Killer Shell CKA - Apiserver Misconfigured

1 개요

Killer Shell CKA - Apiserver Misconfigured

https://killercoda.com/killer-shell-cka/scenario/apiserver-misconfigured
API 서버 매니페스트에 3가지 오류(YAML 구문, 잘못된 플래그, 잘못된 etcd 포트)가 포함되어 API 서버가 기동/정상동작하지 않는 상황을 진단·복구하는 실습
선행: Killer Shell CKA - Apiserver Crash

2 문제 상황

controlplane:~$ k get pods -A
The connection to the server 172.30.1.2:6443 was refused - did you specify the right host or port?

controlplane:~$ crictl ps -a | grep api
controlplane:~$

3 확인

controlplane:~$ cat /var/log/syslog | grep kube-apiserver
...
2025-09-18T18:31:09.374852+00:00 controlplane kubelet[1560]: I0918 18:31:09.374711    1560 kubelet.go:3309] "Creating a mirror pod for static pod" pod="kube-system/kube-apiserver-controlplane"
2025-09-18T18:31:09.420997+00:00 controlplane kubelet[1560]: E0918 18:31:09.420818    1560 kubelet.go:3311] "Failed creating a mirror pod" err="pods \"kube-apiserver-controlplane\" already exists" pod="kube-system/kube-apiserver-controlplane"
2025-09-18T19:16:58.792760+00:00 controlplane kubelet[1560]: E0918 19:16:58.792415    1560 file.go:108] "Unable to process watch event" err="can't process config file \"/etc/kubernetes/manifests/kube-apiserver.yaml\": /etc/kubernetes/manifests/kube-apiserver.yaml: couldn't parse as pod(yaml: line 4: could not find expected ':'), please check config file"
2025-09-18T19:17:15.763575+00:00 controlplane kubelet[1560]: E0918 19:17:15.762697    1560 file.go:187] "Could not process manifest file" err="/etc/kubernetes/manifests/kube-apiserver.yaml: couldn't parse as pod(yaml: line 4: could not find expected ':'), please check config file" path="/etc/kubernetes/manifests/kube-apiserver.yaml"
2025-09-18T19:17:25.933002+00:00 controlplane kubelet[1560]: E0918 19:17:25.932844    1560 mirror_client.go:138] "Failed deleting a mirror pod" err="Delete \"https://172.30.1.2:6443/api/v1/namespaces/kube-system/pods/kube-apiserver-controlplane\": dial tcp 172.30.1.2:6443: connect: connection refused" pod="kube-system/kube-apiserver-controlplane"

4 수정 (1): YAML 오류 복구

controlplane:~$ cp /etc/kubernetes/manifests/kube-apiserver.yaml ~/kube-apiserver.yaml.ori
controlplane:~$ vim /etc/kubernetes/manifests/kube-apiserver.yaml

#metadata;
metadata:

5 확인 (1): 잘못된 플래그 확인 및 수정

controlplane:~$ crictl ps -a | grep api
c157523014713       ee794efa53d85       20 seconds ago       Exited              kube-apiserver            3                   b1f63d8786efa       kube-apiserver-controlplane               kube-system

controlplane:~$ crictl logs c157523014713
Error: unknown flag: --authorization-modus

controlplane:~$ vim /etc/kubernetes/manifests/kube-apiserver.yaml

#- --authorization-modus=Node,RBAC
- --authorization-mode=Node,RBAC

6 수정 (2): etcd 포트 복구

controlplane:~$ crictl ps -a | grep apiserver
...
W0918 19:33:17.646932       1 logging.go:55] [core] [Channel #3 SubChannel #6]grpc: addrConn.createTransport failed to connect to {Addr: "127.0.0.1:23000", ServerName: "127.0.0.1:23000", }. Err: connection error: desc = "transport: Error while dialing: dial tcp 127.0.0.1:23000: connect: connection refused"
W0918 19:33:17.646968       1 logging.go:55] [core] [Channel #2 SubChannel #5]grpc: addrConn.createTransport failed to connect to {Addr: "127.0.0.1:23000", ServerName: "127.0.0.1:23000", }. Err: connection error: desc = "transport: Error while dialing: dial tcp 127.0.0.1:23000: connect: connection refused"

controlplane:~$ vim /etc/kubernetes/manifests/kube-apiserver.yaml

#- --etcd-servers=https://127.0.0.1:23000
- --etcd-servers=https://127.0.0.1:2379

7 검증

controlplane:~$ crictl ps
CONTAINER           IMAGE               CREATED                  STATE               NAME                      ATTEMPT             POD ID              POD                                       NAMESPACE
184c8093e6b8e       ee794efa53d85       Less than a second ago   Running             kube-apiserver            0                   71ec1447ba526       kube-apiserver-controlplane               kube-system
...

controlplane:~$ kubectl get pods -A
NAMESPACE            NAME                                      READY   STATUS    RESTARTS      AGE
kube-system          calico-kube-controllers-fdf5f5495-8jbqm   1/1     Running   1 (66m ago)   30d
kube-system          canal-rtfc5                               2/2     Running   2 (66m ago)   30d
kube-system          coredns-6ff97d97f9-2rxsf                  1/1     Running   1 (66m ago)   30d
kube-system          coredns-6ff97d97f9-85m5c                  1/1     Running   1 (66m ago)   30d
kube-system          etcd-controlplane                         1/1     Running   1 (66m ago)   30d
kube-system          kube-apiserver-controlplane               1/1     Running   1 (66m ago)   30d
kube-system          kube-controller-manager-controlplane      1/1     Running   1 (66m ago)   30d
kube-system          kube-proxy-7kdz8                          1/1     Running   1 (66m ago)   30d
kube-system          kube-scheduler-controlplane               1/1     Running   1 (66m ago)   30d
local-path-storage   local-path-provisioner-5c94487ccb-gmwjg   1/1     Running   1 (66m ago)   30d