Update automatic sidecar injection prerequisites for k8s 1.9 (AWS/Kops)

[ayj]

https://istio.io/docs/setup/kubernetes/sidecar-injection.html#prerequisites for AWS/Kops need to be updated for k8s 1.9 to enable support for mutating webhooks.

$ kubectl api-versions | grep admissionregistration.k8s.io/v1beta1
admissionregistration.k8s.io/v1beta1

See https://archive.istio.io/v0.4/docs/setup/kubernetes/sidecar-injection#prerequisites for previous 0.4.0 doc version.

[ayj]

@jsenon, looks like you added the original aws/kops steps. Would you be able to update them for k8s 1.9 with admissionregistration.k8s.io/v1beta1 and MutatingWebhook plugin enabled?

[jsenon]

@ayj sure. I will do

[mailtovivek87]

is there any existing document that we can use for setting up automatic sidecar injection with AWS/Kops and K8 1.9 ?

[jsenon]

AFAIK no, but I will try to document it

…

On 9 Feb 2018, at 8:13 AM, mailtovivek87 ***@***.***> wrote: is there any existing document that we can use for setting up automatic sidecar injection with AWS/Kops and K8 1.9 ? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or mute the thread.

[mailtovivek87]

Thanks ..

[jsenon]

admissionregistration.k8s.io/v1beta1 is already configured with admission control when you deploy kubernetes 1.9.2 with kops:

--admission-control=Initializers,NamespaceLifecycle,LimitRanger,ServiceAccount,PersistentVolumeLabel,DefaultStorageClass,DefaultTolerationSeconds,NodeRestriction,Priority,ResourceQuota

Missing MutatingAdmissionWebhook,ValidatingAdmissionWebhook

Just notice that script install/kubernetes/webhook-create-signed-cert.sh to launch create CA is not in the repo when perform curl -L https://git.io/getLatestIstio | sh - referenced with issue #959

[jsenon]

I've submit PR #958 for AWS automatic sidecar injection with aws using kops utility

[mailtovivek87]

@jsenon @ayj I have installed Kubectl 1.9 using KOPS 1.8 with below comands :

export KUBERNETES_VERSION=${KUBERNETES_VERSION:-https://storage.googleapis.com/kubernetes-release/release/v1.9.0/}

kops create cluster --cloud=aws --zones=ap-southeast-1a --name=kops.example.com --network-cidr=192.168.0.0/16 --dns-zone=example.com --master-zones=ap-southeast-1a --zones=ap-southeast-1a --master-size=t2.medium --node-size=t2.medium --node-count=1 --kubernetes-version $KUBERNETES_VERSION --yes

Which worked perfectly. After which I did steps mentioned in docs https://istio.io/docs/setup/kubernetes/sidecar-injection.html#aws-with-kops
After kops rolling-update cluster --yes, nodes are coming up but kubectl get nodes and kops get cluster is showing nodes as not ready.
Am I missing something here?

[jsenon]

Hi @mailtovivek87, could you try with kubernetes version 1.9.2? find my kops create used for the docs:

kops create cluster  \
  --node-count 1 \
  --zones eu-central-1a \
  --master-zones eu-central-1a \
  --dns-zone=xxx \
  --node-size t2.medium \
  --master-size t2.small  \
  --topology private \
  --vpc=vpc-xxx \
  --networking flannel \
  --bastion  \
  --kubernetes-version=1.9.2 \
  --name=k8s-test.cloud \
  --cloud-labels "Contact=julien.senon" \
  --ssh-public-key ~/.ssh/mykey

[mailtovivek87]

Sure. Just want to confirm that after kops create cluster command, i can directly follow the steps mentioned https://istio.io/docs/setup/kubernetes/sidecar-injection.html#aws-with-kops, nothing in between. Right ?

[jsenon]

Indeed, just notice that I don't I've launch with kops create --yes

[mailtovivek87]

Oh, so you didn't launched cluster. Just created a config first, updated it and then rolled out update to create cluster with updated settings.

[jsenon]

indeed. I will try with:

1. Create cluster
2. Apply configuration
3. Edit Cluster
4. Rolling Update cluster

[jsenon]

I was not able to reproduce your issue, with steps mention earlier

[mailtovivek87]

Still not able to apply changes. Steps i followed :

• kops create cluster (KOPS 1.8 with Kubernetes 1.9.2)
• kops edit cluster
• kops update cluster --yes
• kops rolling-update cluster --yes

After last step, KOPS launch new masters and nodes but only etcd R53 entry is updated and entries like api.example.com and api.internal.example.com still points to old ones (waited 30 min after rolling step). On manually updating api ip, nodes status shows Ready but master as Not Ready.

[jsenon]

Perhaps have a look on Kubectl logs on master. AFAIK seems not an issue with istio but i can help you.

[mailtovivek87]

My bad, I missed out few admission controllers from the list and after adding those it worked perfectly for me.
Thanks @jsenon

[jsenon]

Cool 👍 ! Thanks for this update