Error with cluster Restore

[Abhiger]

Hi All,

Cluster: error restoring mutatingwebhookconfigurations.admissionregistration.k8s.io/aks-webhook-admission-controller: MutatingWebhookConfiguration.admissionregistration.k8s.io "aks-webhook-admission-controller" is invalid: webhooks[0].sideEffects: Unsupported value: "Unknown": supported values: "None", "NoneOnDryRun"
Namespaces:

While restoring an AKS cluster I get the following error
Cluster: error restoring mutatingwebhookconfigurations.admissionregistration.k8s.io/aks-webhook-admission-controller: MutatingWebhookConfiguration.admissionregistration.k8s.io "aks-webhook-admission-controller" is invalid: webhooks[0].sideEffects: Unsupported value: "Unknown": supported values: "Namespaces:

Will Velero restore not work if the SideEffects Key is set to "UnKnown" ?
Do we have to explicitly set the value to "None" or "NoneOnDryRun" ?

[nrb]

@Abhiger Velero doesn't modify the webhook properties that get backed up. This is due to AKS having support only for 2 values on its webhook side effect field, as shown in the error message.

Were you migrating between versions of AKS? That may have introduced this new constraint.

[HizzyCO]

I have this same error and haven't migrated version. @nrb wnat info do you need to help resolve this?

[taisyo7333]

I have the same issue.
My environment is the following.

Environment

• Velero v1.5.2
• Amazon EKS v1.18.9-eks-d1db3
• Chart v2.14.1
• Helm v3.4.2

Log

{"level":"info","logSource":"pkg/restore/restore.go:1170","msg":"error restoring pod-identity-webhook: MutatingWebhookConfiguration.admissionregistration.k8s.io \"pod-identity-webhook\" is invalid: webhooks[0].sideEffects: Unsupported value: \"Unknown\": supported values: \"None\", \"NoneOnDryRun\"","restore":"velero/velero-backup-20201224075249-20201224173831","time":"2020-12-24T08:39:14Z"}

Describe -> Errors

Errors:
  Velero:     <none>
  Cluster:  error restoring mutatingwebhookconfigurations.admissionregistration.k8s.io/pod-identity-webhook: MutatingWebhookConfiguration.admissionregistration.k8s.io "pod-identity-webhook" is invalid: webhooks[0].sideEffects: Unsupported value: "Unknown": supported values: "None", "NoneOnDryRun"
  Namespaces: <none>

Work around

The work around I did is the below.

velero restore create --from-schedule velero-backup  --exclude-resources MutatingWebhookConfiguration.admissionregistration.k8s.io

[MRostanski]

This is clearly a bad workaround to omit the objects that cause trouble when restoring. What about migration to the other cluster? Will those mutatingwebhookconfigurations be missing?

[johannesfrey]

FYI: There is also an open issue regarding this.