如何修补Nutanix Karbon最近的Kubernetes漏洞(CVE-2018-1002105)

  • 2018年12月5日
  • 0回答
  • 648的浏览量
JoseNutanix
排名
Userlevel 4
徽章 ＋5
请注意: Nutanix碳是在技术预览，所以它不应该被用于生产。本指南中的步骤可能会影响现有正在运行的容器。

这篇文章涵盖了如何修补Kubernetes最近的漏洞(https://github.com/kubernetes/kubernetes/issues/71411)．在这篇文章中作为例子使用的版本是Kubernetes 1.10.3，这是唯一被测试的版本，但它应该可以在任何其他可用的Karbon Kubernetes版本上以同样的方式工作。

请注意: SSH密码是已知的Nutanix CVM的标准密码

1.收集您的Kubernetes节点的IP地址:
代码: 
Kubectl获取节点-o yaml | grep地址

输出:
代码: 
地址:
——地址:10.10.56.174
——地址:security-e8316c-k8s-master-0
地址:
——地址:10.10.56.150
——地址:security-e8316c-k8s-worker-0

2.连接到主节点，运行以下命令(将IP地址更改为您的IP地址):
代码: 
ssh root@10.10.56.174


代码: 
Sed -i 's/hyperkube:v1.10.3/hyperkube:v1.10.11/g' /etc/kubernetes/manifest /kube-apiserver。yaml /etc/systemd/system/kubelet-master.service


代码: 
Systemctl daemon-reload && Systemctl restart kubelet-master

3.检查Kubernetes master和kubectl客户端已经升级。
代码: 
kubectl版本

输出:
代码: 
客户端版本:版本。信息{主要:“1”,小:“10”,GitVersion:“v1.10.11”,
服务器版本:版本。信息{主要:“1”,小:“10”,GitVersion:“v1.10.11”,

4.连接到worker(s)并运行命令(用你的IP地址更改IP地址):
代码: 
ssh root@10.10.56.150


代码: 
Sed -i 's/hyperkube:v1.10.3/hyperkube:v1.10.11/g' /etc/systemd/system/kubelet-worker.service .service . properties . properties . properties . properties . properties . properties . properties


代码: 
Systemctl daemon-reload && Systemctl restart kubelet-worker

5.检查所有节点已经修补(版本必须是1.10.11现在)
代码: 
kubectl得到节点

输出:
代码: 
Name status roles age version
security-e8316c-k8s-master-0 Ready master 42m v1.10.11
security-e8316c-k8s-worker-0 Ready node 39m v1.10.11


如果你遇到任何问题，请不要犹豫在下面发表你的评论。
Jose Gomez |技术营销工程师| jose.gomez@nutanix.com | @pipoe2h
Note<\/b>: Nutanix Karbon is on Technical Preview so it should not be used on production. The steps on this guide may impact the existing running containers.
\r\n
\r\nThis post covers how to patch the recent Kubernetes vulnerability (https:\/\/github.com\/kubernetes\/kubernetes\/issues\/71411<\/a>). The version used as an example in this post is Kubernetes version 1.10.3, this is the only version tested but it should work on the same way for any of the other Kubernetes versions available in Karbon.
\r\n
\r\nNote<\/b>: the SSH password is the known standard for Nutanix CVM
\r\n
\r\n1. Gather the IP address for your Kubernetes nodes:
\r\n
code:<\/b>
kubectl get nodes -o yaml | grep address 
<\/pre><\/div>
\r\nOutput:
\r\n
code:<\/b>
   addresses: 
   - address: 10.10.56.174 
   - address: security-e8316c-k8s-master-0 
   addresses: 
   - address: 10.10.56.150 
   - address: security-e8316c-k8s-worker-0 
<\/pre><\/div>
\r\n2. Connect to the master node and run the commands (change the IP address with yours): 
\r\n
code:<\/b>
ssh root@10.10.56.174 
<\/pre><\/div>
\r\n 
\r\n
code:<\/b>
sed -i 's\/hyperkube:v1.10.3\/hyperkube:v1.10.11\/g' \/etc\/kubernetes\/manifests\/kube-apiserver.yaml \/etc\/systemd\/system\/kubelet-master.service 
<\/pre><\/div>
\r\n
\r\n
code:<\/b>
systemctl daemon-reload && systemctl restart kubelet-master 
<\/pre><\/div>
\r\n3. Check Kubernetes master has been upgraded as well as the kubectl client. 
\r\n
code:<\/b>
kubectl version 
<\/pre><\/div>
\r\nOutput:
\r\n
code:<\/b>
\tClient Version: version.Info{Major:\"1\", Minor:\"10\", GitVersion:\"v1.10.11\",  
\tServer Version: version.Info{Major:\"1\", Minor:\"10\", GitVersion:\"v1.10.11\",  
<\/pre><\/div>
\r\n4. Connect to the worker(s) and run the command (change the IP address with yours): 
\r\n
code:<\/b>
ssh root@10.10.56.150 
<\/pre><\/div>
\r\n\t 
\r\n
code:<\/b>
sed -i 's\/hyperkube:v1.10.3\/hyperkube:v1.10.11\/g' \/etc\/systemd\/system\/kubelet-worker.service 
<\/pre><\/div>
\r\n
\r\n
code:<\/b>
systemctl daemon-reload && systemctl restart kubelet-worker 
<\/pre><\/div>
\r\n5. Check all the nodes have been patched (version must be 1.10.11 now) 
\r\n
code:<\/b>
kubectl get nodes 
<\/pre><\/div>
\r\nOutput:
\r\n
code:<\/b>
NAME                          STATUS   ROLES    AGE      VERSION 
security-e8316c-k8s-master-0  Ready    master   42m      v1.10.11 
security-e8316c-k8s-worker-0  Ready    node     39m      v1.10.11 
<\/pre><\/div>
\r\n
\r\nIf you face any issue please do not hesitate to post your comments below.","quoteUsername":"JoseNutanix","translations":{"Common":{"like":"Like","unlike":"Unlike"},"Forum":{"Quote":"Quote","Share":"Share"}}}">
            
           

          

         

         

          

         

        

        

         

          本主题已关闭供评论
Baidu