kubernetes-goat靶机搭建

发表于 分类于 阅读次数：
kubernetes-goat

环境

应用 版本
RockyLinux 10.1
Docker 29.4.0
minikube 1.38.1
helm 4.1.4

docker

单机版的K8s 需要用docker

[root@localhost ~]# dnf -y install dnf-plugins-core git
[root@localhost ~]# dnf config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
[root@localhost ~]# dnf install docker-ce docker-ce-cli  docker-buildx-plugin docker-compose-plugin
[root@localhost ~]# systemctl start docker 
[root@localhost ~]# docker info
Client: Docker Engine - Community
 Version:    29.4.0
 Context:    default
 Debug Mode: false
 Plugins:
<...>
[root@localhost ~]# systemctl enable docker  //设置开机自启

minikube

安装minikube

[root@localhost ~]# curl -LO https://storage.googleapis.com/minikube/releases/latest/minikube-latest.x86_64.rpm
[root@localhost ~]# rpm -Uvh minikube-latest.x86_64.rpm

启动minikube

[root@localhost ~]# minikube start --force
😄  minikube v1.38.1 on Rocky 10.1
❗  minikube skips various validations when --force is supplied; this may lead to unexpected behavior
✨  Automatically selected the docker driver. Other choices: ssh, none
🛑  The "docker" driver should not be used with root privileges. If you wish to continue as root, use --force.
💡  If you are running minikube within a VM, consider using --driver=none:
📘    https://minikube.sigs.k8s.io/docs/reference/drivers/none/
❗  Starting v1.39.0, minikube will default to "containerd" container runtime. See #21973 for more info.
📌  Using Docker driver with root privileges
👍  Starting "minikube" primary control-plane node in "minikube" cluster
🚜  Pulling base image v0.0.50 ...
💾  Downloading Kubernetes v1.35.1 preload ...
    > preloaded-images-k8s-v18-v1...:  272.45 MiB / 272.45 MiB  100.00% 5.76 Mi
    > gcr.io/k8s-minikube/kicbase...:  519.58 MiB / 519.58 MiB  100.00% 4.66 Mi
🔥  Creating docker container (CPUs=2, Memory=3072MB) ...
🐳  Preparing Kubernetes v1.35.1 on Docker 29.2.1 ...
🔗  Configuring bridge CNI (Container Networking Interface) ...
🔎  Verifying Kubernetes components...
    ▪ Using image gcr.io/k8s-minikube/storage-provisioner:v5
🌟  Enabled addons: storage-provisioner, default-storageclass
💡  kubectl not found. If you need it, try: 'minikube kubectl -- get pods -A'
🏄  Done! kubectl is now configured to use "minikube" cluster and "default" namespace by default

查看minikube 状态

[root@localhost  ~]# minikube kubectl -- get pods -A
    > kubectl.sha256:  64 B / 64 B [-------------------------] 100.00% ? p/s 0s
    > kubectl:  55.88 MiB / 55.88 MiB [-------------] 100.00% 9.87 MiB p/s 5.9s
NAMESPACE     NAME                               READY   STATUS    RESTARTS      AGE
kube-system   coredns-7d764666f9-lq6vl           1/1     Running   0             76s
kube-system   etcd-minikube                      1/1     Running   0             82s
kube-system   kube-apiserver-minikube            1/1     Running   0             82s
kube-system   kube-controller-manager-minikube   1/1     Running   0             82s
kube-system   kube-proxy-xmq5q                   1/1     Running   0             77s
kube-system   kube-scheduler-minikube            1/1     Running   0             82s
kube-system   storage-provisioner                1/1     Running   1 (46s ago)   81

配置kubectl

kubernetes-goat 需要使用kubectl，但是minikube使用 kubectl 命令为 minikube kubectl ，做个软链接即可

[root@localhost kubernetes-goat]# ln -s $(which minikube) /usr/local/bin/kubectl

helm

[root@localhost ~]# curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-4 | bash
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 11929  100 11929    0     0  17516      0 --:--:-- --:--:-- --:--:-- 17516
Downloading https://get.helm.sh/helm-v4.1.4-linux-amd64.tar.gz
Verifying checksum... Done.
Preparing to install helm into /usr/local/bin
helm installed into /usr/local/bin/helm

kubernetes-goat

安装

第一次安装会报错 The Deployment “health-check-deployment” is invalid: spec.template.spec.initContainers[0].volumeMounts[1].name: Not found: “socket-link”

