespaces/kube-public/configmaps/cluster-info?timeout=10s 401 Unauthorized in 1 milliseconds
I0730 12:23:31.174398     374 token.go:215] [discovery] Failed to request cluster-info, will try again: Unauthorized
I0730 12:23:36.987986     374 round_trippers.go:443] GET https://kubegoat-control-plane:6443/api/v1/namespaces/kube-public/configmaps/cluster-info?timeout=10s 401 Unauthorized in 1 milliseconds
I0730 12:23:36.988441     374 token.go:215] [discovery] Failed to request cluster-info, will try again: Unauthorized
I0730 12:23:42.806017     374 round_trippers.go:443] GET https://kubegoat-control-plane:6443/api/v1/namespaces/kube-public/configmaps/cluster-info?timeout=10s 401 Unauthorized in 0 milliseconds
I0730 12:23:42.806121     374 token.go:215] [discovery] Failed to request cluster-info, will try again: Unauthorized
I0730 12:23:48.226915     374 round_trippers.go:443] GET https://kubegoat-control-plane:6443/api/v1/namespaces/kube-public/configmaps/cluster-info?timeout=10s 401 Unauthorized in 1 milliseconds
I0730 12:23:48.227095     374 token.go:215] [discovery] Failed to request cluster-info, will try again: Unauthorized
I0730 12:23:53.829447     374 round_trippers.go:443] GET https://kubegoat-control-plane:6443/api/v1/namespaces/kube-public/configmaps/cluster-info?timeout=10s 401 Unauthorized in 1 milliseconds
I0730 12:23:53.829586     374 token.go:215] [discovery] Failed to request cluster-info, will try again: Unauthorized
I0730 12:23:59.627035     374 round_trippers.go:443] GET https://kubegoat-control-plane:6443/api/v1/namespaces/kube-public/configmaps/cluster-info?timeout=10s 401 Unauthorized in 0 milliseconds
I0730 12:23:59.627156     374 token.go:215] [discovery] Failed to request cluster-info, will try again: Unauthorized
I0730 12:24:05.009087     374 round_trippers.go:443] GET https://kubegoat-control-plane:6443/api/v1/namespaces/kube-public/configmaps/cluster-info?timeout=10s 401 Unauthorized in 1 milliseconds
I0730 12:24:05.009384     374 token.go:215] [discovery] Failed to request cluster-info, will try again: Unauthorized
I0730 12:24:10.434684     374 round_trippers.go:443] GET https://kubegoat-control-plane:6443/api/v1/namespaces/kube-public/configmaps/cluster-info?timeout=10s 401 Unauthorized in 1 milliseconds
I0730 12:24:10.435356     374 token.go:215] [discovery] Failed to request cluster-info, will try again: Unauthorized
I0730 12:24:16.620367     374 round_trippers.go:443] GET https://kubegoat-control-plane:6443/api/v1/namespaces/kube-public/configmaps/cluster-info?timeout=10s 401 Unauthorized in 1 milliseconds
I0730 12:24:16.620542     374 token.go:215] [discovery] Failed to request cluster-info, will try again: Unauthorized
I0730 12:24:22.165278     374 round_trippers.go:443] GET https://kubegoat-control-plane:6443/api/v1/namespaces/kube-public/configmaps/cluster-info?timeout=10s 401 Unauthorized in 1 milliseconds
I0730 12:24:22.165537     374 token.go:215] [discovery] Failed to request cluster-info, will try again: Unauthorized
I0730 12:24:28.453723     374 round_trippers.go:443] GET https://kubegoat-control-plane:6443/api/v1/namespaces/kube-public/configmaps/cluster-info?timeout=10s 401 Unauthorized in 1 milliseconds
I0730 12:24:28.453852     374 token.go:215] [discovery] Failed to request cluster-info, will try again: Unauthorized
I0730 12:24:33.901345     374 round_trippers.go:443] GET https://kubegoat-control-plane:6443/api/v1/namespaces/kube-public/configmaps/cluster-info?timeout=10s 401 Unauthorized in 1 milliseconds
I0730 12:24:33.901615     374 token.go:215] [discovery] Failed to request cluster-info, will try again: Unauthorized
I0730 12:24:40.245249     374 round_trippers.go:443] GET https://kubegoat-control-plane:6443/api/v1/namespaces/kube-public/configmaps/cluster-info?timeout=10s 401 Unauthorized in 1 milliseconds
I0730 12:24:40.245878     374 token.go:215] [discovery] Failed to request cluster-info, will try again: Unauthorized
I0730 12:24:45.394173     374 round_trippers.go:443] GET https://kubegoat-control-plane:6443/api/v1/namespaces/kube-public/configmaps/cluster-info?timeout=10s 401 Unauthorized in 1 milliseconds
I0730 12:24:45.394316     374 token.go:215] [discovery] Failed to request cluster-info, will try again: Unauthorized
I0730 12:24:54.169882     374 round_trippers.go:443] GET https://kubegoat-control-plane:6443/api/v1/namespaces/kube-public/configmaps/cluster-info?timeout=10s 401 Unauthorized in 2344 milliseconds
I0730 12:24:54.170027     374 token.go:215] [discovery] Failed to request cluster-info, will try again: Unauthorized
I0730 12:25:00.193818     374 round_trippers.go:443] GET https://kubegoat-control-plane:6443/api/v1/namespaces/kube-public/configmaps/cluster-info?timeout=10s 401 Unauthorized in 1 milliseconds
I0730 12:25:00.194128     374 token.go:215] [discovery] Failed to request cluster-info, will try again: Unauthorized
