How to solve a rancher upgrade failure due to PSP

This document (000021582) is provided subject to the disclaimer at the end of this document.

Environment

Rancher 2.7.x
Kubernetes +1.25.x

Situation

A helm upgrade command to upgrade Rancher failed with the below message

Error: UPGRADE FAILED: execution error at (rancher/templates/validate-psp-install.yaml:4:5): The target cluster does not have the PodSecurityPolicy API resource. Please disable PSPs in this chart before proceeding.

Resolution

We need to disable PSP in this chart by adding --set global.cattle.psp.enabled=false to the helm upgrade command [1]

Cause

Rancher has the PSP enabled by default, however, as it has been deprecated in favor of PSA for Kubernetes +1.25.x this should now be disabled. For Rancher +2.7.5 there is an attempt to detect if PSP should be enabled or not [2]

Additional Information

References:
[1] https://github.com/rancher/rancher/issues/41295
[2] https://ranchermanager.docs.rancher.com/getting-started/installation-and-upgrade/installation-references/helm-chart-options#advanced-options

Disclaimer

This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.