Skip to content

Commit a96303b

Browse files
prmerger-automator[bot]prmerger-automator[bot]
authored
Merge pull request #288405 from khdownie/kendownie101424-3
Move Azure Policy restrictions
2 parents 12c95cb + d70bddb commit a96303b

File tree

2 files changed

+28
-19
lines changed

2 files changed

+28
-19
lines changed

‎articles/storage/container-storage/container-storage-faq.md

Lines changed: 1 addition & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ title: Frequently asked questions for Azure Container Storage
33
description: Get answers to Azure Container Storage frequently asked questions (FAQ).
44
author: khdownie
55
ms.service: azure-container-storage
6-
ms.date: 07/24/2024
6+
ms.date: 10/15/2024
77
ms.author: kendownie
88
ms.topic: faq
99
ms.custom: references_regions
@@ -58,22 +58,6 @@ ms.custom: references_regions
5858
* <a id="azure-container-storage-ephemeralosdisk"></a>
5959
**Does Azure Container Storage use the capacity from Ephemeral OS disks for ephemeral disk storage pool?**
6060
No, Azure Container Storage only discovers and uses the capacity from ephemeral data disks for ephemeral disk storage pool.
61-
62-
* <a id="azure-container-storage-installation"></a>
63-
**I encountered installation issues due to Azure Policy. What is the recommended approach?**
64-
65-
If you’re experiencing installation issues with Azure Container Storage in your AKS cluster, it might be due to Azure Policy restrictions. To resolve this,
66-
you’ll need to add the `acstor` namespace to the exclusion list of your Azure Policy. Azure Policy is used to create and enforce rules for managing resources
67-
within Azure, including AKS clusters. In some cases, policies might block the creation of Azure Container Storage pods and components. You can find more details
68-
on working with Azure Policy for Kubernetes by consulting [Azure Policy for Kubernetes](/azure/governance/policy/concepts/policy-for-kubernetes).
69-
To resolve this, follow these steps:
70-
- [Create your Azure Kubernetes cluster](install-container-storage-aks.md)
71-
- Enable Azure Policy for AKS
72-
- Create a policy that you suspect is blocking the installation of Azure Container Storage
73-
- Attempt to install Azure Container Storage in the AKS cluster
74-
- Check the logs for the gatekeeper-controller pod to confirm any policy violations
75-
- Add the `acstor` namespace to the exclusion list of the policy
76-
- Attempt to install Azure Container Storage in the AKS cluster again
7761

7862
## See also
7963

‎articles/storage/container-storage/troubleshoot-container-storage.md

Lines changed: 27 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ title: Troubleshoot Azure Container Storage
33
description: Troubleshoot common problems with Azure Container Storage, including installation and storage pool issues.
44
author: khdownie
55
ms.service: azure-container-storage
6-
ms.date: 07/24/2024
6+
ms.date: 10/15/2024
77
ms.author: kendownie
88
ms.topic: how-to
99
---
@@ -14,7 +14,7 @@ ms.topic: how-to
1414

1515
## Troubleshoot installation issues
1616

17-
### Azure Container Storage fails to install
17+
### Azure Container Storage fails to install due to missing configuration
1818

1919
After running `az aks create`, you might see the message *Azure Container Storage failed to install. AKS cluster is created. Please run `az aks update` along with `--enable-azure-container-storage` to enable Azure Container Storage*.
2020

@@ -26,6 +26,31 @@ To install Azure Container Storage on the cluster and create a storage pool, run
2626
az aks update -n <cluster-name> -g <resource-group> --enable-azure-container-storage <storage-pool-type>
2727
```
2828

29+
### Azure Container Storage fails to install due to Azure Policy restrictions
30+
31+
Azure Container Storage might fail to install if Azure Policy restrictions are in place. Specifically, Azure Container Storage relies on privileged containers, which can be blocked by Azure Policy. When this happens, the installation of Azure Container Storage might timeout or fail, and you might see errors in the `gatekeeper-controller` logs such as:
32+
33+
```output
34+
{"level":"info","ts":1722622443.9484184,"logger":"webhook","msg":"denied admission: Privileged container is not allowed: prereq, securityContext: {\"privileged\": true, \"runAsUser\": 0}","hookType":"validation","process":"admission","details":{},"event_type":"violation","constraint_name":"azurepolicy-k8sazurev2noprivilege-686dd8b209a774ba977c","constraint_group":"constraints.gatekeeper.sh","constraint_api_version":"v1beta1","constraint_kind":"K8sAzureV2NoPrivilege","constraint_action":"deny","resource_group":"","resource_api_version":"v1","resource_kind":"Pod","resource_namespace":"acstor","resource_name":"azurecontainerstorage-prereq-gt58x","request_username":"system:serviceaccount:kube-system:daemon-set-controller"}
35+
{"level":"info","ts":1722622443.9839077,"logger":"webhook","msg":"denied admission: Privileged container is not allowed: metrics-exporter, securityContext: {\"privileged\": true}","hookType":"validation","process":"admission","details":{},"event_type":"violation","constraint_name":"azurepolicy-k8sazurev2noprivilege-686dd8b209a774ba977c","constraint_group":"constraints.gatekeeper.sh","constraint_api_version":"v1beta1","constraint_kind":"K8sAzureV2NoPrivilege","constraint_action":"deny","resource_group":"","resource_api_version":"v1","resource_kind":"Pod","resource_namespace":"acstor","resource_name":"azurecontainerstorage-metrics-exporter-286np","request_username":"system:serviceaccount:kube-system:daemon-set-controller"}
36+
{"level":"info","ts":1722622444.0515249,"logger":"webhook","msg":"denied admission: Privileged container is not allowed: csi-node, securityContext: {\"privileged\": true}","hookType":"validation","process":"admission","details":{},"event_type":"violation","constraint_name":"azurepolicy-k8sazurev2noprivilege-686dd8b209a774ba977c","constraint_group":"constraints.gatekeeper.sh","constraint_api_version":"v1beta1","constraint_kind":"K8sAzureV2NoPrivilege","constraint_action":"deny","resource_group":"","resource_api_version":"v1","resource_kind":"Pod","resource_namespace":"acstor","resource_name":"azurecontainerstorage-csi-node-7hcd7","request_username":"system:serviceaccount:kube-system:daemon-set-controller"}
37+
{"level":"info","ts":1722622444.0729053,"logger":"webhook","msg":"denied admission: Privileged container is not allowed: io-engine, securityContext: {\"privileged\": true}","hookType":"validation","process":"admission","details":{},"event_type":"violation","constraint_name":"azurepolicy-k8sazurev2noprivilege-686dd8b209a774ba977c","constraint_group":"constraints.gatekeeper.sh","constraint_api_version":"v1beta1","constraint_kind":"K8sAzureV2NoPrivilege","constraint_action":"deny","resource_group":"","resource_api_version":"v1","resource_kind":"Pod","resource_namespace":"acstor","resource_name":"azurecontainerstorage-io-engine-84hwx","request_username":"system:serviceaccount:kube-system:daemon-set-controller"}
38+
{"level":"info","ts":1722622444.0742755,"logger":"webhook","msg":"denied admission: Privileged container is not allowed: ndm, securityContext: {\"privileged\": true}","hookType":"validation","process":"admission","details":{},"event_type":"violation","constraint_name":"azurepolicy-k8sazurev2noprivilege-686dd8b209a774ba977c","constraint_group":"constraints.gatekeeper.sh","constraint_api_version":"v1beta1","constraint_kind":"K8sAzureV2NoPrivilege","constraint_action":"deny","resource_group":"","resource_api_version":"v1","resource_kind":"Pod","resource_namespace":"acstor","resource_name":"azurecontainerstorage-ndm-x6q5n","request_username":"system:serviceaccount:kube-system:daemon-set-controller"}
39+
{"level":"info","ts":1722622449.2412128,"logger":"webhook","msg":"denied admission: Privileged container is not allowed: ndm, securityContext: {\"privileged\": true}","hookType":"validation","process":"admission","details":{},"event_type":"violation","constraint_name":"azurepolicy-k8sazurev2noprivilege-686dd8b209a774ba977c","constraint_group":"constraints.gatekeeper.sh","constraint_api_version":"v1beta1","constraint_kind":"K8sAzureV2NoPrivilege","constraint_action":"deny","resource_group":"","resource_api_version":"v1","resource_kind":"Pod","resource_namespace":"acstor","resource_name":"azurecontainerstorage-ndm-b5nfg","request_username":"system:serviceaccount:kube-system:daemon-set-controller"}
40+
```
41+
42+
To resolve this, you’ll need to add the `acstor` namespace to the exclusion list of your Azure Policy. Azure Policy is used to create and enforce rules for managing resources within Azure, including AKS clusters. In some cases, policies might block the creation of Azure Container Storage pods and components. You can find more details on working with Azure Policy for Kubernetes by consulting [Azure Policy for Kubernetes](/azure/governance/policy/concepts/policy-for-kubernetes).
43+
44+
To add the `acstor` namespace to the exclusion list, follow these steps:
45+
46+
1. [Create your Azure Kubernetes cluster](install-container-storage-aks.md).
47+
1. Enable Azure Policy for AKS.
48+
1. Create a policy that you suspect is blocking the installation of Azure Container Storage.
49+
1. Attempt to install Azure Container Storage in the AKS cluster.
50+
1. Check the logs for the gatekeeper-controller pod to confirm any policy violations.
51+
1. Add the `acstor` namespace to the exclusion list of the policy.
52+
1. Attempt to install Azure Container Storage in the AKS cluster again.
53+
2954
### Can't set storage pool type to NVMe
3055

3156
If you try to install Azure Container Storage with Ephemeral Disk, specifically with local NVMe on a cluster where the virtual machine (VM) SKU doesn't have NVMe drives, you get the following error message: *Cannot set --storage-pool-option as NVMe as none of the node pools can support ephemeral NVMe disk*.

0 commit comments

Comments
 (0)