Uploaded image for project: 'OpenShift API for Data Protection'
  1. OpenShift API for Data Protection
  2. OADP-5239

Restore Partially Fails Due to container 'restore-wait' Violating PodSecurityContext Constraints

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Undefined Undefined
    • OADP 1.5.0
    • OADP 1.4.2
    • None
    • 3
    • False
    • Hide

      None

      Show
      None
    • False
    • ToDo
    • 0
    • 0.000
    • Very Likely
    • 0
    • None
    • Unset
    • Unknown
    • None

      Description of problem:

      On performing the backup of an application with excluded cluster scoped resources, including namespace,storageclass, The backup succeeds but the restore fails.

      Version-Release number of selected component (if applicable):

      1.4.2

      How reproducible:

      Always

      Steps to Reproduce:
      1. Deploy an application
      2. Perform backup with appropriate exclude cluster scoped resources param.
      3. Delete Project and perform the restore.

      Actual results:

      Restore partilally fails.

      Expected results:

      Restore should succeed.

      Additional info:

      Backup:

      
      apiVersion: velero.io/v1
      kind: Backup
      metadata:
       name: backup9
       namespace: openshift-adp
      spec:
       defaultVolumesToFsBackup: true
       hooks: {}
       includedNamespaces:
       - mysql2
        excludedClusterScopedResources: ["storageclasses", "Namespace"]
       storageLocation: velero-sample-1
       ttl: 720h0s
      

      Velero Describe Restore:

      $ velero describe restore mytest1 -n openshift-adp --details
      Name:         mytest1
      Namespace:    openshift-adp
      Labels:       <none>
      Annotations:  <none>
      
      Phase:                       PartiallyFailed (run 'velero restore logs mytest1' for more information)
      Total items to be restored:  28
      Items restored:              28
      
      Started:    2024-11-18 18:25:03 +0530 IST
      Completed:  2024-11-18 18:25:07 +0530 IST
      
      Warnings:
        Velero:     <none>
        Cluster:    <none>
        Namespaces:
          mytest1:  could not restore, RoleBinding "system:image-builders" already exists. Warning: the in-cluster version is different than the backed-up version
                    could not restore, RoleBinding "system:image-pullers" already exists. Warning: the in-cluster version is different than the backed-up version
                    could not restore, ConfigMap "kube-root-ca.crt" already exists. Warning: the in-cluster version is different than the backed-up version
                    could not restore, ConfigMap "openshift-service-ca.crt" already exists. Warning: the in-cluster version is different than the backed-up version
                    could not restore, RoleBinding "admin" already exists. Warning: the in-cluster version is different than the backed-up version
                    could not restore, RoleBinding "system:deployers" already exists. Warning: the in-cluster version is different than the backed-up version
                    could not restore, RoleBinding "system:image-builders" already exists. Warning: the in-cluster version is different than the backed-up version
                    could not restore, RoleBinding "system:image-pullers" already exists. Warning: the in-cluster version is different than the backed-up version
      
      Errors:
        Velero:     <none>
        Cluster:    <none>
        Namespaces:
          mytest1:  error restoring pods/mytest1/mysql-7db78bc44b-rwtsk: pods "mysql-7db78bc44b-rwtsk" is forbidden: violates PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container "restore-wait" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "restore-wait" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "restore-wait" must set securityContext.runAsNonRoot=true)
      
      Backup:  mytest1
      
      Namespaces:
        Included:  all namespaces found in the backup
      

              wnstb Wes Hayutin
              rhn-support-ssingla Sachin Singla
              Sachin Singla Sachin Singla
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Created:
                Updated: