Open a root shell on a Kubernetes cluster Node (no ssh).

k8s-node-gate.sh

#!/bin/sh

# Copyright (c) 2019 Gonçalo Baltazar <[email protected]>
# MIT License

# Open a root shell on a Kubernetes cluster Node (no ssh).

# It uses a privileged container to unlock Linux capabilities and chroot to
# change into the root filesystem of the Node for full access.

# The Node is selected using the 'kubernetes.io/hostname' label.

# usage: k8s-node-gate.sh <node-hostname>

set -e

NODE_HOSTNAME=$1

kubectl run "node-gate-"$NODE_HOSTNAME -it --rm --restart=Never --attach --image=busybox --overrides '
{
	"spec": {
		"nodeSelector": {
			"kubernetes.io/hostname": "'$NODE_HOSTNAME'"
		},
		"hostPID": true,
		"hostIPC": true,
		"hostNetwork": true,
		"containers": [
			{
				"name": "node-gate",
				"image": "busybox",
				"stdin": true,
				"tty": true,
				"command": [
					"chroot", "/mnt/host"
				],
				"securityContext": {
					"privileged": true
				},
				"volumeMounts": [
					{
						"name": "host",
						"mountPath": "/mnt/host"
					}
				]
			}
		],
		"tolerations": [
			{
				"effect": "NoSchedule",
				"operator": "Exists"
			}
		],
		"volumes": [
			{
				"name": "host",
				"hostPath": {
					"path": "/"
				}
			}
		]
	}
}
'