istio 无法安装在通过 AWS 中的 Kops 构建的 Kubernetes 集群中

Question

我无法让演示配置文件与 istioctl 一起使用。似乎 istioctl 在创建 IngressGateway 和 AddonComponents 时遇到了问题。我试过用类似的问题进行 helm 安装。我从 kops 做了一个新的 k8s 集群和同样的问题。任何调试此问题的帮助将不胜感激。

我正在遵循这些说明。 https://istio.io/docs/setup/getting-started/#download

我在跑步

 istioctl manifest apply --set profile=demo --logtostderr

这是输出

2020-04-06T19:59:24.951136Z info    Detected that your cluster does not support third party JWT authentication. Falling back to less secure first party JWT. See https://istio.io/docs/ops/best-practices/security/#configure-third-party-service-account-tokens for details.
- Applying manifest for component Base...
✔ Finished applying manifest for component Base.
- Applying manifest for component Pilot...
✔ Finished applying manifest for component Pilot.
- Applying manifest for component IngressGateways...
- Applying manifest for component EgressGateways...
- Applying manifest for component AddonComponents...
✔ Finished applying manifest for component EgressGateways.
2020-04-06T20:00:11.501795Z error   installer   error running kubectl: exit status 1
✘ Finished applying manifest for component AddonComponents.
2020-04-06T20:00:40.418396Z error   installer   error running kubectl: exit status 1
✘ Finished applying manifest for component IngressGateways.
2020-04-06T20:00:40.421746Z info    
Component AddonComponents - manifest apply returned the following errors:
2020-04-06T20:00:40.421823Z info    Error: error running kubectl: exit status 1

2020-04-06T20:00:40.421884Z info    Error detail:


Error from server (Timeout): error when creating "STDIN": Timeout: request did not complete within requested timeout 30s (repeated 1 times)


clusterrole.rbac.authorization.k8s.io/kiali unchanged
clusterrole.rbac.authorization.k8s.io/kiali-viewer unchanged
clusterrole.rbac.authorization.k8s.io/prometheus-istio-system unchanged
clusterrolebinding.rbac.authorization.k8s.io/kiali unchanged
clusterrolebinding.rbac.authorization.k8s.io/prometheus-istio-system unchanged

serviceaccount/kiali-service-account unchanged
serviceaccount/prometheus unchanged
configmap/istio-grafana unchanged
configmap/istio-grafana-configuration-dashboards-citadel-dashboard unchanged
configmap/istio-grafana-configuration-dashboards-galley-dashboard unchanged
configmap/istio-grafana-configuration-dashboards-istio-mesh-dashboard unchanged
configmap/istio-grafana-configuration-dashboards-istio-performance-dashboard unchanged
configmap/istio-grafana-configuration-dashboards-istio-service-dashboard unchanged
configmap/istio-grafana-configuration-dashboards-istio-workload-dashboard unchanged
configmap/istio-grafana-configuration-dashboards-mixer-dashboard unchanged
configmap/istio-grafana-configuration-dashboards-pilot-dashboard unchanged
configmap/kiali configured
configmap/prometheus unchanged
secret/kiali unchanged
deployment.apps/grafana unchanged
deployment.apps/istio-tracing unchanged
deployment.apps/kiali unchanged
deployment.apps/prometheus unchanged
service/grafana unchanged
service/jaeger-agent unchanged
service/jaeger-collector unchanged
service/jaeger-collector-headless unchanged
service/jaeger-query unchanged
service/kiali unchanged
service/prometheus unchanged
service/tracing unchanged
service/zipkin unchanged


2020-04-06T20:00:40.421999Z info    
Component IngressGateways - manifest apply returned the following errors:
2020-04-06T20:00:40.422056Z info    Error: error running kubectl: exit status 1

2020-04-06T20:00:40.422096Z info    Error detail:

Error from server (Timeout): error when creating "STDIN": Timeout: request did not complete within requested timeout 30s (repeated 2 times)


serviceaccount/istio-ingressgateway-service-account unchanged
deployment.apps/istio-ingressgateway configured
poddisruptionbudget.policy/ingressgateway unchanged
role.rbac.authorization.k8s.io/istio-ingressgateway-sds unchanged
rolebinding.rbac.authorization.k8s.io/istio-ingressgateway-sds unchanged
service/istio-ingressgateway unchanged


2020-04-06T20:00:40.422134Z info    

✘ Errors were logged during apply operation. Please check component installation logs above.

Error: failed to apply manifests: errors were logged during apply operation

在运行上述命令之前，我运行了以下命令来验证安装。

istioctl verify-install

Checking the cluster to make sure it is ready for Istio installation...

#1. Kubernetes-api
-----------------------
Can initialize the Kubernetes client.
Can query the Kubernetes API Server.

#2. Kubernetes-version
-----------------------
Istio is compatible with Kubernetes: v1.16.7.

#3. Istio-existence
-----------------------
Istio will be installed in the istio-system namespace.

#4. Kubernetes-setup
-----------------------
Can create necessary Kubernetes configurations: Namespace,ClusterRole,ClusterRoleBinding,CustomResourceDefinition,Role,ServiceAccount,Service,Deployments,ConfigMap. 

#5. SideCar-Injector
-----------------------
This Kubernetes cluster supports automatic sidecar injection. To enable automatic sidecar injection see https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/#deploying-an-app

Answer 1

如您的日志中所述

2020-04-06T19:59:24.951136Z info 检测到您的集群不支持第三方 JWT 身份验证。退回到安全性较低的第一方 JWT。

---

如上所述here

要确定您的集群是否支持第三方令牌，请查找 TokenRequest API：

$ kubectl get --raw /api/v1 | jq '.resources[] | select(.name | index("serviceaccounts/token"))'
{
    "name": "serviceaccounts/token",
    "singularName": "",
    "namespaced": true,
    "group": "authentication.k8s.io",
    "version": "v1",
    "kind": "TokenRequest",
    "verbs": [
        "create"
    ]
}

虽然现在大多数云提供商都支持此功能，但许多本地开发工具和自定义安装可能不支持。要启用此功能，请参阅Kubernetes documentation。

---

为了通过 Istio 控制平面进行身份验证，Istio 代理将使用服务帐户令牌。 Kubernetes 支持这些令牌的两种形式：

第三方令牌，具有范围受众和有效期。 第一方令牌，没有过期并安装到所有 pod 中。 由于第一方令牌的属性不太安全，Istio 将默认使用第三方令牌。但是，并非所有 Kubernetes 平台都启用此功能。

如果您使用 istioctl 安装，将自动检测支持。这也可以手动完成，并通过传递 --set values.global.jwtPolicy=third-party-jwt 或 --set values.global 进行配置.jwtPolicy=first-party-jwt.

---

如果这不起作用，我会打开一个新的 github 问题，或添加评论 here，因为安装问题类似。