配置验证的问题
看似有效的配置不生效
手动验证您的配置是否正确,当有必要的时候请参照 Istio API 文档 。
接受无效配置
验证 istiod-istio-system
validationwebhookconfiguration
配置是否存在并且是正确的。无效的 apiVersion
、apiGroup
和 resource
配置应该在两个 webhook
其中之一被列举出来。
$ kubectl get validatingwebhookconfiguration istiod-istio-system -o yaml
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
creationTimestamp: "2020-01-24T19:53:03Z"
generation: 1
labels:
app: istiod
istio: istiod
release: istio
name: istiod-istio-system
ownerReferences:
- apiVersion: rbac.authorization.k8s.io/v1
blockOwnerDeletion: true
controller: true
kind: ClusterRole
name: istiod-istio-system
uid: c3d24917-c2da-49ad-add3-c91c14608a45
resourceVersion: "36649"
selfLink: /apis/admissionregistration.k8s.io/v1/validatingwebhookconfigurations/istiod-istio-system
uid: 043e39d9-377a-4a67-a7cf-7ae4cb3c562c
webhooks:
- admissionReviewVersions:
- v1beta1
clientConfig:
# caBundle should be non-empty. This is periodically (re)patched
# every second by the webhook service using the ca-cert
# from the mounted service account secret.
caBundle: LS0t...
service:
# service corresponds to the Kubernetes service that implements the
# webhook, e.g. istio-galley.istio-system.svc:443
name: istio-istiod
namespace: istio-system
path: /validate
port: 443
failurePolicy: Fail
matchPolicy: Exact
name: validation.istio.io
namespaceSelector: {}
objectSelector: {}
rules:
- apiGroups:
- config.istio.io
- rbac.istio.io
- security.istio.io
- authentication.istio.io
- networking.istio.io
apiVersions:
- '*'
operations:
- CREATE
- UPDATE
resources:
- '*'
scope: '*'
sideEffects: None
timeoutSeconds: 30
如果 validatingwebhookconfiguration
不存在,那就验证
istio-validation
configmap
是否存在。Istio 使用 configmap 的数据来创建或更新 validatingwebhookconfiguration
。
$ kubectl -n istio-system get configmap istio-validation -o jsonpath='{.data}'
map[config:apiVersion: admissionregistration.k8s.io/v1beta1
kind: ValidatingWebhookConfiguration
metadata:
name: istiod-istio-system
namespace: istio-system
labels:
app: istiod
release: istio
istio: istiod
webhooks:
- name: validation.istio.io
clientConfig:
service:
name: istiod
namespace: istio-system
path: "/validate"
port: 443
caBundle: ""
rules:
- operations:
- CREATE
- UPDATE
apiGroups:
- config.istio.io
- rbac.istio.io
- security.istio.io
- authentication.istio.io
- networking.istio.io
apiVersions:
- "*"
resources:
- "*"
failurePolicy: Fail
sideEffects: None]
(... snip ...)
如果 istio-validation
中的 webhook 数组为空,则校验 global.configValidation
安装选项是否被设置。
校验配置如果失败会自动关闭,正常情况下配置存在并校验通过,webhook 将被调用。在资源创建或更新的时候,如果缺失 caBundle
或者错误的证书,亦或网络连接问题都将会导致报错。如果你确信你的配置没有问题,webhook 没有被调用却看不到任何错误信息,你的集群配置肯定有问题。
创建配置失败报错:x509 certificate errors
x509: certificate signed by unknown authority
错误通常和 webhook 配置中的空 caBundle
有关,所以要确认它不为空 (请查阅验证 webhook 配置)。Istio 有意识的使用 istio-validation
configmap
和根证书,调整了 webhook 配置。
验证
istio-pilot
pod 是否在运行:$ kubectl -n istio-system get pod -lapp=pilot NAME READY STATUS RESTARTS AGE istio-pilot-5dbbbdb746-d676g 1/1 Running 0 2d
检查 pod 日志是否有错误,修复
caBundle
失败的时候会报错:$ for pod in $(kubectl -n istio-system get pod -lapp=pilot -o jsonpath='{.items[*].metadata.name}'); do \ kubectl -n istio-system logs ${pod} \ done
如果修复失败,请验证 Pilot 的 RBAC 配置:
$ kubectl get clusterrole istiod-istio-system -o yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole name: istiod-istio-system rules: - apiGroups: - admissionregistration.k8s.io resources: - validatingwebhookconfigurations verbs: - '*'
Istio 需要
validatingwebhookconfigurations
的写权限来创建和更新istio-galley validatingwebhookconfiguration
配置项。
创建配置报错:no such hosts
、no endpoints available
如果 istio-pilot
pod 没有准备就绪,配置是不会被创建或者更新的,在下面的例子里您可以看到关于 no endpoints available
的错误信息。
检查 istio-pilot
pod 是否运行,并且检查 endpoint 是否准备就绪。
$ kubectl -n istio-system get pod -lapp=pilot
NAME READY STATUS RESTARTS AGE
istio-pilot-5dbbbdb746-d676g 1/1 Running 0 2d
$ kubectl -n istio-system get endpoints istio-pilot
NAME ENDPOINTS AGE
istio-pilot 10.48.6.108:15014,10.48.6.108:443 3d
如果 pod 或者 endpoint 尚未准备就绪,请检查 pod log 和任何导致 webhook pod 无法启动的异常状态,以及服务流量。
$ for pod in $(kubectl -n istio-system get pod -lapp=pilot -o jsonpath='{.items[*].metadata.name}'); do \
kubectl -n istio-system logs ${pod} \
done
$ for pod in $(kubectl -n istio-system get pod -lapp=pilot -o name); do \
kubectl -n istio-system describe ${pod} \
done