Installing Velero with "restricted" PSA level

[jobartim44]

Hi,

I’m trying to install Velero with the “restricted” PSA level. However, it fails during the CRD upgrade with the following error:
"container has runAsNonRoot and image has non-numeric user (cnb), cannot verify user is non-root"

Is it possible to run Velero at the “restricted” level, or should I switch to the “baseline” level instead?

It seems that with the Helm installation, the CRD upgrade runs before the namespace labels are applied, which might be causing the issue.

Thanks,

[kaovilai]

We had addressed PSA in the past in #5871, but I don't think we have doc how to installed as restricted yet. It might be possible if you do not need file system backup or data mover.