Kubernetes : CKAD weekly challenge

echo 'source <(kubectl completion bash)' >>~/.bashrc
echo 'alias k="kubectl"' >> .bashrc
echo 'complete -F __start_kubectl k' >>~/.bashrc

echo 'alias kx="kubectl explain"' >>~/.bashrc
echo 'alias kgp="kubectl get pods"' >>~/.bashrc
echo 'alias kdp="kubectl delete pod"' >>~/.bashrc
echo 'alias kgs="kubectl get svc"' >>~/.bashrc
echo 'alias kn="kubectl config set-context --current --namespace "' >>~/.bashrc

k config set-context --current --namespace <namespace>

k create ns 02-namespace-a
k config set-context --current --namsespace 02-namespace-a
k create deployment nginx-deployment --image=nginx --dry-run=client -o yaml > 02-deployment.yaml
k apply -f 02-deployment.yaml
k scale deployment nginx-deployment --replicas=3
k set resources deployment nginx-deployment --limits=cpu=200m,memory=512Mi

k expose deployment nginx-deployment --port 4444 --target-port 80
k expose deployment nginx-deployment --port 4444 --target-port 80 --name my-service

k run --image=cosmintitei/bash-curl --restart=Never pod1 -- bash -c "curl http://nginx-deployment:4444"
k run --image=cosmintitei/bash-curl --restart=Never --command=true pod2 -- sleep 1d

k exec -it pod2 -- bash
k exec pod2 -- bash -c "curl http://nginx-deployment:4444"
k exec pod2 -- bash -c 'curl http://$NGINX_DEPLOYMENT_SERVICE_HOST:$NGINX_DEPLOYMENT_SERVICE_PORT'

k create ns 02-namespace-b
k run --image=cosmintitei/bash-curl --restart=Never --namespace 02-namespace-b pod3 -- sleep 1d
k exec pod3 --namespace 02-namespace-b -- bash -c "curl http://my-service.k8s-challenge-2-a:4444"
k exec pod3 --namespace 02-namespace-b -- bash -c "curl http://my-service.k8s-challenge-2-a.svc.cluster.local:4444"

k create ns k8s-challenge-3
k config set-context --current --namespace k8s-challenge-3

# Use doc tasks snippet to create PV + PCV confif files (use storageClassName="" or storageClassName=manual)
k apply -f pv-manual.yaml
k-apply -f pv-claim.yaml

k explain PersistentVolume.spec
k create cj cronjob1 --image=bash --schedule="*/1 * * * *" -o yaml --dry-run=client -- bash -c "hostname >> /tmp/vol/storage" > cronjob1.yaml
# Edit Cronjob1.yaml file and add volume + volumeMount / Set spec.successfulJobsHistoryLimit=4 / Set jobTemplate.spec.parallelism=2
k get jobs,pods

k create ns one
k config set-contex --current --namespace one
k explain deployment.spec.template.spec.containers

k create deployment nginx --image=nginx:1.14.2 --dry-run=client -o yaml > deployment.yaml
k apply -f deployment.yam
k scale deploy nginx1 --replicas=15

k patch deployments.apps nginx -p '{"spec": {"template": {"spec": {"containers": [{"name": "nginx", "image": "nginx:1.15.10"}]}}}}'
k patch deployments.apps nginx -p '{"spec": {"template": {"spec": {"containers": [{"name": "nginx", "image": "nginx:1.15.666"}]}}}}'

k set image deploy/nginx nginx=nginx:1.15.10

k get pods -o yaml | grep 1.15.10 | wc -l

k rollout -h
k rollout history deployment/nginx
k rollout undo deployment/nginx

k create -h
k creat secret generic -h

k create secret generic secret1 --from-literal=password=12345678 --dry-run=client -o yaml > secret1.yaml
k applt -f secret1.yaml

# Copy past pod1.yaml from k8s docs/tasks : Inject data to pod via secret (update secret volume)
k apply -f pod1.yaml

k exec pod1 -- bash -c "cat /tmp/secret1/password && echo"

mkdir drinks; echo ipa > drinks/beer; echo red > drinks/wine; echo sparkling > drinks/water
k create configmap configmap1 --from-file=./drinks