[root@localhost kubernetes-goat]# ./setup-kubernetes-goat.sh 
kubectl setup looks good.
deploying insecure super admin scenario
serviceaccount/superadmin unchanged
clusterrolebinding.rbac.authorization.k8s.io/superadmin unchanged
deploying helm chart metadata-db scenario
NAME: metadata-db
LAST DEPLOYED: Sun Apr 12 01:42:54 2026
NAMESPACE: default
STATUS: deployed
REVISION: 1
DESCRIPTION: Install complete
NOTES:
1. Get the application URL by running these commands:
  export POD_NAME=$(kubectl get pods --namespace default -l "app.kubernetes.io/name=metadata-db,app.kubernetes.io/instance=metadata-db" -o jsonpath="{.items[0].metadata.name}")
  echo "Visit http://127.0.0.1:8080 to use your application"
  kubectl port-forward $POD_NAME 8080:80
deploying the vulnerable scenarios manifests
job.batch/batch-check-job unchanged
deployment.apps/build-code-deployment unchanged
service/build-code-service unchanged
namespace/secure-middleware unchanged
service/cache-store-service unchanged
deployment.apps/cache-store-deployment unchanged
service/health-check-service unchanged
The Deployment "health-check-deployment" is invalid: spec.template.spec.initContainers[0].volumeMounts[1].name: Not found: "socket-link"
namespace/big-monolith unchanged
role.rbac.authorization.k8s.io/secret-reader unchanged
rolebinding.rbac.authorization.k8s.io/secret-reader-binding unchanged
serviceaccount/big-monolith-sa unchanged
secret/vaultapikey unchanged
secret/webhookapikey unchanged
deployment.apps/hunger-check-deployment unchanged
service/hunger-check-service unchanged
deployment.apps/internal-proxy-deployment unchanged
service/internal-proxy-api-service unchanged
service/internal-proxy-info-app-service unchanged
deployment.apps/kubernetes-goat-home-deployment unchanged
service/kubernetes-goat-home-service unchanged
deployment.apps/poor-registry-deployment unchanged
service/poor-registry-service unchanged
secret/goatvault unchanged
deployment.apps/system-monitor-deployment unchanged
service/system-monitor-service unchanged
job.batch/hidden-in-layers unchanged
Successfully deployed Kubernetes Goat. Have fun learning Kubernetes Security!
Ensure pods are in running status before running access-kubernetes-goat.sh script
Now run the bash access-kubernetes-goat.sh to access the Kubernetes Goat environment.

问题解决

[root@localhost ~]# cd /root/kubernetes-goat/scenarios/health-check
[root@localhost ~]# sed -i '/socket-link/d' deployment.yaml 
[root@localhost kubernetes-goat]# helm list --all-namespaces
NAME            NAMESPACE       REVISION        UPDATED                                 STATUS      CHART                    APP VERSION
metadata-db     default         1               2026-04-12 01:42:54.41527795 +0800 CST  deployed    metadata-db-0.1.0        1.0        
[root@localhost kubernetes-goat]# helm uninstall metadata-db //卸载残留文件
release "metadata-db" uninstalled
[root@localhost kubernetes-goat]# ./setup-kubernetes-goat.sh  //重新安装
kubectl setup looks good.
deploying insecure super admin scenario
serviceaccount/superadmin unchanged
clusterrolebinding.rbac.authorization.k8s.io/superadmin unchanged
deploying helm chart metadata-db scenario
NAME: metadata-db
LAST DEPLOYED: Sun Apr 12 01:49:55 2026
NAMESPACE: default
STATUS: deployed
REVISION: 1
DESCRIPTION: Install complete
NOTES:
1. Get the application URL by running these commands:
  export POD_NAME=$(kubectl get pods --namespace default -l "app.kubernetes.io/name=metadata-db,app.kubernetes.io/instance=metadata-db" -o jsonpath="{.items[0].metadata.name}")
  echo "Visit http://127.0.0.1:8080 to use your application"
  kubectl port-forward $POD_NAME 8080:80
deploying the vulnerable scenarios manifests
job.batch/batch-check-job unchanged
deployment.apps/build-code-deployment unchanged
service/build-code-service unchanged
namespace/secure-middleware unchanged
service/cache-store-service unchanged
deployment.apps/cache-store-deployment unchanged
deployment.apps/health-check-deployment unchanged
service/health-check-service unchanged
namespace/big-monolith unchanged
role.rbac.authorization.k8s.io/secret-reader unchanged
rolebinding.rbac.authorization.k8s.io/secret-reader-binding unchanged
serviceaccount/big-monolith-sa unchanged
secret/vaultapikey unchanged
secret/webhookapikey unchanged
deployment.apps/hunger-check-deployment unchanged
service/hunger-check-service unchanged
deployment.apps/internal-proxy-deployment unchanged
service/internal-proxy-api-service unchanged
service/internal-proxy-info-app-service unchanged
deployment.apps/kubernetes-goat-home-deployment unchanged
service/kubernetes-goat-home-service unchanged
deployment.apps/poor-registry-deployment unchanged
service/poor-registry-service unchanged
secret/goatvault unchanged
deployment.apps/system-monitor-deployment unchanged
service/system-monitor-service unchanged
job.batch/hidden-in-layers unchanged
Successfully deployed Kubernetes Goat. Have fun learning Kubernetes Security!
Ensure pods are in running status before running access-kubernetes-goat.sh script
Now run the bash access-kubernetes-goat.sh to access the Kubernetes Goat environment.

端口转发

[root@localhost kubernetes-goat]# chmod +x access-kubernetes-goat.sh 
[root@localhost kubernetes-goat]# ./access-kubernetes-goat.sh 
kubectl setup looks good.
Creating port forward for all the Kubernetes Goat resources to locally. We will be using 1230 to 1236 ports locally!
Visit http://127.0.0.1:1234 to get started with your Kubernetes Goat hacking!
[root@localhost kubernetes-goat]# systemctl stop firewalld

搭建完成