I0730 12:25:05.559617     374 round_trippers.go:443] GET https://kubegoat-control-plane:6443/api/v1/namespaces/kube-public/configmaps/cluster-info?timeout=10s 401 Unauthorized in 2 milliseconds
I0730 12:25:05.559807     374 token.go:215] [discovery] Failed to request cluster-info, will try again: Unauthorized
I0730 12:25:11.029007     374 round_trippers.go:443] GET https://kubegoat-control-plane:6443/api/v1/namespaces/kube-public/configmaps/cluster-info?timeout=10s 401 Unauthorized in 1 milliseconds
I0730 12:25:11.029224     374 token.go:215] [discovery] Failed to request cluster-info, will try again: Unauthorized
I0730 12:25:17.430442     374 round_trippers.go:443] GET https://kubegoat-control-plane:6443/api/v1/namespaces/kube-public/configmaps/cluster-info?timeout=10s 401 Unauthorized in 1 milliseconds
I0730 12:25:17.431183     374 token.go:215] [discovery] Failed to request cluster-info, will try again: Unauthorized
I0730 12:25:23.510742     374 round_trippers.go:443] GET https://kubegoat-control-plane:6443/api/v1/namespaces/kube-public/configmaps/cluster-info?timeout=10s 401 Unauthorized in 1 milliseconds
I0730 12:25:23.510850     374 token.go:215] [discovery] Failed to request cluster-info, will try again: Unauthorized
Unauthorized
couldn't validate the identity of the API Server
k8s.io/kubernetes/cmd/kubeadm/app/discovery.For
	/go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/cmd/kubeadm/app/discovery/discovery.go:44
k8s.io/kubernetes/cmd/kubeadm/app/cmd.(*joinData).TLSBootstrapCfg
	/go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/cmd/kubeadm/app/cmd/join.go:442
k8s.io/kubernetes/cmd/kubeadm/app/cmd.(*joinData).InitCfg
	/go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/cmd/kubeadm/app/cmd/join.go:452
k8s.io/kubernetes/cmd/kubeadm/app/cmd/phases/join.runPreflight
	/go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/cmd/kubeadm/app/cmd/phases/join/preflight.go:95
k8s.io/kubernetes/cmd/kubeadm/app/cmd/phases/workflow.(*Runner).Run.func1
	/go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/cmd/kubeadm/app/cmd/phases/workflow/runner.go:234
k8s.io/kubernetes/cmd/kubeadm/app/cmd/phases/workflow.(*Runner).visitAll
	/go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/cmd/kubeadm/app/cmd/phases/workflow/runner.go:422
k8s.io/kubernetes/cmd/kubeadm/app/cmd/phases/workflow.(*Runner).Run
	/go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/cmd/kubeadm/app/cmd/phases/workflow/runner.go:207
k8s.io/kubernetes/cmd/kubeadm/app/cmd.NewCmdJoin.func1
	/go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/cmd/kubeadm/app/cmd/join.go:170
k8s.io/kubernetes/vendor/github.com/spf13/cobra.(*Command).execute
	/go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/vendor/github.com/spf13/cobra/command.go:826
k8s.io/kubernetes/vendor/github.com/spf13/cobra.(*Command).ExecuteC
	/go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/vendor/github.com/spf13/cobra/command.go:914
k8s.io/kubernetes/vendor/github.com/spf13/cobra.(*Command).Execute
	/go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/vendor/github.com/spf13/cobra/command.go:864
k8s.io/kubernetes/cmd/kubeadm/app.Run
	/go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/cmd/kubeadm/app/kubeadm.go:50
main.main
	_output/dockerized/go/src/k8s.io/kubernetes/cmd/kubeadm/kubeadm.go:25
runtime.main
	/usr/local/go/src/runtime/proc.go:203
runtime.goexit
	/usr/local/go/src/runtime/asm_amd64.s:1357
error execution phase preflight
k8s.io/kubernetes/cmd/kubeadm/app/cmd/phases/workflow.(*Runner).Run.func1
	/go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/cmd/kubeadm/app/cmd/phases/workflow/runner.go:235
k8s.io/kubernetes/cmd/kubeadm/app/cmd/phases/workflow.(*Runner).visitAll
	/go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/cmd/kubeadm/app/cmd/phases/workflow/runner.go:422
k8s.io/kubernetes/cmd/kubeadm/app/cmd/phases/workflow.(*Runner).Run
	/go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/cmd/kubeadm/app/cmd/phases/workflow/runner.go:207
k8s.io/kubernetes/cmd/kubeadm/app/cmd.NewCmdJoin.func1
	/go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/cmd/kubeadm/app/cmd/join.go:170
k8s.io/kubernetes/vendor/github.com/spf13/cobra.(*Command).execute
	/go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/vendor/github.com/spf13/cobra/command.go:826
k8s.io/kubernetes/vendor/github.com/spf13/cobra.(*Command).ExecuteC
	/go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/vendor/github.com/spf13/cobra/command.go:914
k8s.io/kubernetes/vendor/github.com/spf13/cobra.(*Command).Execute
	/go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/vendor/github.com/spf13/cobra/command.go:864
k8s.io/kubernetes/cmd/kubeadm/app.Run
	/go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/cmd/kubeadm/app/kubeadm.go:50
main.main
	_output/dockerized/go/src/k8s.io/kubernetes/cmd/kubeadm/kubeadm.go:25
runtime.main
	/usr/local/go/src/runtime/proc.go:203
runtime.goexit
	/usr/local/go/src/runtime/asm_amd64.s:1357