# Edit pod1.yam and envFrom->ConfigMapRef->configmap1 (cf docs/tasks : configure pod)

k replace -f pod1.yaml --force --grace-period=0

k exec pod1 -- env

k create deployment 

k create svc -h
k create svc externalname -h
k create svc externalname my-svc --external-name www.google.com

k run --image=byrnedo/alpine-curl --command pod1 -- sleep 1d
k exec pod1 -- sh -c "ping -c 4  my-svc"
k exec pod1 -- sh -c "curl --header "" -c 4  my-svc"

# Test using curl
k exec pod1 -- sh -c "ping -c 4 mysvc"
k exec pod1 -- sh -c "curl -h"
k exec pod1 -- sh -c "curl --header 'Host: www.google.com' mysvc"

# Test using busybox/wget
k run --restart=Never --image=busybox --rm pod2 -- sh -c "wget --spider --header 'Host: www.google.com' mysvc"

k create clusterrole -h
k create clusterrole secretmanager --verb=* --resource=secret

# Bind clusterrole to "secret@test.com" user
k create clusterrolebinding secretmanager-rb --clusterrole=secretmanager --user=secret@test.com

# Test
kubectl auth can-i create secret --as secret@test.com
k auth can-i * secrets --as secret@test.com

# Auth for specific pod
k create clusterrole podmgr --verb=* --resource=pods --resource-name=compute
k create clusterrolebinding podmgr-rb --clusterrole=podmgr --user=deploy@test.com
k auth can-i * secrets --as deploy@test.com #no
k auth can-i create pod/compute --as deploy@test.com #yes

# Authorize read permission to secrets 
k create clusterrole secret-reader --verb=get,list,watch --resource=secrets --resource-name=compute-secret
k create clusterrolebinding secret-reader-rb --clusterrole=secret-reader --user=deploy@test.com
k auth can-i get secret/compute-secret --as deploy@test.com #yes
k auth can-i delete secrets/compute-secret --as deploy@test.com # no

# Chek log from existing pod volume
k exec nginx-54d8ff86dc-tthzg -- tail -f /var/log/nginx/access.log

# Export deployement to edit
k get deploy nginx -o yaml > deployment.yaml

# Sidecar container snippet to add

#  - image: bash
#    name: logging
#    args: ["bash", "-c", "tail -f /var/log/nginx/acces.log"]
#    volumeMounts:
#      - name: logs
#        mountPath: /var/log/nginx

k apply -f deployment.yaml

# Test (after acces nginx page Ex: curl $(minikube -p ckad ip):1234
k logs nginx-788965584-gnftv -c logging

# Bonus
POD=$(k get pod -l run=nginx -o jsonpath='{.items[0].metadata.name}'
k logs $POD -c logging

k create deployment super-app --image=nginx
k scale deployment super-app --replicas=3

kubectl get events | tail -n 10

# Show pod labels (replicaset template-hash is added to pod)
k get pod --show-labels # app=super-app,pod-template-hash=747cdb6c98

# Try create pod with these labels : #FAILURE : POD DELETED BY REPLICA CONTROLLER
k run nginx --image=nginx --labels="app=super-app,pod-template-hash=747cdb6c98"

kx pod.spec.securityContext

# Edit Pod.yaml to add Pod global securityContext

k apply -f pod.yaml
k exec bash -c bash1 -- touch /tmp/share/file
k exec bash -c bash2 -- ls -lh /tmp/share/file

k exec bash -c bash1 -- whoami # ftp
k exec bash -c bash2 -- whoami # ftp

# Edit Pod.yaml to add Container bash1 securityContext => root
k apply -f pod-securityContext-2.yaml
k exec bash -c bash1 -- whoami # root
k exec bash -c bash2 -- whoami # ftp

k exec bash -c bash1 -- touch /tmp/share/file
k exec bash -c bash2 -- ls -lh /tmp/share/file
k exec bash -c bash2 -- rm /tmp/share/file # FILE DELETED !!!

