Cause:
Azure is recommending users to leverage Storage Accounts v2 instead of v1.
Consequence:
Under certain security profiles administrators can force Azure to not accept Storage Accounts v1 creation. As registry depends on v1 storage accounts a cluster install would fail in such environments.
Fix:
During cluster bootstrap the Operator now attempts to create and use V2 Storage Accounts. Clusters running on v1 will remain using V1.
Result:
Installation succeeds and Image Registry now reports Available.
DescriptionMangirdas Judeikis
2021-02-17 11:35:03 UTC
Description of problem:
Currently registry is using V1 StorageAccounts for Azure registry storage.
V1 is considered legacy and is being blocked by some customers with azure policy.
ARO started to notice failed clusters installs due to existence of this policy.
Version-Release number of selected component (if applicable):
master
How reproducible:
1. Enable Azure policy to prevent v1 storage account usage
2. Install cluster
3. Fail
1. Code change required to start using V2 for new installs:
storage.AccountCreateParameters{
Kind: storage.StorageV2,
2. Existing accounts needs to be upgraded to v2 by image registry operator
(https://docs.microsoft.com/en-us/azure/storage/common/storage-account-upgrade?tabs=azure-cli)
This will require backport to 4.6
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory (Moderate: OpenShift Container Platform 4.8.2 bug fix and security update), and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://access.redhat.com/errata/RHSA-2021:2438
Description of problem: Currently registry is using V1 StorageAccounts for Azure registry storage. V1 is considered legacy and is being blocked by some customers with azure policy. ARO started to notice failed clusters installs due to existence of this policy. Version-Release number of selected component (if applicable): master How reproducible: 1. Enable Azure policy to prevent v1 storage account usage 2. Install cluster 3. Fail 1. Code change required to start using V2 for new installs: storage.AccountCreateParameters{ Kind: storage.StorageV2, 2. Existing accounts needs to be upgraded to v2 by image registry operator (https://docs.microsoft.com/en-us/azure/storage/common/storage-account-upgrade?tabs=azure-cli) This will require backport to 4.6