# 컨테이너 재시작여부 확인
crictl ps

# Manifest 문법오류 탐색 (컨테이너가 안뜨므로 치명적임)
journalctl -u kubelet | grep manifest

# 종료된 컨테이너 에러여부 탐색
cat /var/log/pods/kube-system_kube-apiserver-*/kube-apiserver/*.log
cat /var/log/containers/kube-apiserver-*.log

# 컨테이너 재시작: running 컨테이너를 재시작 할 경우
cd /etc/kubernetes/manifests
mv kube-apiserver.yaml ..
crictl ps
mv ../kube-apiserver.yaml .

# 컨테이너 재시작: crictl에서 컨테이너가 안뜨는 상태 (에러 후 복구)
systemctl restart kubelet

# 1. Create the directory
mkdir $target_log_dir

# 2. Edit Manifest
### 다음의 요구조건 사전 확인
#### policy_file
#### target_log_dir
#### target_log_file
#### maxsize
#### maxbackup
#### maxage

vi /etc/kubernetes/manifests/kube-apiserver.yaml
```
# enable Audit Logs
spec:
  containers:
  - command:
    - kube-apiserver
    - --audit-policy-file=$policy_file
    - --audit-log-path=$target_log_dir/$target_log_file
    - --audit-log-maxsize=$maxsize #요구조건 있을 경우
    - --audit-log-maxbackup=$maxbackup #요구조건 있을 경우
    - --audit-log-maxage=$maxage #요구조건 있을 경우

# add new VolumeMounts
volumeMounts:
  - mountPath: $policy_file
    name: audit-policy
    readOnly: true
  - mountPath: $target_log_dir
    name: audit-logs
    readOnly: false

# add new Volumes
volumes:
  - name: audit-policy
    hostPath:
      path: $policy_file
      type: File
  - name: audit-logs
    hostPath:
      path: $target_log_dir
      type: DirectoryOrCreate
`

# wait
watch crictl ps

vi /etc/kubernetes/manifests/kube-apiserver.yaml
```yaml
spec:
  containers:
  - command:
    - kube-apiserver
... #add 1 line
    - --enable-admission-plugins=<Plugin Name>
`

# add 1 flagline
  kube-apiserver --enable-admission-plugins=NodeRestriction

ssh node01 #worker-node
  export KUBECONFIG=/etc/kubernetes/kubelet.conf #kubectl 명령어 활성화

  # 노드 스스로에 대한 node-restriction.kubernetes.io/* 라벨 수정 차단됨
  k label node node01 node-restriction.kubernetes.io/two=123
  ```prompt
  Error from server (Forbidden): nodes "node01" is forbidden: is not allowed to modify labels: node-restriction.kubernetes.io/two
  `

  # 컨트롤 플레인 노드 라벨 수정 차단됨
  k label node controlplane killercoda/two=123
  ```prompt
  Error from server (Forbidden): nodes "controlplane" is forbidden: User "system:node:node01" cannot get resource "nodes" in API group "" at the cluster scope: node 'node01' cannot read 'controlplane', only its own Node object
  `

  # 노드 스스로에 대한 적용범위 내의 라벨 수정 허용됨
  k label node node01 test/two=123
  ```prompt
  node/node01 labeled
  `

  # 컨트롤플레인에서는 모두 허용됨

# add flag in --enable-admission-plugins
  kube-apiserver --enable-admission-plugins=NodeRestriction,AlwaysPullImages

# imagePullPolicy를 기재하지 않거나 IfNotPresent로 기재하여 Pod 배포
  kubectl run test-pod --image=nginx --restart=Never --dry-run=client -o yaml > pod.yaml

  # 생성된 yaml 확인 (기본값 또는 IfNotPresent)
  cat pod.yaml | grep imagePullPolicy

  # 클러스터에 배포
  kubectl apply -f pod.yaml

  # 실제 배포된 Pod 정보 조회 시 imagePullPolicy가 Always로 변경된 것을 확인
  kubectl get pod test-pod -o jsonpath='{.spec.containers[0].imagePullPolicy}'
  ```prompt
  Always
  `

apiVersion: apiserver.config.k8s.io/v1
  kind: AdmissionConfiguration
  plugins:
  - name: ImagePolicyWebhook
    configuration:
      imagePolicy:
        kubeConfigFile: /etc/kubernetes/admission/kubeconf.yaml
        allowTTL: 50
        denyTTL: 50
        retryBackoff: 500
        defaultAllow: false # 웹훅 통신 장애 시 Fail-Closed (안전)

apiVersion: v1
  kind: Config
  clusters:
  - cluster:
      server: <https://image-policy-webhook-service.security.svc:2379/validate>
      certificate-authority: /etc/kubernetes/admission/ca.crt
    name: image-policy-webhook
  users:
  - name: api-server
    user:
      client-certificate: /etc/kubernetes/admission/api-server.crt
      client-key: /etc/kubernetes/admission/api-server.key
  contexts:
  - context:
      cluster: image-policy-webhook
      user: api-server
    name: image-policy-webhook
  current-context: image-policy-webhook