# Check parent dir premission
k exec bash -c bash2 -- ls -la /tmp/share # => drwxrwxrwx    2 root     root

# Edit Pod.yaml to add set /tmp/share dir permission
k exec bash -c bash1 -- chmod og-w -R /tmp/share
k exec bash -c bash1 -- touch /tmp/share/file
k exec bash -c bash2 -- ls -lh /tmp/share/file
k exec bash -c bash2 -- rm /tmp/share/file # PERMISSION DENIED :)

# Check parent dir premission
k exec bash -c bash2 -- ls -la /tmp/share # => drwxr-xr-x    2 root     root 

k delete -f pod.yaml
k apply -f pod-securityContext-3.yaml

k exec bash -c bash1 -- touch /tmp/share/file
k exec bash -c bash2 -- ls -lh /tmp/share/file
k exec bash -c bash2 -- rm /tmp/share/file # PERMISSION DENIED :)

cat <<EOF > env.txt
CREDENTIAL_001=-bQ(ETLPGE[uT?6C;ed
CREDENTIAL_002=C_;SU@ev7yg.8m6hNqS
CREDENTIAL_003=ZA#$$-Ml6et&4?pKdvy
CREDENTIAL_004=QlIc3$5*+SKsw==9=p{
CREDENTIAL_005=C_2\a{]XD}1#9BpE[k?
CREDENTIAL_006=9*KD8_w<);ozb:ns;JC
CREDENTIAL_007=C[V$Eb5yQ)c~!..{LRT
SETTING_USE_SEC=true
SETTING_ALLOW_ANON=true
SETTING_PREVENT_ADMIN_LOGIN=true
EOF

k create secret -h 
k create secret generic app-secret --from-env-file env.txt
k describe secrets app-secret

# Create pod
k run nginx --image=nginx --restart=Never --dry-run=client -o yaml > pod.yaml

k explain pod.spec.containers.envFrom
# Edit nginx pod to add ennFrom secret entry

# ... 
#spec:
#  containers:
#    - name: app
#      envFrom: 
#        - secretRef:
#            name: app-secret
# ... 

k apply -f pod.yaml

# Test pod env
k exec nginx -- env
k exec nginx -- sh -c echo '$CREDENTIAL_002'

# Create pod

cat <<EOF | k apply -f -
apiVersion: v1
kind: Pod
metadata:
  name: pod-calc
spec:
  containers:
  - command:
    - sh
    - -c
    - echo "important calculation"; sleep 1d
    image: nginx
    name: pod-calc
EOF

# Label the pod
k label pod pod-calc app=calc

# 1. Create a ReplicaSet of 2 replicas with the same template spec as pod-calc (with lablel app=calc). 
# 2. Ensure to set ReplicaSet selector.matchLabels to app=calc, so it will handle existing Pod as of its replicas

cat <<EOF | k apply -f -
apiVersion: apps/v1
kind: ReplicaSet
metadata:
  name: calculation-rs
spec:
  replicas: 2
  selector:
    matchLabels:
      app: calc
  template:
    metadata:
      labels:
        app: calc
    spec:
      containers:
        - command:
            - sh
            - -c
            - echo "important calculation"; sleep 1d
          image: nginx
          name: pod-calc
EOF

# Check 
k get rs

k create ns zeus
k config set-context --current --namespace zeus
k create deployment my-app --image=nginx --dry-run=client -o yaml > my-app-deployment.yaml

k explain k explain pod.spec.containers
k explain k explain pod.spec.containers.livenessProbe

k apply -f my-app-deployment.yaml

# Get IP of one pod of my-app deployment exemple: 172.17.0.2
k get pod -o wide 

k run tmp --rm -ti --restart=Never --image=busybox -- sh -c "wget -O- 172.17.0.2"

k create deployment nginx --image=nginx
k scale deployment nginx --replicas=5

k autoscale -h
k autoscale deployment nginx --min=5 --max=10 --cpu-percent=80 --dry-run -o yaml > autoscale.yaml

k appply -f autoscale.yaml