调用 webhook“v1.vseldondeployment.kb.io”失败。 x509: 由未知机构签署的证书答案

【问题标题】：failed calling webhook "v1.vseldondeployment.kb.io". x509: certificate signed by unknown authority调用 webhook“v1.vseldondeployment.kb.io”失败。 x509: 由未知机构签署的证书
【发布时间】：2021-01-30 02:12:26
【问题描述】：

我正在尝试 Seldon Core 示例。

这里是 SeldonExampleDeployment.yaml。

apiVersion: machinelearning.seldon.io/v1
kind: SeldonDeployment
metadata:
  name: seldon-model
spec:
  name: test-deployment
  predictors:
  - componentSpecs:
    - spec:
        containers:
        - image: seldonio/mock_classifier_rest:1.3
          name: classifier
          command:
          - --kubelet-insecure-tls
          - --insecure-skip-tls-verify
    graph:
      children: []
      endpoint:
        type: REST
      name: classifier
      type: MODEL
    name: example
    replicas: 1

$ kubectl apply -n seldon -f SeldonExampleDeployment.yaml
Error from server (InternalError): error when creating "SeldonExampleDeployment.yaml": 
Internal error occurred: failed calling webhook "v1.vseldondeployment.kb.io": 
Post https://seldon-webhook-service.kubeflow.svc:443/validate-machinelearning-seldon-io-v1-seldondeployment?timeout=30s: 
x509: certificate signed by unknown authority

我使用 EKS
我刚刚打开了 VPC 中的所有流量（入站和出站）

我不知道为什么会发生这个错误。请帮帮我...

【问题讨论】：

标签： kubernetes kubeflow seldon

【解决方案1】：

旧案子，但至少可以帮助其他 Google 员工...

为避免该 webhook 部署失败，

首先创建 SeldonDeployment
然后在命名空间上启用干扰服务，
最后添加网关

# Create namespace and add a mock classifier REST service
MY_NS=a-namespace
kubectl create namespace $MY_NS
cat <<EOF | kubectl create -n $MY_NS -f -
apiVersion: machinelearning.seldon.io/v1
kind: SeldonDeployment
metadata:
  name: seldon-model
spec:
  name: test-deployment
  predictors:
  - componentSpecs:
    - spec:
        containers:
        - image: seldonio/mock_classifier_rest:1.3
          name: classifier
    graph:
      children: []
      endpoint:
        type: REST
      name: classifier
      type: MODEL
    name: example
    replicas: 1
EOF

# Enable interferenceservice namespace and add gateway
kubectl label namespace $MY_NS serving.kubeflow.org/inferenceservice=enabled
cat <<EOF | kubectl create -n $MY_NS -f -
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: kubeflow-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
  - hosts:
    - '*'
    port:
      name: http
      number: 80
      protocol: HTTP
EOF

# Test REST service
curl -s -d '{"data": {"ndarray":[[1.0, 2.0, 5.0]]}}'    -X POST http://localhost:8004/seldon/$MY_NS/seldon-model/api/v1.0/predictions    -H "Content-Type: application/json"

【讨论】：

仅在 SeldonDeployment 出现错误