FYI, here is how I created my Docker in Docker :
docker run -it -v /var/run/docker.sock:/var/run/docker.sock debian bash

And inside the Docker :

cd ~ 
apt update
apt install -y curl nano git

curl -o install.sh https://get.docker.com
chmod +x install.sh
./install.sh

curl -LO https://storage.googleapis.com/kubernetes-release/release/$(curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt)/bin/linux/amd64/kubectl
chmod +x ./kubectl
mv ./kubectl /usr/local/bin/kubectl

curl -o kind https://github.com/kubernetes-sigs/kind/releases/download/v0.8.1/kind-linux-amd64
chmod +x ./kind
mv ./kind /usr/local/bin/kind

git clone https://github.com/ksoclabs/kube-goat.git
cd kube-goat/deploy/kind/
kind create cluster --name=kubegoat --config=config.yaml

As a user I am able to log in to the cluster anonymously.

Motivation

anonymous-auth=true is bad when combined with authorization-mode=AlwaysAllow. We will enable this and figure out how to expose a key to the user that is applicable.

Acceptance

Design Ideas

As a user I need to be able to see what is mounted in a sensitive volume mount

Motivation

The key will be stored in the volume mount. Containers shouldn't be allowed to mount volumes like this.

Acceptance

Design Ideas

Recommend Projects

React

A declarative, efficient, and flexible JavaScript library for building user interfaces.
Vue.js

🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript

TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
TensorFlow

An Open Source Machine Learning Framework for Everyone
Django

The Web framework for perfectionists with deadlines.
Laravel

A PHP framework for web artisans
D3

Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

javascript

JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
web

Some thing interesting about web. New door for the world.
server

A server is a program made to process requests and deliver data to clients.
Machine learning

Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Visualization

Some thing interesting about visualization, use data art
Game

Some thing interesting about game, make everyone happy.

Recommend Org

Facebook

We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft

Open source projects and samples from Microsoft.
Google

Google ❤️ Open Source for everyone.
Alibaba

Alibaba Open Source for everyone
D3

Data-Driven Documents codes.
Tencent

China tencent open source team.

ksoclabs / kube-goat Goto Github PK

kube-goat's People

Contributors

Stargazers

Watchers

Forkers

kube-goat's Issues

Motivation

Acceptance

Design Ideas

Motivation

Acceptance

Design Ideas

Implementation

Resources

Motivation

Motivation

Motivation

Motivation

Motivation

Acceptance

Design Ideas

Motivation

Acceptance

Design Ideas

Recommend Projects

Recommend Topics

Recommend Org