no matches for kind "K8sPSPAllowPrivilegeEscalationContainer" in version "constraints.gatekeeper.sh/v1beta1"

[momalik11]

I was able to deploy this constraint before, but today I am getting this weird message. I tried with v1alpha1 and v1 version as well for both template and constraint, but still getting the same error. I am using release v3.1.0-rc.1.

[brycecr]

Hi momalik11,

Thanks for the message!

A few things that might help understand this issue:

• What are you doing when you encounter this error? Are you applying the Constraint and ConstraintTemplate in the same kubectl apply operation or separately?
• What is the status of the gatekeeper pods in your cluster? I.e. what is the result of kubectl get pods -n gatekeeper system ?
• What is the result of kubectl get ConstraintTemplate k8spspallowprivilegeescalationcontainer -oyaml?

[exploremani]

Hi - I am having the same issue. But yes I am trying to apply both the constraint and template in a same kubectl apply. I am using kustomize to apply
kustomize build ./templates/psp --reorder none | kubectl apply -f -
Is there a known issue with applying in the same kubectl apply?

[maxsmythe]

There shouldn't be an issue installing multiple templates at the same time.

Can you copy/paste the output of the command so we can see what error you're getting?

[shomron]

Trying to read between the lines - there is a slight delay between the time you apply a ConstraintTemplate and the time its corresponding Constraint CRD is registered. Even if the order is correct in your kustomize command, there is a good chance it would fail applying the constraint within that time window.

[exploremani]

Thanks @shomron. I had the exact issue. When I applied them through my ansible, the constraint keeps failing as the CRD thru template is not registered. This is very unusual as I have worked on other CRD's and never faced such issue. Initially kustomize ordering was an issue. But I used --reorder none to allow the template go first before the constraint. But still no luck. The only way I worked out was applied the template set first and gave a pause of one second and applied the constraint. Found this a little strange though

[maxsmythe]

Sorry, I missed that you were mixing constraints and templates.

My guess is that because constraint templates are not themselves CRDs, but are instead a precursor object for CRDs, there is a longer delay before the CRDs are available. This is because instead of just needing the CRD controller to do its thing, the Constraint Template controller must perform its reconciliation, and then the CRD controller must also do so.

[stale]

This issue/PR has been automatically marked as stale because it has not had recent activity. It will be closed in 14 days if no further activity occurs. Thank you for your contributions.