$ kdel pvc [pvc]
persistentvolumeclaim "[pvc]" deleted
^C # 멈춰서 강제 종료

$ k get volumeattachments.storage.k8s.io
No resources found # 사용 주체가 없다

$ pvc get
$ k get pvc
NAME                         STATUS        VOLUME                                     CAPACITY   ACCESS MODES   STORAGECLASS       AGE
[pvc]                        Terminating   pvc-9d3a82a2-49bd-45e7-99b7-e68eb8b76f34   20M        RWO            openebs-hostpath   30h

kubectl patch pvc {PVC_NAME} -p '{"metadata":{"finalizers":null}}'

kubectl patch pv [ PV_NAME ] -p '{"spec":{"claimRef": null}}'

  Warning  FailedMount       24s (x7 over 56s)  kubelet            MountVolume.NewMounter initialization failed for volume "pv-static" : path "/var/openebs/local/some-directory" does not exist

mount: /var/lib/kubelet/pods/91f95da8-3cea-4f8a-a367-c2b11b3444b5/volumes/kubernetes.io~nfs/test-volume: bad option; for several filesystems (e.g. nfs, cifs) you might need a /sbin/mount.<type> helper program.                                                                                                                                 │

mount.nfs: failed to apply fstab options

  Warning  FailedScheduling  29s   default-scheduler  0/1 nodes are available: 1 Too many pods. preemption: 0/1 nodes are available: 1 No
 preemption victims found for incoming pod..

# 파일로 부터 값 생성
kubectl create secret generic [name] --from-file=[key]=[filename] --from-file=[key]=[filename]
# 직접 입력한 값으로 부터 생성
kubectl create secret generic [name] --from-literal=[key]=[base64 encoded value]
# 기존 시크릿에 추가 혹은 값 변경
kubectl patch secret [name] -p '{"data": {["key"]: "[based encoded value]"}}' 
# 시크릿 네임스페이스 복사
kubectl get secret -n [ namespace ] [ secret name ] | kubectl neat | sed "s/namespace: .*/namespace: [ target namespace]/" | kubectl apply -f -

$ openssl genrsa -out user.key 2048
$ openssl req -new -key user.key -out user.csr
$ cat <<EOF | kubectl apply -f -
apiVersion: certificates.k8s.io/v1
kind: CertificateSigningRequest
metadata:
  name: user
spec:
  request: $(cat user.csr | base64)
  signerName: kubernetes.io/kube-apiserver-client
  expirationSeconds: 3600
  usages:
  - client auth
EOF

certificatesigningrequest.certificates.k8s.io/user created

$ k get csr
NAME     AGE   SIGNERNAME                            REQUESTOR          REQUESTEDDURATION   CONDITION
user   34s   kubernetes.io/kube-apiserver-client   kubernetes-admin   60m                 Pending

$ kubectl get csr user -o jsonpath='{.status.certificate}'| base64 -d > user.crt
$ kubectl config set-credentials user --client-key=user.key --client-certificate=user.crt --embed-certs
User "user" set.

$ kubectl config set-context user --cluster=local --user=user
Context "user" created.

$ kubectl config use-context user
Switched to context "user".

$ kgp
Error from server (Forbidden): pods is forbidden: User "user.dev" cannot list resource "pods" in API group "" in the namespace "default"

$ kubectl create role test --verb=get --verb=list --resource=pods
role.rbac.authorization.k8s.io/test created

$ kubectl create rolebinding test-user --role=test --user=user
rolebinding.rbac.authorization.k8s.io/test-user created

$ k config use-context user
Switched to context "user".

$ kgp
Error from server (Forbidden): pods is forbidden: User "user.dev" cannot list resource "pods" in API group "" in the namespace "default"

$ kgp -n test
Error from server (Forbidden): pods is forbidden: User "user.dev" cannot list resource "pods" in API group "" in the namespace "test"

$ k auth can-i list pods
no

$ k auth can-i list pods -n test
no

$ k api-resources head -1 ; k api-resources | grep pod
NAME                              SHORTNAMES                                      APIVERSION                             NAMESPACED   KIND
pods                              po                                              v1                                     true         Pod

$ k use-context user
error: unknown command "use-context" for "kubectl"
$ kgp
NAME                                    READY   STATUS      RESTARTS      AGE
curl                                    1/1     Running     5 (10d ago)   23d

$ kgp
error: You must be logged in to the server (Unauthorized)

PEM block type must be CERTIFICATE REQUEST

error: --overwrite is false but found the following declared annotation(s):