[BUG] Helm upgrade failed: execution error at (rancher/templates/validate-psp-install.yaml:4:5): The target cluster does not have the PodSecurityPolicy API resource. Please disable PSPs in this chart before proceeding.

[timothystewart6]

Rancher Server Setup

• Rancher version: 2.7.3
• Installation option (Docker install/Helm Chart): Helm Chart
  • If Helm Chart, Kubernetes Cluster and version (RKE1, RKE2, k3s, EKS, etc):
• Proxy/Cert Details: Self Signed

Information about the Cluster

• Kubernetes version: k3s 1.25.9
• Cluster Type (Local/Downstream): local
  • If downstream, what type of cluster? (Custom/Imported or specify provider for Hosted/Infrastructure Provider):

User Information

• What is the role of the user logged in? (Admin/Cluster Owner/Cluster Member/Project Owner/Project Member/Custom)
  • If custom, define the set of permissions: Admin

Describe the bug

Rancher seemed to upgrade but I still get this error in the cluster logs:

Helm upgrade failed: execution error at (rancher/templates/validate-psp-install.yaml:4:5): The target cluster does not have the PodSecurityPolicy API resource. Please disable PSPs in this chart before proceeding. Last Helm logs: preparing upgrade for rancher resetting values to the chart's original version

This seems to be resolved in this issue #40331, however I still get the error when trying to run an upgrade.

To Reproduce

helm upgrade rancher rancher-stable/rancher --namespace cattle-system --set hostname=rancher.example.com --set rancherImageTag=v2.7.3

Result

Errors in logs

Helm upgrade failed: execution error at (rancher/templates/validate-psp-install.yaml:4:5): The target cluster does not have the PodSecurityPolicy API resource. Please disable PSPs in this chart before proceeding. Last Helm logs: preparing upgrade for rancher resetting values to the chart's original version

reconciliation failed: Helm upgrade failed: execution error at (rancher/templates/validate-psp-install.yaml:4:5): The target cluster does not have the PodSecurityPolicy API resource. Please disable PSPs in this chart before proceeding.

Expected Result

No errors in logs.

Screenshots

Additional context

I have also tried running this command (suggestion from comments) but I still see the same error in the logs

helm upgrade rancher rancher-stable/rancher --namespace cattle-system --set hostname=rancher.example.com --set rancherImageTag=v2.7.3 --set global.cattle.psp.enabled=false

[aretche]

For Kubernetes version >=1.25 you have to use

--set global.cattle.psp.enabled=false

https://ranchermanager.docs.rancher.com/getting-started/installation-and-upgrade/installation-references/helm-chart-options#advanced-options

[timothystewart6]

For Kubernetes version >=1.25 you have to use

--set global.cattle.psp.enabled=false

https://ranchermanager.docs.rancher.com/getting-started/installation-and-upgrade/installation-references/helm-chart-options#advanced-options

I did, and that was included in my issue above :)

[ApolloDS]

For Kubernetes version >=1.25 you have to use

--set global.cattle.psp.enabled=false

https://ranchermanager.docs.rancher.com/getting-started/installation-and-upgrade/installation-references/helm-chart-options#advanced-options

I just tried it and since I specified the option above the upgrade was working again from v2.7.2 to v2.7.3.
Thanks!

[diogoasouza]

Hi @timothystewart6 can you provide more information about your environment? I didn't manage to reproduce the issue

Which OS are you using?
How many nodes are in your cluster?
Was the issue on a clean k3s cluster or an existing one?
Your rancher 2.7.2 had psp enabled? If yes, I'm assuming you had rancher 2.7.2 installed in a k3s 1.24.x cluster before upgrading it to 1.25.9, right?
Did you install any charts through the apps marketplace before trying the upgrade?

[jcmontigny]

I did, and that was included in my issue above :)

Hello,

If this helps, I had the same issue and this worked fine, however I specified the option in a values.yaml file :

global:
  cattle:
    psp:
      enabled: false

Maybe retry your command using a file? (here I named it values.psp.yaml) :

helm upgrade rancher rancher-stable/rancher --namespace cattle-system --set hostname=rancher.example.com --set rancherImageTag=v2.7.3 -f values.psp.yaml