Im trying to solve the below lab:
The ImagePolicyWebhook admission controller intercepts pod creation requests and consults an external webhook service to determine whether the container images specified in the pod spec should be allowed or denied.
In this lab, you will configure an ImagePolicyWebhook admission controller to work with a container image scanner.
A functional container image scanner is already deployed with the HTTPS endpoint:
https://image-checker-webhook.default.svc:1323/image_policy
It appears that the Volume is not getting mounted inside the kube-apiserver POD and after making the necessary modification, kube-apiserver is terminating, even though the entry is correct in the kube-apiserver manifest file.
Following are the details:
controlplane /etc/kubernetes/imgvalidation ➜ cat admission-configuration.yaml
apiVersion: apiserver.config.k8s.io/v1
kind: AdmissionConfiguration
plugins:
- name: ImagePolicyWebhook
path: /etc/kubernetes/imgvalidation/imagepolicy-conf.yaml
controlplane /etc/kubernetes/imgvalidation ➜ cat imagepolicy-conf.yaml
imagePolicy:
kubeConfigFile: /etc/kubernetes/imgvalidation/kubeconf.yaml
allowTTL: 50
denyTTL: 50
retryBackoff: 500
defaultAllow: false
controlplane /etc/kubernetes/imgvalidation ➜
controlplane /etc/kubernetes/imgvalidation ➜ cat kubeconf.yaml
apiVersion: v1
kind: Config
clusters:
- cluster:
certificate-authority: /etc/kubernetes/imgvalidation/webhook.crt
server: https://image-checker-webhook.default.svc:1323/image_policy
name: checker_webhook
contexts: - context:
cluster: checker_webhook
user: api-server
name: checker_validator
current-context: checker_validator
preferences: {}
users: - name: api-server
user:
client-certificate: /etc/kubernetes/pki/front-proxy-client.crt
client-key: /etc/kubernetes/pki/front-proxy-client.key
controlplane /etc/kubernetes/imgvalidation ➜
Made below changes to the /etc/Kubernetes/manifests/kube-apiserver.yaml to enable ImagePolicyWebhook
- –enable-admission-plugins=NodeRestriction,ImagePolicyWebhook
- –admission-control-config-file=/etc/kubernetes/imgvalidation/admission-configuration.yaml
volumeMounts:
- mountPath: /etc/kubernetes/imgvalidation
name: imgvalidation
readOnly: true
volumes:
- hostPath:
path: /etc/kubernetes/imgvalidation
type: Directory
name: imgvalidation
But it appears kube-api crashed.
controlplane /etc/kubernetes/imgvalidation 
kubectl get pods -n kube-system
The connection to the server controlplane:6443 was refused - did you specify the right host or port?
controlplane /etc/kubernetes/imgvalidation ➜ crictl ps -a --name kube-apiserver
CONTAINER IMAGE CREATED STATE NAME ATTEMPT POD ID POD NAMESPACE
42ab6b5d31e16 5c6acd67e9cd1 4 minutes ago Exited kube-apiserver 8 9b0ac3992d84d kube-apiserver-controlplane kube-system
controlplane /etc/kubernetes/imgvalidation ➜
#crictl logs $(crictl ps -a --name kube-apiserver -q | head -n 1)
E0718 03:01:01.677834 1 run.go:72] “command failed” err=“failed to apply admission: failed to read plugin config: unable to read admission control configuration from "/etc/kubernetes/imgvalidation/admission-configuration.yaml" [open /etc/kubernetes/imgvalidation/admission-configuration.yaml: no such file or directory]”
controlplane /etc/kubernetes/imgvalidation ➜ pwd
/etc/kubernetes/imgvalidation
controlplane /etc/kubernetes/imgvalidation ➜ ls -ltr
total 20
-rw------- 1 root root 1708 Jul 18 02:23 webhook.key
-rw-r–r-- 1 root root 1172 Jul 18 02:23 webhook.crt
-rw-r–r-- 1 root root 164 Jul 18 02:23 admission-configuration.yaml
-rw-r–r-- 1 root root 147 Jul 18 02:28 imagepolicy-conf.yaml
-rw-r–r-- 1 root root 522 Jul 18 02:29 kubeconf.yaml
controlplane /etc/kubernetes/imgvalidation ➜ ls -ltr /etc/kubernetes/imgvalidation/admission-configuration.yaml
-rw-r–r-- 1 root root 164 Jul 18 02:23 /etc/kubernetes/imgvalidation/admission-configuration.yaml
controlplane /etc/kubernetes/imgvalidation ➜ ls -ld /etc/kubernetes/imgvalidation/
drwxr-xr-x 2 root root 4096 Jul 18 02:29 /etc/kubernetes/imgvalidation/