[Question] Azure Policy blocking AKS Run Command #4769
Comments
|
Hi @k-cogswell - here's details on why the run command is affected by Policy and how you can exempt the namespace from Policy - run command docs. More of an overview of what Azure Policies can be applied to AKS can be found on the AKS docs on Policy. |
|
@k-cogswell It may be a different policy than k8sazurecustomcontainerallowedimages blocking the run command. If you run |
microsoft-github-policy-service
bot
added
Needs Attention 👋
@anlandu , thanks for your reply! The output is quite large - is there any one of these that you may think is the culprit? |
|
@k-cogswell I'm guessing it's k8sazurev2containerallowedimages but to be sure, you can send me your cluster's resource ID and a timestamp of an attempt, and I'll take a look at the logs |
microsoft-github-policy-service
bot
removed
the
Needs Attention 👋
@anlandu here is the resource id and timestamp of my latest attempt:
Thank you for your help with this |
|
@k-cogswell looks like there are several constraints that blocked the command: You may also need an exemption on You can look at each constraint's annotation to see the assignment ID for each, then visit that assignment ID in portal to create a temporary exemption or permanent ns/labelSelector-based exclusion depending on your needs. |
|
Note that the Azure docs linked above are for excluding the initial command passthrough, which gets run in aks-command namespace, however the pod running the command and potentially getting blocked after the first command goes through will be in the default namespace. Will start a thread internally about our docs and improving error message passthrough. |
|
Thank you @anlandu , do you happen to have the name of the image that is being used for the pod in the If I can, I would prefer to create an exemption for that specific image vs an exemption for the entire namespace. |
|
That depends on the command you're trying to run, I just assumed because I saw an nginx 403 earlier in the logs that the command would involve creating an nginx pod. @k-cogswell |
microsoft-github-policy-service
bot
added
the
Needs Attention 👋
|
@k-cogswell I've merged a fix to the error message to have it pass through the list of failures from Gatekeeper, for easier debugging. It should go out in the next release after 20250220 https://releases.aks.azure.com/ Will add a backlog item to make the pod in the aks-command namespace PSS compliant, as well. Thanks for raising this! |
microsoft-github-policy-service
bot
removed
the
Needs Attention 👋
|
Action required from @aritraghosh, @julia-yin, @AllenWen-at-Azure |
microsoft-github-policy-service
bot
added
the
Needs Attention 👋
|
Issue needing attention of @Azure/aks-leads |
|
This issue has been automatically marked as stale because it has not had any activity for 14 days. It will be closed if no further activity occurs within 7 days of this comment. |
I'm trying to use the Run Command feature in my AKS cluster but I get the following message:
I tried to run the command it suggests:
but I get a message that this resource type doesn't exist
I thought maybe there was a typo in the suggestion and tried:
but the template was not found.
Question
Is there any other way for me to find which policy is blocking me from using Run Command?
The text was updated successfully, but these errors were encountered: