Uploaded image for project: 'OpenShift API for Data Protection'
  1. OpenShift API for Data Protection
  2. OADP-2094

OADP-1.2.2: Restic restore is partially failing due to Pod Security standard

XMLWordPrintable

    • False
    • Hide

      None

      Show
      None
    • False
    • QE - Ack
    • oadp-operator-bundle-container-1.2.2-16
    • ToDo
    • 0
    • 0
    • Very Likely
    • 0
    • None
    • Unset
    • Unknown
    • No

      Description of problem:

      We found this issue during the interop testing, OCP 4.14 has pod Security mode set as enforce which caused the pod to be getting denied. This is caused due to the restore order, basically the pod is getting created before the SCC resource as this pod violates the podSecurity standard it denies the pod.

      I have tested it with setting restore priority field on velero server, restore was successful. 

      $ oc get dpa -o yaml
   configuration:
      restic:
        enable: true
      velero:
        args:
          restore-resource-priorities: ServiceAccount,SecurityContextConstraints
        defaultPlugins:
        - gcp
        - openshift

$ oc get restore -o yaml
spec:
  backupName: test-restic
  excludedResources:
  - nodes
  - events
  - events.events.k8s.io
  - backups.velero.io
  - restores.velero.io
  - resticrepositories.velero.io
  - csinodes.storage.k8s.io
  - volumeattachments.storage.k8s.io
status:
  completionTimestamp: "2023-06-14T11:44:34Z"
  phase: Completed
  progress:
    itemsRestored: 41
    totalItems: 41
  startTimestamp: "2023-06-14T11:43:59Z"
  warnings: 5

      Version-Release number of selected component (if applicable):
      OCP 4.14 
      OADP 1.1.4 

       

      How reproducible:
      Always

      Steps to Reproduce:
      1. Deploy an application which consist SCC resource.

      $ oc create -f https://raw.githubusercontent.com/openshift/oadp-operator/master/tests/e2e/sample-applications/mysql-persistent/mysql-persistent.yaml

      2. Execute backup with restic.

      $ cat backup.yml 
apiVersion: velero.io/v1
kind: Backup
metadata:
  name: test-restic
  labels:
    velero.io/storage-location: default
  namespace: openshift-adp
spec:
  defaultVolumesToRestic: true
  includedNamespaces:
  - mysql-persistent
  storageLocation: ts-dpa-1

      3. Delete app namespace
      4. Execute Restore

       

      Actual results:

      Restore is partially failing.

       

      \"level=error\" in line#2273: time=\"2023-06-12T06:50:04Z\" level=error msg=\"error restoring mysql-869f9f44f6-tp5lv: pods \\\"mysql-869f9f44f6-tp5lv\\\" is forbidden: violates PodSecurity \\\"restricted:v1.24\\\": privileged (container \\\"mysql\\\" must not set securityContext.privileged=true), allowPrivilegeEscalation != false (containers \\\"restic-wait\\\", \\\"mysql\\\" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (containers \\\"restic-wait\\\", \\\"mysql\\\" must set securityContext.capabilities.drop=[\\\"ALL\\\"]), seccompProfile (pod or containers \\\"restic-wait\\\", \\\"mysql\\\" must set securityContext.seccompProfile.type to \\\"RuntimeDefault\\\" or \\\"Localhost\\\")\" logSource=\"/remote-source/velero/app/pkg/restore/restore.go:1388\" restore=openshift-adp/todolist-backup-0780518c-08ed-11ee-805c-0a580a80e92c\n velero container contains \"level=error\" in line#2447: time=\"2023-06-12T06:50:05Z\" level=error msg=\"Namespace todolist-mariadb, resource restore error: error restoring pods/todolist-mariadb/mysql-869f9f44f6-tp5lv: pods \\\"mysql-869f9f44f6-tp5lv\\\" is forbidden: violates PodSecurity \\\"restricted:v1.24\\\": privileged (container \\\"mysql\\\" must not set securityContext.privileged=true), allowPrivilegeEscalation != false (containers \\\"restic-wait\\\", \\\"mysql\\\" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (containers \\\"restic-wait\\\", \\\"mysql\\\" must set securityContext.capabilities.drop=[\\\"ALL\\\"]), seccompProfile (pod or containers \\\"restic-wait\\\", \\\"mysql\\\" must set securityContext.seccompProfile.type to \\\"RuntimeDefault\\\" or \\\"Localhost\\\")\" logSource=\"/remote-source/velero/app/pkg/controller/restore_controller.go:510\" restore=openshift-adp/todolist-backup-0780518c-08ed-11ee-805c-0a580a80e92c\n]",

      Expected results: 
      Restore should be successful.

       

      Additional info:
      slack thread:-
      https://redhat-internal.slack.com/archives/C0144ECKUJ0/p1686741632153959

          1.
          		 [RedHat QE] Verify Bug OADP-2094 - OADP-1.2.2: Restic restore is partially failing due to Pod Security standard Sub-task Closed Undefined Prasad Joshi
          2.
          		 [IBM QE-P] Verify Bug OADP-2094 - OADP-1.2.2: Restic restore is partially failing due to Pod Security standard Sub-task Release Pending Undefined Sonia Garudi
          3.
          		 [IBM QE-Z] Verify Bug OADP-2094 - OADP-1.2.2: Restic restore is partially failing due to Pod Security standard Sub-task Release Pending Undefined SHIVA SAI K (Inactive)

              hitpatel@redhat.com Hiteshwari Patel
              rhn-support-prajoshi Prasad Joshi
              Prasad Joshi Prasad Joshi
              Votes:
              0 Vote for this issue
              Watchers:
              8 Start watching this issue

                Created:
                Updated:
                Resolved: