主页 / user-616349

E. Jaep's questions

Martin Hope
E. Jaep
Asked: 2025-04-09 18:45:05 +0800 CST
  • 6

免责声明

我知道这不是我们在 Kubernetes 集群上应该工作的方式，而且我们想要执行的操作可能会带来安全风险

背景

一位同事休假了，忘记记录我们 Kubernetes 集群节点的 root 密码了。现在我必须在节点上安装一个简单的软件包（nfs-common），才能挂载 NFS 卷。

我正在尝试chroot在已安装的主机文件系统上安装一个软件包。

为了做到这一点，我创建了以下 pod：

apiVersion: v1
kind: Pod
metadata:
  name: ubuntu-pod
spec:
  containers:
  - name: ubuntu-container
    image: ubuntu:24.04
    command: ["/bin/bash", "-c", "while true; do sleep 30; done;"]
    volumeMounts:
    - name: host-root
      mountPath: /hostfs
    securityContext:
      privileged: true
      capabilities:
        add:
          - SYS_ADMIN
          - SYS_RESOURCE
          - SYS_NICE
          - SYS_PTRACE
          - SYS_BOOT
          - SYS_MODULE
          - SYS_RAWIO
          - SYS_PACCT
          - SYS_NICE
          - SYS_TIME
          - SYS_TTY_CONFIG
          - SYSLOG
          - NET_ADMIN
  hostPID: true
  volumes:
  - name: host-root
    hostPath:
      path: /
  restartPolicy: Never

一旦 pod 启动，我就可以进入其中chroot /hostfs /bin/bash。

但是，apt update && apt install -y nfs-common失败并出现以下错误：

Ign:1 http://archive.ubuntu.com/ubuntu jammy InRelease
Ign:2 http://archive.ubuntu.com/ubuntu jammy-updates InRelease
Ign:3 http://archive.ubuntu.com/ubuntu jammy-backports InRelease
Ign:4 http://archive.ubuntu.com/ubuntu jammy-security InRelease
Ign:1 http://archive.ubuntu.com/ubuntu jammy InRelease
Ign:2 http://archive.ubuntu.com/ubuntu jammy-updates InRelease
Ign:3 http://archive.ubuntu.com/ubuntu jammy-backports InRelease
Ign:4 http://archive.ubuntu.com/ubuntu jammy-security InRelease
Ign:1 http://archive.ubuntu.com/ubuntu jammy InRelease
Ign:2 http://archive.ubuntu.com/ubuntu jammy-updates InRelease
Ign:3 http://archive.ubuntu.com/ubuntu jammy-backports InRelease
Ign:4 http://archive.ubuntu.com/ubuntu jammy-security InRelease
Err:1 http://archive.ubuntu.com/ubuntu jammy InRelease
  Temporary failure resolving 'archive.ubuntu.com'
Err:2 http://archive.ubuntu.com/ubuntu jammy-updates InRelease
  Temporary failure resolving 'archive.ubuntu.com'
Err:3 http://archive.ubuntu.com/ubuntu jammy-backports InRelease
  Temporary failure resolving 'archive.ubuntu.com'
Err:4 http://archive.ubuntu.com/ubuntu jammy-security InRelease
  Temporary failure resolving 'archive.ubuntu.com'
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
29 packages can be upgraded. Run 'apt list --upgradable' to see them.

我相信我缺少一种能力，但我无法弄清楚。

kubernetes