Merge pull request #126195 from abarqawi/patch-7

Update azure-kubernetes-service-backup-troubleshoot.md

Author: Court72

articles/backup/azure-kubernetes-service-backup-troubleshoot.md

@@ -129,6 +129,41 @@ This error appears due to absence of these FQDN rules because of which configura
 
 6. Delete and reinstall Backup Extension to initiate backup. 
 
+### Scenario 4
+
+**Error message**:
+
+   ```Error
+   "message": "Error: [ InnerError: [Helm installation failed : Unable to create/update Kubernetes resources for the extension : Recommendation Please check that there are no policies blocking the resource creation/update for the extension : InnerError [release azure-aks-backup failed, and has been uninstalled due to atomic being set: failed pre-install: job failed: BackoffLimitExceeded]]] occurred while doing the operation : [Create] on the config, For general troubleshooting visit: https://aka.ms/k8s-extensions-TSG, For more application specific troubleshooting visit: Facing trouble? Common errors and potential fixes are detailed in the Kubernetes Backup Troubleshooting Guide, available at https://www.aka.ms/aksclusterbackup",
+   ```
+The upgrade CRDs pre-install job is failing in the cluster.
+
+**Cause**: Pods Unable to Communicate with Kube API Server
+
+**Debug**
+
+1. Check for any events in the cluster related to pod spawn issue.
+```azurecli-interactive
+kubectl events -n dataprotection-microsoft
+```
+2. Check the pods for dataprotection crds.
+```azurecli-interactive
+kubectl get pods -A | grep "dataprotection-microsoft-kubernetes-agent-upgrade-crds"
+```
+3. Check the pods logs.
+```azurecli-interactive
+kubectl logs -f --all-containers=true --timestamps=true -n dataprotection-microsoft <pod-name-from-prev-command>
+```
+Example log message:
+```Error
+2024-08-09T06:21:37.712646207Z Unable to connect to the server: dial tcp: lookup aks-test.hcp.westeurope.azmk8s.io: i/o timeout
+2024-10-01T11:26:17.498523756Z Unable to connect to the server: dial tcp 10.146.34.10:443: i/o timeout
+```
+**Resolution**:
+In this case, there is a Network/Calico policy or NSG that didn't allow dataprotection-microsoft pods to communicate with the API server. 
+You should allow the dataprotection-microsoft namespace, and then reinstall the extension.
+
+
 ## Backup Extension post installation related errors
 
 These error codes appear due to issues on the Backup Extension installed in the AKS cluster.