Istio 自動注入 sidecar 失敗導致無法訪問webhook服務的解決方法

更新時間：2023年10月26日 10:37:21 作者：張志翔的博客

最近工作中在部署Istio環(huán)境的過程中發(fā)現(xiàn)官方示例啟動的pod不能訪問不到Istio的webhook,這個問題也是困擾了我一天,我把他歸類到sidecar注入失敗的情況下,本文給大家分享問題解決方法,感興趣的朋友跟隨小編一起看看吧

1、第一種可能（我遇到的情況）

如果自動注入時，報如下錯誤信息：

Error from server (InternalError): error when creating "STDIN": Internal error occurred: failed calling webhook "rev.validation.istio.io": failed to call webhook: Post "https://istiod.istio-system.svc:443/validate?timeout=10s": dial tcp 10.101.106.199:443: i/o timeout

造成上述問題的原因是 kube-apiserver 的 --enable-admission-plugins 沒有配置 MutatingAdmissionWebhook,ValidatingAdmissionWebhook參數(shù)，所以解決問題的方法就是找到 kube-apiserver.yaml 配置文件，我是通過kubeadm安裝的，所以路徑在 /etc/kubernetes/manifests 下，把 --enable-admission-plugins 修改為 NodeRestriction,MutatingAdmissionWebhook,ValidatingAdmissionWebhook 后保存文件，刪掉 kube-apiserver 的pod，讓他自己根據(jù)新的配置文件重新啟動（注意：如果是用kubeadm安裝的修改內(nèi)容如果錯誤，可能會導致k8s集群中的kube-apiserver全部掛掉，導致無法訪問集群，這時就需要從官網(wǎng)下載kube-apiserver二進制文件，重新拉起一個進程，再執(zhí)行刪除pod的操作），修改后文件內(nèi)容如下：

apiVersion: v1
kind: Pod
metadata:
  annotations:
    kubeadm.kubernetes.io/kube-apiserver.advertise-address.endpoint: 192.168.1.61:6443
  creationTimestamp: null
  labels:
    component: kube-apiserver
    tier: control-plane
  name: kube-apiserver
  namespace: kube-system
spec:
  containers:
  - command:
    - kube-apiserver
    - --advertise-address=192.168.1.61
    - --allow-privileged=true
    - --authorization-mode=Node,RBAC
    - --client-ca-file=/etc/kubernetes/pki/ca.crt
    - --enable-admission-plugins=NodeRestriction,MutatingAdmissionWebhook,ValidatingAdmissionWebhook
    - --enable-bootstrap-token-auth=true
    - --etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt
    - --etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt
    - --etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key
    - --etcd-servers=https://127.0.0.1:2379
    - --kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt
    - --kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key
    - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
    - --proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.crt
    - --proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client.key
    - --requestheader-allowed-names=front-proxy-client
    - --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt
    - --requestheader-extra-headers-prefix=X-Remote-Extra-
    - --requestheader-group-headers=X-Remote-Group
    - --requestheader-username-headers=X-Remote-User
    - --secure-port=6443
    - --service-account-issuer=https://kubernetes.default.svc.cluster.local
    - --service-account-key-file=/etc/kubernetes/pki/sa.pub
    - --service-account-signing-key-file=/etc/kubernetes/pki/sa.key
    - --service-cluster-ip-range=10.96.0.0/12
    - --tls-cert-file=/etc/kubernetes/pki/apiserver.crt
    - --tls-private-key-file=/etc/kubernetes/pki/apiserver.key
    - --feature-gates=RemoveSelfLink=false
    image: registry.aliyuncs.com/google_containers/kube-apiserver:v1.23.0
    imagePullPolicy: IfNotPresent
    livenessProbe:
      failureThreshold: 8
      httpGet:
        host: 192.168.1.61
        path: /livez
        port: 6443
        scheme: HTTPS
      initialDelaySeconds: 10
      periodSeconds: 10
      timeoutSeconds: 15
    name: kube-apiserver
    readinessProbe:
      failureThreshold: 3
      httpGet:
        host: 192.168.1.61
        path: /readyz
        port: 6443
        scheme: HTTPS
      periodSeconds: 1
      timeoutSeconds: 15
    resources:
      requests:
        cpu: 250m
    startupProbe:
      failureThreshold: 24
      httpGet:
        host: 192.168.1.61
        path: /livez
        port: 6443
        scheme: HTTPS
      initialDelaySeconds: 10
      periodSeconds: 10
      timeoutSeconds: 15
    volumeMounts:
    - mountPath: /etc/ssl/certs
      name: ca-certs
      readOnly: true
    - mountPath: /etc/pki
      name: etc-pki
      readOnly: true
    - mountPath: /etc/kubernetes/pki
      name: k8s-certs
      readOnly: true
  hostNetwork: true
  priorityClassName: system-node-critical
  securityContext:
    seccompProfile:
      type: RuntimeDefault
  volumes:
  - hostPath:
      path: /etc/ssl/certs
      type: DirectoryOrCreate
    name: ca-certs
  - hostPath:
      path: /etc/pki
      type: DirectoryOrCreate
    name: etc-pki
  - hostPath:
      path: /etc/kubernetes/pki
      type: DirectoryOrCreate
    name: k8s-certs
status: {}

2、第二種可能

安裝 Istio 時，配置了 enableNamespacesByDefault: false

sidecarInjectorWebhook:
  enabled: true
  # 變量為true，就會為所有命名空間開啟自動注入功能。如果賦值為false，則只有標簽為istio-injection的命名空間才會開啟自動注入功能
  enableNamespacesByDefault: false
  rewriteAppHTTPProbe: false

解決方法：

# 設置標簽
$ kubectl label namespace default istio-injection=enabled --overwrite
# 查看
$ kubectl get namespace -L istio-injection
NAME                   STATUS   AGE    ISTIO-INJECTION
default                Active   374d   enabled

如果要重新禁用注入istio sidecar，執(zhí)行下面命令：

$ kubectl label namespace default istio-injection=disabled --overwrite

3、第三種可能

安裝 Istio 時，設置 autoInject: disabled

proxy:
  includeIPRanges: 192.168.16.0/20,192.168.32.0/20
  # 是否開啟自動注入功能，取值enabled則該pods只要沒有被注解為sidecar.istio.io/inject: "false",就會自動注入。如果取值為disabled，則需要為pod設置注解sidecar.istio.io/inject: "true"才會進行注入
  autoInject: disabled

解決方法：