# 1. 플러그인 활성화 및 설정파일 플래그 추가
  - --enable-admission-plugins=NodeRestriction,ImagePolicyWebhook
  - --admission-control-config-file=/etc/kubernetes/admission/admission_config.yaml

  # 2. 볼륨 마운트 추가 (admission 디렉토리 내의 설정 및 인증서 사용 가능하도록 호스트 마운트)
  ...
  spec:
    containers:
    - name: kube-apiserver
      volumeMounts:
      - mountPath: /etc/kubernetes/admission
        name: admission-config
        readOnly: true
    volumes:
    - hostPath:
        path: /etc/kubernetes/admission
        type: DirectoryOrCreate
      name: admission-config

# 승인되지 않은 비인가 이미지를 사용하는 Pod 배포 시도
  kubectl run malicious-pod --image=evilregistry.com/malicious-app:latest
  ```prompt
  Error from server (Forbidden): pods "malicious-pod" is forbidden: image evilregistry.com/malicious-app:latest is denied by image policy webhook.
  `

kubectl create ns secure-apps

  # 1. baseline 수준을 강제 적용 (enforce)
  kubectl label namespace secure-apps pod-security.kubernetes.io/enforce=baseline

  # 2. restricted 수준 위반 시 경고 출력 (warn)
  kubectl label namespace secure-apps pod-security.kubernetes.io/warn=restricted

# 특권 권한(Privileged)을 요구하는 Pod yaml 파일 생성
  cat <<EOF > priv-pod.yaml
  apiVersion: v1
  kind: Pod
  metadata:
    name: bad-pod
    namespace: secure-apps
  spec:
    containers:
    - name: nginx
      image: nginx
      securityContext:
        privileged: true
  EOF

  # 배포 시도 (baseline enforce 정책에 의해 생성 차단됨)
  kubectl apply -f priv-pod.yaml
  ```prompt
  Error from server (Forbidden): error when creating "priv-pod.yaml": pods "bad-pod" is forbidden: violates PodSecurity "baseline:latest": privileged (container "nginx" must not set securityContext.privileged=true)
  `

openssl genrsa -out /root/60099.key 2048
openssl req -new -key /root/60099.key -out /root/60099.csr -subj '/[email protected]'
# or
openssl req -new -key /root/60099.key -out 60099.csr
# Common Name에 userName 입력하기.
```prompt
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:[email protected]
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
`

openssl x509 -req -in 60099.csr \
    -CA /etc/kubernetes/pki/ca.crt \
    -CAkey /etc/kubernetes/pki/ca.key \
    -CAcreateserial \
    -out /root/60099.crt \
    -days 500
```prompt
Certificate request self-signature ok
subject=C = AU, ST = Some-State, O = Internet Widgits Pty Ltd, CN = [email protected]
`

cat <<EOF > csr.yaml
apiVersion: certificates.k8s.io/v1
kind: CertificateSigningRequest
metadata:
  name: [email protected] # ADD
spec:
  groups:
  - system:authenticated
  request: $(cat 60099.csr | base64 -w 0)
  signerName: kubernetes.io/kube-apiserver-client
  usages:
  - client auth
EOF
k apply -f csr.yaml
### or
cat <<EOF kubectl apply -f -
apiVersion: certificates.k8s.io/v1
kind: CertificateSigningRequest
metadata:
  name: [email protected] # ADD
spec:
  groups:
  - system:authenticated
  request: $(cat 60099.csr | base64 -w 0)
  signerName: kubernetes.io/kube-apiserver-client
  usages:
  - client auth
EOF

k certificate approve [email protected]
k get csr

k get csr [email protected] \
    -ojsonpath="{.status.certificate}" | base64 -d > 60099.crt

k config get-clusters 
```prompt
NAME
kubernetes
`
k config set-credentials [email protected] \
    --client-key=60099.key \
    --client-certificate=60099.crt 
```prompt
User "[email protected]" set.
`
k config get-users
```prompt
NAME
[email protected]
kubernetes-admin
`
k config set-context [email protected] \
    --cluster=kubernetes \
    [email protected]
```prompt
Context "[email protected]" created.
`
k config get-contexts 
```prompt
CURRENT   NAME                          CLUSTER      AUTHINFO               NAMESPACE
          [email protected]          kubernetes   [email protected]   
*         kubernetes-admin@kubernetes   kubernetes   kubernetes-admin       
`