While installing Prisma Cloud Defender, seeing older version being loaded with error message 'Unable to find image 'twistlock/private:defender_xx_xx_xxx' locally'

While installing Prisma Cloud Defender, seeing older version being loaded with error message 'Unable to find image 'twistlock/private:defender_xx_xx_xxx' locally'

5453
Created On 05/19/22 03:35 AM - Last Modified 06/17/22 03:51 AM


Symptom


 
  • While installing Defender using script, the output shows it is trying to pull older image version of Defender:
Loaded image: twistlock/private:defender_21_xx_xxx
Unable to find image 'twistlock/private:defender_20_0x_xxx' locally
Failed to create Twistlock data container
Failed to run twistlock.sh
  • Error message could show as below:WechatIMG208.jpeg
  • If any of the above errors matches, please check ConfigMap from the K8s cluster using the following command:
1$ kubectl -n twistlock get configmap twistlock-console -o yaml
  • Using command "grep" to check DOCKER_TWISTLOCK_TAG also shows older Defender version.


Environment


  • Prisma Cloud Compute Edition


Cause


Most Common Reasons for this error include:
  • The Configuration Manifest applied during the Console Upgrade was corrupted. Which leaves the DOCKER_TWISTLOCK_TAG as older version which will interrupt new version defender installation process.
  •  The Data was corrupted due to an error during the Console Upgrade Process. 


Resolution


  • Update the twistlock-console ConfigMap.
  • “twistlock.cfg:” field should be changed from ...DOCKER_TWISTLOCK_TAG=_20_xx_xxx\n" to ...DOCKER_TWISTLOCK_TAG=_21_xx_xxx\n" to contain the correct version.
  •  Make sure the Console pod is restarted to apply the changes.
  • The simplest way is to generate the full YAML with <PLATFORM>/twistcli console export kubernetes ... command, get the ConfigMap object from it, update the content of the “twistlock.cfg“ field and apply.
  • Post this, the Console can be restarted using the following command: 
    kubectl -n twistlock rollout restart deployment/twistlock-console
  • Other tools can also be leveraged to update the k8s workloads.
  • After the ConfigMap is updated and console is restarted, the installation should be able to succeed.


Additional Information




Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000sYc2CAE&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

Choose Language