Kind 实验室：云原生安全闯关笔记
目录
第一条命令：
% cubectl config current-context # 查看当前指向集群
kind-demo
% kubectl create namespace secure-lab # 创建一个用于实验的 namespace
namespace/secure-lab created
编辑一个yaml文件用于生成测试节点
apiVersion: v1
kind: Pod
metadata:
name: seclab-server
namespace: secure-lab
labels:
app: nginx # 冒号后必须有空格
spec:
containers:
- name: seclab-ns
image: nicolaka/netshoot
command: ["sleep", "infinity"] # 让容器不退出，方便后面 exec 进去测
---
apiVersion: v1
kind: Pod
metadata:
name: seclab-client
namespace: secure-lab
labels:
app: terminal
spec:
containers:
- name: seclab-cl
image: nicolaka/netshoot
command: ["sleep", "infinity"]
建议在执行前进行语法检查，确认无误后应用策略：
% kubectl apply -f ./pods.yaml --dry-run -o yaml
...
...
% kubectl apply -f ./pods.yaml
pod/seclab-server created
pod/seclab-client created
查看节点状态，发现两个节点的 Status 都是 ImagePullBackOff，说明启动存在问题。进一步进行状态查看。
% kubectl get pods -n secure-lab -o wide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
seclab-client 0/1 ImagePullBackOff 0 3m38s 10.244.0.9 demo-control-plane <none> <none>
seclab-server 0/1 ImagePullBackOff 0 3m38s 10.244.0.8 demo-control-plane <none> <none>
% kubectl describe pod seclab-server -n secure-lab
Name: seclab-server
Namespace: secure-lab
Priority: 0
Service Account: default
Node: demo-control-plane/172.18.0.2
Start Time: Sat, 07 Nov 2026 20:26:30 +0800
Labels: app=nginx
Annotations: <none>
Status: Pending
IP: 10.244.0.8
IPs:
IP: 10.244.0.8
Containers:
seclab-ns:
Container ID:
Image: nicolaka/netshoot
Image ID:
Port: <none>
Host Port: <none>
Command:
sleep
infinity
State: Waiting
Reason: ImagePullBackOff
Ready: False
Restart Count: 0
Environment: <none>
Mounts:
/var/run/secrets/kubernetes.io/serviceaccount from kube-api-access-2x966 (ro)
Conditions:
Type Status
Initialized True
Ready False
ContainersReady False
PodScheduled True
Volumes:
kube-api-access-2x966:
Type: Projected (a volume that contains injected data from multiple sources)
TokenExpirationSeconds: 3607
ConfigMapName: kube-root-ca.crt
Optional: false
DownwardAPI: true
QoS Class: BestEffort
Node-Selectors: <none>
Tolerations: node.kubernetes.io/not-ready:NoExecute op=Exists for 300s
node.kubernetes.io/unreachable:NoExecute op=Exists for 300s
Events:
Type Reason Age From Message
---- ------ ---- ---- -------
Normal Scheduled 3m40s default-scheduler Successfully assigned secure-lab/seclab-server to demo-control-plane
Warning Failed 3m9s kubelet spec.containers{seclab-ns}: Failed to pull image "nicolaka/netshoot": rpc error: code = Unknown desc = failed to pull and unpack image "docker.io/nicolaka/netshoot:latest": failed to resolve reference "docker.io/nicolaka/netshoot:latest": failed to do request: Head "https://registry-1.docker.io/v2/nicolaka/netshoot/manifests/latest": dial tcp 162.125.32.12:443: i/o timeout
Warning Failed 2m9s kubelet spec.containers{seclab-ns}: Failed to pull image "nicolaka/netshoot": rpc error: code = DeadlineExceeded desc = failed to pull and unpack image "docker.io/nicolaka/netshoot:latest": failed to resolve reference "docker.io/nicolaka/netshoot:latest": failed to do request: Head "https://registry-1.docker.io/v2/nicolaka/netshoot/manifests/latest": dial tcp 162.125.32.12:443: i/o timeout
Warning Failed 69s (x3 over 3m9s) kubelet spec.containers{seclab-ns}: Error: ErrImagePull
Warning Failed 69s kubelet spec.containers{seclab-ns}: Failed to pull image "nicolaka/netshoot": rpc error: code = DeadlineExceeded desc = failed to pull and unpack image "docker.io/nicolaka/netshoot:latest": failed to resolve reference "docker.io/nicolaka/netshoot:latest": failed to do request: Head "https://registry-1.docker.io/v2/nicolaka/netshoot/manifests/latest": dial tcp 162.125.7.1:443: i/o timeout
Normal BackOff 42s (x4 over 3m9s) kubelet spec.containers{seclab-ns}: Back-off pulling image "nicolaka/netshoot"
Warning Failed 42s (x4 over 3m9s) kubelet spec.containers{seclab-ns}: Error: ImagePullBackOff
Normal Pulling 28s (x4 over 3m39s) kubelet spec.containers{seclab-ns}: Pulling image "nicolaka/netshoot"
发现Pods启动卡在了拉取镜像的阶段，尝试按照以下方法配置成国内的镜像源：
% docker exec demo-control-plane containerd --version # 确认当前 docker 版本
containerd github.com/containerd/containerd v1.7.1 1677a17964311325ed1c31e2c0a3589ce6d5c30d
f145h@f145h-Lenovo-Legion ~/Documents/k8s/secure-lab
% docker exec demo-control-plane cp /etc/containerd/config.toml /etc/containerd/config.toml.bak # 备份 config.toml 文件
% docker exec -i demo-control-plane tee -a /etc/containerd/config.toml <<'EOF'
[plugins."io.containerd.grpc.v1.cri".registry]
config_path = "/etc/containerd/certs.d"
EOF
[plugins."io.containerd.grpc.v1.cri".registry]
config_path = "/etc/containerd/certs.d"
% docker exec demo-control-plane mkdir -p /etc/containerd/certs.d/docker.io # 创建docker.io 文件夹
% docker exec -i demo-control-plane tee /etc/containerd/certs.d/docker.io/hosts.toml <<'EOF'
server = "https://registry-1.docker.io"
[host."https://docker.1ms.run"]
capabilities = ["pull", "resolve"]
[host."https://docker-0.unsee.tech"]
capabilities = ["pull", "resolve"]
EOF