Error while deploying the service

Question

While deploying new ABC-alert service in prod, we are getting the below error.

 

Message:             Error creating: admission webhook "validation.gatekeeper.sh" denied the request: [azurepolicy-k8sazurev2containerallowedimag-3770e19106c2b08cb480] Container image acrinfdv1001.azurecr.io/ABC-alert-batch:433479 for container ABC-alert-batch has not been allowed.
[azurepolicy-k8sazurev2containerallowedimag-a89c4b5bb210c859536c] Container image acrinfdv1001.azurecr.io/epac-alert-batch:433479 for container ABC-alert-batch has not been allowed.

Answer 1

@37821879,

It seems Azure Policy has been enabled on your subscription, more precisely there seems to be a policy azurepolicy-k8sazurev2containerallowedimag-3770e19106c2b08cb480 which is not allowing you to use that image from the registry. When you enable the policy those validation admission webhooks gets deployed & does the work behind the scenes (of allowing/ not allowing)

You might have to review that policy and speak to the Administrator who ever has created, you should be able to see the definition of that policy which will be like a JSON file - validate the conditions.

https://learn.microsoft.com/en-us/azure/aks/use-azure-policy

You can disable the policy if you have permissions:

https://learn.microsoft.com/en-us/azure/aks/use-azure-policy#disable-a-policy-or-initiative

Or you can disable the policy add on:

https://learn.microsoft.com/en-us/azure/governance/policy/concepts/policy-for-kubernetes#remove-the-add-on-from-aks

sometimes you can create an exemption for a particular resource group :

https://learn.microsoft.com/en-us/azure/governance/policy/concepts/exemption-structure

Regards,

Shiva.