istio 1.8.1 installed on aliyun ACK, use helm install skywalking, forbidden error in oap pod log

[wingying]

Please answer these questions before submitting your issue.

• Why do you submit this issue?
• Question or discussion
• Bug
• Requirement
• Feature or performance improvement

---

Question

• What do you want to know?
  I installed istio 1.8.1 in aliyun ACK kubernetes, just want to use skywalking, I used helm to install:

helm install skywalking skywalking/skywalking -n istio-system
--set oap.image.tag=8.0.1-es6
--set oap.storageType=elasticsearch
--set oap.env.SW_ENVOY_METRIC_ALS_HTTP_ANALYSIS=k8s-mesh
--set oap.env.envoy.als.enabled=true
--set ui.image.tag=8.0.1
--set elasticsearch.imageTag=6.8.6

It is installed successfully. However, in oap pod log shows:
2021-08-29 06:46:53,097 - org.apache.skywalking.oap.server.receiver.envoy.als.K8sALSServiceMeshHTTPAnalysis -4494000 [load-pod-0] ERROR [] - run load pod error
io.kubernetes.client.ApiException: Forbidden
at io.kubernetes.client.ApiClient.handleResponse(ApiClient.java:882) ~[client-java-api-4.0.0.jar:?]
at io.kubernetes.client.ApiClient.execute(ApiClient.java:798) ~[client-java-api-4.0.0.jar:?]
at io.kubernetes.client.apis.CoreV1Api.listPodForAllNamespacesWithHttpInfo(CoreV1Api.java:18795) ~[client-java-api-4.0.0.jar:?]
at io.kubernetes.client.apis.CoreV1Api.listPodForAllNamespaces(CoreV1Api.java:18773) ~[client-java-api-4.0.0.jar:?]
at org.apache.skywalking.oap.server.receiver.envoy.als.K8sALSServiceMeshHTTPAnalysis.loadPodInfo(K8sALSServiceMeshHTTPAnalysis.java:101) ~[envoy-metrics-receiver-plugin-8.0.1.jar:8.0.1]
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) [?:1.8.0_212]
at java.util.concurrent.FutureTask.runAndReset(FutureTask.java:308) [?:1.8.0_212]
at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$301(ScheduledThreadPoolExecutor.java:180) [?:1.8.0_212]
at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:294) [?:1.8.0_212]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_212]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_212]
at java.lang.Thread.run(Thread.java:748) [?:1.8.0_212]

Nothing display in skywalking UI.

[wu-sheng]

@wingying Actually, this is forbidden by K8s API server, which SkyWalking requires.

I can see how we install sw on the minikube and run test,

skywalking/.github/workflows/e2e.istio.yaml

Lines 83 to 106 in 0ab10ab

	- name: Install SkyWalking
	if: env.SKIP_CI != 'true'
	run: |
	git clone https://github.com/apache/skywalking-kubernetes.git
	cd skywalking-kubernetes
	git reset --hard $SW_KUBERNETES_COMMIT_SHA
	cd chart
	mkdir -p skywalking/files/conf.d/oap/ && cp ../../test/e2e/e2e-test/src/test/resources/metadata-service-mapping.yaml skywalking/files/conf.d/oap/metadata-service-mapping.yaml
	helm dep up skywalking
	helm -n istio-system install skywalking skywalking \
	--set fullnameOverride=skywalking \
	--set elasticsearch.replicas=1 \
	--set elasticsearch.minimumMasterNodes=1 \
	--set elasticsearch.imageTag=7.5.1 \
	--set oap.env.SW_ENVOY_METRIC_ALS_HTTP_ANALYSIS=${{ matrix.analyzer }} \
	--set oap.env.SW_ENVOY_METRIC_ALS_TCP_ANALYSIS=${{ matrix.analyzer }} \
	--set oap.env.K8S_SERVICE_NAME_RULE='e2e::${service.metadata.name}' \
	--set oap.envoy.als.enabled=true \
	--set oap.replicas=1 \
	--set ui.image.repository=skywalking/ui \
	--set ui.image.tag=$TAG \
	--set oap.image.tag=$TAG \
	--set oap.image.repository=skywalking/oap \
	--set oap.storageType=elasticsearch7

Any further question about aliyun ACK is their responsibility.

[kezhenxu94]

OAP 8.0.1 seems to be a too old version, please consider using a newer version (the latest version now is 8.7.0).

[wingying]

@kezhenxu94 nice! use 8.7.0 that fix the issue