• Icon: Sub-task Sub-task
    • Resolution: Done
    • Icon: Undefined Undefined
    • None
    • None
    • QE-Task
    • None
    • 2
    • False
    • Hide

      None

      Show
      None
    • False
    • ToDo
    • 0
    • 0.000
    • Very Likely
    • 0
    • None
    • Unset
    • Unknown

      Currently image-stream application is failing due to PSA policies in OCP 4.16 cluster.

       "Failed to create object: b'{\"kind\":\"Status\",\"apiVersion\":\"v1\",\"metadata\":{},\"status\":\"Failure\",\"message\":\"pods \\\\\"usetag-alp\\\\\" is forbidden: violates PodSecurity \\\\\"restricted:v1.24\\\\\": allowPrivilegeEscalation != false (container \\\\\"podtest\\\\\" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container \\\\\"podtest\\\\\" must set securityContext.capabilities.drop=[\\\\\"ALL\\\\\"]), runAsNonRoot != true (pod or container \\\\\"podtest\\\\\" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container \\\\\"podtest\\\\\" must set securityContext.seccompProfile.type to \\\\\"RuntimeDefault\\\\\" or \\\\\"Localhost\\\\\")\",\"reason\":\"Forbidden\",\"details\":{\"name\":\"usetag-alp\",\"kind\":\"pods\"},\"code\":403}\\n'", "reason": "Forbidden", "status": 403} 2024-05-27 11:21:59,558 p=150076 u=1002280000 n=ansible | failed: [localhost] (item=Create pod for image image-registry.openshift-image-registry.svc:5000/test-oadp-98-kopia/internal-image:busy) => {"ansible_loop_var": "item", "changed": false, "error": 403, "item": {"external_image_name": "quay.io/migqe/busybox", "external_image_tag": 1.35, "extra_tags": [{"alias": false, "name": "tag3"}, {"alias": false, "name": "latest"}, {"alias": true, "name": "tag4"}], "internal_image_name": "internal-image", "internal_image_tag": "busy"}, "msg": "Failed to create object: b'{\"kind\":\"Status\",\"apiVersion\":\"v1\",\"metadata\":{},\"status\":\"Failure\",\"message\":\"pods \\\\\"usetag-busy\\\\\" is forbidden: violates PodSecurity \\\\\"restricted:v1.24\\\\\": allowPrivilegeEscalation != false (container \\\\\"podtest\\\\\" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container \\\\\"podtest\\\\\" must set securityContext.capabilities.drop=[\\\\\"ALL\\\\\"]), runAsNonRoot != true (pod or container \\\\\"podtest\\\\\" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container \\\\\"podtest\\\\\" must set securityContext.seccompProfile.type to \\\\\"RuntimeDefault\\\\\" or \\\\\"Localhost\\\\\")\",\"reason\":\"Forbidden\",\"details\":{\"name\":\"usetag-busy\",\"kind\":\"pods\"},\"code\":403}\\n'", "reason": "Forbidden", "status": 403}

              rhn-support-prajoshi Prasad Joshi
              rhn-support-prajoshi Prasad Joshi
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated:
                Resolved: