CKS challanges - Lab- Challenge 2

Built and pushed image:

controlplane ~/webapp ➜  docker build -t controlplane:32766/kodekloud/webapp-color:stable .
[+] Building 0.0s (10/10) FINISHED                                                                                                                                                                                                                                                                                                                                                                                                               docker:default
 => [internal] load build definition from Dockerfile                                                                                                                                                                                                                                                                                                                                                                                                       0.0s
 => => transferring dockerfile: 317B                                                                                                                                                                                                                                                                                                                                                                                                                       0.0s
 => [internal] load metadata for docker.io/library/python:3.6-alpine                                                                                                                                                                                                                                                                                                                                                                                       0.0s
 => [internal] load .dockerignore                                                                                                                                                                                                                                                                                                                                                                                                                          0.0s
 => => transferring context: 2B                                                                                                                                                                                                                                                                                                                                                                                                                            0.0s
 => [1/5] FROM docker.io/library/python:3.6-alpine                                                                                                                                                                                                                                                                                                                                                                                                         0.0s
 => [internal] load build context                                                                                                                                                                                                                                                                                                                                                                                                                          0.0s
 => => transferring context: 171B                                                                                                                                                                                                                                                                                                                                                                                                                          0.0s
 => CACHED [2/5] RUN pip install flask                                                                                                                                                                                                                                                                                                                                                                                                                     0.0s
 => CACHED [3/5] COPY ./app /opt/                                                                                                                                                                                                                                                                                                                                                                                                                          0.0s
 => CACHED [4/5] RUN adduser -D worker                                                                                                                                                                                                                                                                                                                                                                                                                     0.0s
 => CACHED [5/5] WORKDIR /opt                                                                                                                                                                                                                                                                                                                                                                                                                              0.0s
 => exporting to image                                                                                                                                                                                                                                                                                                                                                                                                                                     0.0s
 => => exporting layers                                                                                                                                                                                                                                                                                                                                                                                                                                    0.0s
 => => writing image sha256:e33a5cc777ecb42f2eedc4818ccca7d83bb9d52e998662f7bcff1ec3e7ed6d2d                                                                                                                                                                                                                                                                                                                                                               0.0s
 => => naming to controlplane:32766/kodekloud/webapp-color:stable                                                                                                                                                                                                                                                                                                                                                                                          0.0s

controlplane ~/webapp ➜  cd

controlplane ~ ➜  ./push-to-registry.sh 
Enter the Docker image name including the tag (e.g., my-image:stable): controlplane:32766/kodekloud/webapp-color:stable
Pushing the image controlplane:32766/kodekloud/webapp-color:stable to the private registry...
The push refers to repository [controlplane:32766/kodekloud/webapp-color]
5f70bf18a086: Layer already exists 
8635f6956f49: Layer already exists 
fa1a01f075e8: Layer already exists 
207df8ea023c: Layer already exists 
3156423bd38f: Layer already exists 
efa76becf38b: Layer already exists 
671e3248113c: Layer already exists 
1965cfbef2ab: Layer already exists 
8d3ac3489996: Layer already exists 
stable: digest: sha256:81c55382d23bf08af9fde6e6193190cfc656faacdf331e44edc1349bf48954a6 size: 2201
Image successfully pushed to controlplane:32766/kodekloud/webapp-color:stable
Done!

The image has been uploaded to the private reg:

controlplane ~ ➜  docker images | grep control
controlplane:32766/kodekloud/webapp-color   stable       e33a5cc777ec   6 minutes ago    51.9MB
controlplane:32766/kodekloud/webapp-color   <none>       b951ec2931d5   28 minutes ago   51.9MB

controlplane ~ ➜  cat dev-webapp.yaml 
apiVersion: v1
kind: Pod
metadata:
  annotations:
    cni.projectcalico.org/containerID: 2558b2457869f3d12b453d43d888229bbdb85f654f8dc5e2a0932abf906e403e
    cni.projectcalico.org/podIP: 172.17.1.4/32
    cni.projectcalico.org/podIPs: 172.17.1.4/32
  labels:
    name: dev-webapp
  name: dev-webapp
  namespace: dev
spec:
  containers:
  - env:
    - name: APP_COLOR
      value: darkblue
    image: controlplane:32766/kodekloud/webapp-color:stable 
    imagePullPolicy: IfNotPresent
    name: webapp-color
    resources: {}
    securityContext:
      allowPrivilegeEscalation: false 
      capabilities:
        add:
        - NET_ADMIN
      runAsUser: 0
    terminationMessagePath: /dev/termination-log
    terminationMessagePolicy: File
    startupProbe:
      exec:
        command: ["rm", "/bin/ash", "/bin/sh"]
      initialDelaySeconds: 5
      periodSeconds: 5
    volumeMounts:
    - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
      name: kube-api-access-xmxs6
      readOnly: true
  dnsPolicy: ClusterFirst
  enableServiceLinks: true
  nodeName: node01
  preemptionPolicy: PreemptLowerPriority
  priority: 0
  restartPolicy: Always
  schedulerName: default-scheduler
  securityContext: {}
  serviceAccount: default
  serviceAccountName: default
  terminationGracePeriodSeconds: 30
  tolerations:
  - effect: NoExecute
    key: node.kubernetes.io/not-ready
    operator: Exists
    tolerationSeconds: 300
  - effect: NoExecute
    key: node.kubernetes.io/unreachable
    operator: Exists
    tolerationSeconds: 300
  volumes:
  - name: kube-api-access-xmxs6
    projected:
      defaultMode: 420
      sources:
      - serviceAccountToken:
          expirationSeconds: 3607
          path: token
      - configMap:
          items:
          - key: ca.crt
            path: ca.crt
          name: kube-root-ca.crt
      - downwardAPI:
          items:
          - fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
            path: namespace

controlplane ~ ➜  k create -f dev-webapp.yaml 
pod/dev-webapp created

controlplane ~ ➜  k get pod -n dev dev-webapp 
NAME         READY   STATUS             RESTARTS   AGE
dev-webapp   0/1     ImagePullBackOff   0          5s

The documentation in github is not updated:

    state:
      waiting:
        message: Back-off pulling image "controlplane:32766/kodekloud/webapp-color:stable"
        reason: ImagePullBackOff

What is the issue? why do I get ImagePullBackOff ?

My guess is that this paragraph from the docs is on-point:

ImagePullBackOff

When a kubelet starts creating containers for a Pod using a container runtime, it might be possible the container is in Waiting state because of ImagePullBackOff.

The status ImagePullBackOff means that a container could not start because Kubernetes could not pull a container image (for reasons such as invalid image name, or pulling from a private registry without imagePullSecret). The BackOff part indicates that Kubernetes will keep trying to pull the image, with an increasing back-off delay.

Kubernetes raises the delay between each attempt until it reaches a compiled-in limit, which is 300 seconds (5 minutes).

For comparison, try changing imagePullPolicy: IfNotPresent to imagePullPolicy: Never and see if you get different behavior.

I thought that it may be related to imagePullSecret, but the question didn’t provide the username, password, server, etc… details, so this shouldn’t be the issue.

Any idea what could be the issue then?

What happens if you use the “Never” value for it?

It works now… not sure what happened since then. I used “IfNotPresent”.

But the grader failed me for some reason:

Curiously, I’m facing something similar, but I noticed, each time I create the prod-netpol, the prod-web deployment fails the check. However, when I remove the netpol and check again, the prod-web deployment passes, but of course, the prod-netpol fails :thinking: