OCPBUGS#6729: Validating admission webhook can block etcd cluster restore procedure

xenolinux · xenolinux · commit 88d32f34d974 · 2023-02-23T21:29:20.000+05:30
diff --git a/modules/dr-restoring-cluster-state.adoc b/modules/dr-restoring-cluster-state.adoc
@@ -296,7 +296,14 @@ Perform the following step only if you are using `OVNKubernetes` network plugin.
 ====
 +
 . Restart the Open Virtual Network (OVN) Kubernetes pods on all the hosts.
++
+[NOTE]
+====
+Validating and mutating admission webhooks can reject pods. If you add any additional webhooks with the `failurePolicy` set to `Fail`, then they can reject pods and the restoration process can fail. You can avoid this by saving and deleting webhooks while restoring the cluster state. After the cluster state is restored successfully, you can enable the webhooks again.
 
+Alternatively, you can temporarily set the `failurePolicy` to `Ignore` while restoring the cluster state. After the cluster state is restored successfully, you can set the `failurePolicy` to `Fail`.
+====
++
 .. Remove the northbound database (nbdb) and southbound database (sbdb). Access the recovery host and the remaining control plane nodes by using Secure Shell (SSH) and run the following command:
 +
 [source,terminal]

Original file line number	Diff line number	Diff line change
@@ -296,7 +296,14 @@ Perform the following step only if you are using `OVNKubernetes` network plugin.
`296`	`296`	`====`
`297`	`297`	`+`
`298`	`298`	`. Restart the Open Virtual Network (OVN) Kubernetes pods on all the hosts.`
	`299`	`++`
	`300`	`+[NOTE]`
	`301`	`+====`
	`302`	+Validating and mutating admission webhooks can reject pods. If you add any additional webhooks with the `failurePolicy` set to `Fail`, then they can reject pods and the restoration process can fail. You can avoid this by saving and deleting webhooks while restoring the cluster state. After the cluster state is restored successfully, you can enable the webhooks again.
`299`	`303`
	`304`	+Alternatively, you can temporarily set the `failurePolicy` to `Ignore` while restoring the cluster state. After the cluster state is restored successfully, you can set the `failurePolicy` to `Fail`.
	`305`	`+====`
	`306`	`++`
`300`	`307`	`.. Remove the northbound database (nbdb) and southbound database (sbdb). Access the recovery host and the remaining control plane nodes by using Secure Shell (SSH) and run the following command:`
`301`	`308`	`+`
`302`	`309`	`[source,terminal]`