Configuration Validation Problems
Seemingly valid configuration is rejected
Manually verify your configuration is correct, cross-referencing Istio API reference1 when necessary.
Invalid configuration is accepted
Verify the istiod-istio-system
validationwebhookconfiguration
exists and
is correct. The apiVersion
, apiGroup
, and resource
of the
invalid configuration should be listed in one of the two webhooks
entries.
If the validatingwebhookconfiguration
doesn’t exist, verify the
istio-validation
configmap
exists. Istio uses
the data from this configmap to create and update the
validatingwebhookconfiguration
.
If the webhook array in istio-validation
is empty, verify
the global.configValidation
installation options are
set.
The validation configuration is fail-close. If
configuration exists and is scoped properly, the webhook will be
invoked. A missing caBundle
, bad certificate, or network connectivity
problem will produce an error message when the resource is
created/updated. If you don’t see any error message and the webhook
wasn’t invoked and the webhook configuration is valid, your cluster is
misconfigured.
Creating configuration fails with x509 certificate errors
x509: certificate signed by unknown authority
related errors are
typically caused by an empty caBundle
in the webhook
configuration. Verify that it is not empty (see verify webhook
configuration). Istio consciously reconciles webhook configuration
used the istio-validation
configmap
and root certificate.
Verify the
istiod
pod(s) are running:Check the pod logs for errors. Failing to patch the
caBundle
should print an error.If the patching failed, verify the RBAC configuration for Istiod:
Istio needs
validatingwebhookconfigurations
write access to create and update thevalidatingwebhookconfiguration
.
Creating configuration fails with no such hosts
or no endpoints available
errors
Validation is fail-close. If the istiod
pod is not ready,
configuration cannot be created and updated. In such cases you’ll see
an error about no endpoints available
.
Verify the istiod
pod(s) are running and endpoints are ready.
If the pods or endpoints aren’t ready, check the pod logs and status for any indication about why the webhook pod is failing to start and serve traffic.