mirror of
https://github.com/openshift/openshift-docs.git
synced 2026-02-05 12:46:18 +01:00
80 lines
4.2 KiB
Plaintext
80 lines
4.2 KiB
Plaintext
// Module included in the following assemblies:
|
||
//
|
||
// * backup_and_restore/application_backup_and_restore/troubleshooting/restic-issues.adoc
|
||
//
|
||
:_mod-docs-content-type: PROCEDURE
|
||
[id="oadp-restic-restore-failing-psa-policy_{context}"]
|
||
= Troubleshooting restic restore partially failed issue on {ocp} 4.14 due to changed PSA policy
|
||
|
||
[role="_abstract"]
|
||
{ocp} 4.14 enforces a Pod Security Admission (PSA) policy that can hinder the readiness of pods during a Restic restore process.
|
||
|
||
If a `SecurityContextConstraints` (SCC) resource is not found when a pod is created, and the PSA policy on the pod is not set up to meet the required standards, pod admission is denied.
|
||
|
||
This issue arises due to the resource restore order of Velero.
|
||
|
||
.Sample error
|
||
[source,text]
|
||
----
|
||
\"level=error\" in line#2273: time=\"2023-06-12T06:50:04Z\"
|
||
level=error msg=\"error restoring mysql-869f9f44f6-tp5lv: pods\\\
|
||
"mysql-869f9f44f6-tp5lv\\\" is forbidden: violates PodSecurity\\\
|
||
"restricted:v1.24\\\": privil eged (container \\\"mysql\\\
|
||
" must not set securityContext.privileged=true),
|
||
allowPrivilegeEscalation != false (containers \\\
|
||
"restic-wait\\\", \\\"mysql\\\" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (containers \\\
|
||
"restic-wait\\\", \\\"mysql\\\" must set securityContext.capabilities.drop=[\\\"ALL\\\"]), seccompProfile (pod or containers \\\
|
||
"restic-wait\\\", \\\"mysql\\\" must set securityContext.seccompProfile.type to \\\
|
||
"RuntimeDefault\\\" or \\\"Localhost\\\")\" logSource=\"/remote-source/velero/app/pkg/restore/restore.go:1388\" restore=openshift-adp/todolist-backup-0780518c-08ed-11ee-805c-0a580a80e92c\n
|
||
velero container contains \"level=error\" in line#2447: time=\"2023-06-12T06:50:05Z\"
|
||
level=error msg=\"Namespace todolist-mariadb,
|
||
resource restore error: error restoring pods/todolist-mariadb/mysql-869f9f44f6-tp5lv: pods \\\
|
||
"mysql-869f9f44f6-tp5lv\\\" is forbidden: violates PodSecurity \\\"restricted:v1.24\\\": privileged (container \\\
|
||
"mysql\\\" must not set securityContext.privileged=true),
|
||
allowPrivilegeEscalation != false (containers \\\
|
||
"restic-wait\\\",\\\"mysql\\\" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (containers \\\
|
||
"restic-wait\\\", \\\"mysql\\\" must set securityContext.capabilities.drop=[\\\"ALL\\\"]), seccompProfile (pod or containers \\\
|
||
"restic-wait\\\", \\\"mysql\\\" must set securityContext.seccompProfile.type to \\\
|
||
"RuntimeDefault\\\" or \\\"Localhost\\\")\"
|
||
logSource=\"/remote-source/velero/app/pkg/controller/restore_controller.go:510\"
|
||
restore=openshift-adp/todolist-backup-0780518c-08ed-11ee-805c-0a580a80e92c\n]",
|
||
----
|
||
|
||
.Procedure
|
||
|
||
. In your DPA custom resource (CR), check or set the `restore-resource-priorities` field on the Velero server to ensure that `securitycontextconstraints` is listed in order before `pods` in the list of resources:
|
||
+
|
||
[source,terminal]
|
||
----
|
||
$ oc get dpa -o yaml
|
||
----
|
||
+
|
||
.Example DPA CR
|
||
[source,yaml]
|
||
----
|
||
# ...
|
||
configuration:
|
||
restic:
|
||
enable: true
|
||
velero:
|
||
args:
|
||
restore-resource-priorities: 'securitycontextconstraints,customresourcedefinitions,namespaces,storageclasses,volumesnapshotclass.snapshot.storage.k8s.io,volumesnapshotcontents.snapshot.storage.k8s.io,volumesnapshots.snapshot.storage.k8s.io,datauploads.velero.io,persistentvolumes,persistentvolumeclaims,serviceaccounts,secrets,configmaps,limitranges,pods,replicasets.apps,clusterclasses.cluster.x-k8s.io,endpoints,services,-,clusterbootstraps.run.tanzu.vmware.com,clusters.cluster.x-k8s.io,clusterresourcesets.addons.cluster.x-k8s.io' <1>
|
||
defaultPlugins:
|
||
- gcp
|
||
- openshift
|
||
----
|
||
<1> If you have an existing restore resource priority list, ensure you combine that existing list with the complete list.
|
||
|
||
. Ensure that the security standards for the application pods are aligned, as provided in link:https://access.redhat.com/solutions/7002730[Fixing PodSecurity Admission warnings for deployments], to prevent deployment warnings. If the application is not aligned with security standards, an error can occur regardless of the SCC.
|
||
|
||
[NOTE]
|
||
====
|
||
This solution is temporary, and ongoing discussions are in progress to address it.
|
||
====
|
||
|
||
|
||
[role="_additional-resources"]
|
||
.Additional resources
|
||
|
||
* link:https://access.redhat.com/solutions/7002730[Fixing PodSecurity Admission warnings for deployments]
|