【CKS】 考试之 ImagePolicyWebhook

16.【CKS】 考试之 ImagePolicyWebhook

16.1 题目要求

16.2 官网位置

16.3 操作步骤

切换 Context 后， ssh 到对应的 master 节点

16.3.1 关闭默认允许

# vim /etc/kubernetes/epconfig/admission_configuration.json
'defaultAllow': false # 改成 false

16.3.2 配置 Webhook 地址

vim /etc/kubernetes/epconfig/kubeconfig.yaml

server: https://wakanda.local:8082/image_policy
# 配置挂载，考试时一般会提前配置好
    - mountPath: /etc/kubernetes/epconfig
      name: epconfig
      readOnly: true
  hostNetwork: true
  priorityClassName: system-node-critical
  securityContext:
    seccompProfile:
      type: RuntimeDefault
  volumes:
  - hostPath:
      path: /etc/kubernetes/epconfig
    name: epconfig

16.3.3 开启 ImagePolicyWebhook

vim /etc/kubernetes/manifests/kube-apiserver.yaml

- --enable-admission-plugins=NodeRestriction,ImagePolicyWebhook
- --admission-control-configfile=/etc/kubernetes/epconfig/admission_configuration.json # 该文件在 epconfig
目录下

16.3.4 重启服务

systemctl daemon-reload
systemctl restart kubelet

16.3.5 测试验证

kubectl create -f /root/KSSC00202/configuration-test.yml