kubernetes - 无法使用 minikube 设置 Istio

Question

我按照 Istio 的官方文档使用 minikube 为示例 bookinfo 应用程序设置了 Istio。但我收到了 无法连接到服务器:net/http: TLS 握手超时 错误。这些是我遵循的步骤(我安装了 kubectl 和 minikube)。

minikube start
curl -L https://git.io/getLatestIstio | sh -
cd istio-1.0.3
export PATH=$PWD/bin:$PATH
kubectl apply -f install/kubernetes/helm/istio/templates/crds.yaml
kubectl apply -f install/kubernetes/istio-demo-auth.yaml
kubectl get pods -n istio-system

这是我得到的终端输出

$ kubectl get pods -n istio-system
NAME                                      READY     STATUS              RESTARTS   AGE
grafana-9cfc9d4c9-xg7bh                   1/1       Running             0          4m
istio-citadel-6d7f9c545b-lwq8s            1/1       Running             0          3m
istio-cleanup-secrets-69hdj               0/1       Completed           0          4m
istio-egressgateway-75dbb8f95d-k6xj2      1/1       Running             0          4m
istio-galley-6d74549bb9-mdc97             0/1       ContainerCreating   0          4m
istio-grafana-post-install-xz9rk          0/1       Completed           0          4m
istio-ingressgateway-6bd4957bc-vhbct      1/1       Running             0          4m
istio-pilot-7f8c49bbd8-x6bmm              0/2       Pending             0          4m
istio-policy-6c65d8cff4-hx2c7             2/2       Running             0          4m
istio-security-post-install-gjfj2         0/1       Completed           0          4m
istio-sidecar-injector-74855c54b9-nnqgx   0/1       ContainerCreating   0          3m
istio-telemetry-65cdd46d6c-rqzfw          2/2       Running             0          4m
istio-tracing-ff94688bb-hgz4h             1/1       Running             0          3m
prometheus-f556886b8-chdxw                1/1       Running             0          4m
servicegraph-778f94d6f8-9xgw5             1/1       Running             0          3m

$kubectl describe pod istio-galley-6d74549bb9-mdc97
Error from server (NotFound): pods "istio-galley-5bf4d6b8f7-8s2z9" not found

pod 描述输出

 $ kubectl -n istio-system describe pod  istio-galley-6d74549bb9-mdc97
Name:           istio-galley-6d74549bb9-mdc97
Namespace:      istio-system
Node:           minikube/172.17.0.4
Start Time:     Sat, 03 Nov 2018 04:29:57 +0000
Labels:         istio=galley
                pod-template-hash=1690826493
Annotations:    scheduler.alpha.kubernetes.io/critical-pod=
                sidecar.istio.io/inject=false
Status:         Pending
IP:
Controlled By:  ReplicaSet/istio-galley-5bf4d6b8f7
Containers:
  validator:
    Container ID:
    Image:         gcr.io/istio-release/galley:1.0.0    Image ID:
    Ports:         443/TCP, 9093/TCP    Host Ports:    0/TCP, 0/TCP
    Command:      /usr/local/bin/galley
      validator      --deployment-namespace=istio-system
      --caCertFile=/etc/istio/certs/root-cert.pem
      --tlsCertFile=/etc/istio/certs/cert-chain.pem
      --tlsKeyFile=/etc/istio/certs/key.pem
      --healthCheckInterval=2s
      --healthCheckFile=/health
      --webhook-config-file
      /etc/istio/config/validatingwebhookconfiguration.yaml
    State:          Waiting
      Reason:       ContainerCreating
    Ready:          False
    Restart Count:  0
    Requests:
      cpu:        10m
    Liveness:     exec [/usr/local/bin/galley probe --probe-path=/health --interval=4s] delay=4s timeout=1s period=4s #success=1 #failure=3
    Readiness:    exec [/usr/local/bin/galley probe --probe-path=/health --interval=4s] delay=4s timeout=1s period=4s #success=1 #failure=3
    Environment:  <none>
    Mounts:
      /etc/istio/certs from certs (ro)
      /etc/istio/config from config (ro)
      /var/run/secrets/kubernetes.io/serviceaccount from istio-galley-service-account-token-9pcmv(ro)
Conditions:
  Type           Status
  Initialized    True
  Ready          False
  PodScheduled   True
Volumes:
  certs:
    Type:        Secret (a volume populated by a Secret)
    SecretName:  istio.istio-galley-service-account
    Optional:    false
  config:
    Type:      ConfigMap (a volume populated by a ConfigMap)
    Name:      istio-galley-configuration
    Optional:  false
  istio-galley-service-account-token-9pcmv:
    Type:        Secret (a volume populated by a Secret)
    SecretName:  istio-galley-service-account-token-9pcmv
    Optional:    false
QoS Class:       Burstable
Node-Selectors:  <none>
Tolerations:     node.kubernetes.io/not-ready:NoExecute for 300s
                 node.kubernetes.io/unreachable:NoExecute for 300s
Events:
  Type     Reason                 Age               From               Message
  ----     ------                 ----              ----               -------
  Normal   Scheduled              1m                default-scheduler  Successfully assigned istio-galley-5bf4d6b8f7-8t8qz to minikube
  Normal   SuccessfulMountVolume  1m                kubelet, minikube  MountVolume.SetUp succeeded for volume "config"
  Normal   SuccessfulMountVolume  1m                kubelet, minikube  MountVolume.SetUp succeeded for volume "istio-galley-service-account-token-9pcmv"
  Warning  FailedMount            27s (x7 over 1m)  kubelet, minikube  MountVolume.SetUp failed for volume "certs" : secrets "istio.istio-galley-service-account" not found

一段时间后 :-

 $ kubectl describe pod istio-galley-6d74549bb9-mdc97

Unable to connect to the server: net/http: TLS handshake timeout

所以我等待 istio-sidecar-injector 和 istio-galley 容器被创建。如果我再次运行 kubectl get pods -n istio-system 或任何其他 kubectl 命令给出 无法连接到服务器:net/http: TLS 握手超时 错误。

请帮我解决这个问题。
ps:我在 ubuntu 16.04 上运行 minikube

提前致谢。

Answer 1

看起来您遇到了 this和 this secret istio.istio-galley-service-account您的 istio-system 中缺少命名空间。您可以尝试解决方法 described :

Install as outlined in the docs: https://istio.io/docs/setup/kubernetes/minimal-install/ the missing secret is created by the citadel pod which isn't running due to the --set security.enabled=false flag, setting that to true starts citadel and the secret is created.