Join GitHub today
GitHub is home to over 40 million developers working together to host and review code, manage projects, and build software together.
Sign upIstio debian release 1.4.2 is broken #19615
Comments
This comment has been minimized.
This comment has been minimized.
|
In the current master branch this was fixed. But the debian package still uses the iptables script and just copies it without the |
This comment has been minimized.
This comment has been minimized.
|
It was actually intended to still be using the shell script but without the |
This comment has been minimized.
This comment has been minimized.
|
That sounds reasonable, so an easy fix for 1.4.2 will be: sudo ln -s /usr/local/bin/istio-clean-iptables.sh /usr/local/bin/istio-clean-iptables
sudo ln -s /usr/local/bin/istio-iptables.sh /usr/local/bin/istio-iptables |
This comment has been minimized.
This comment has been minimized.
|
I was seeing the similar issue and even after trying the suggestion gave by @johscheuer i see the following logs when i execute Dec 18 07:34:47 istio-vm-270266498-2-853399488 istio-start.sh[29270]: # Completed on Wed Dec 18 07:34:47 2019 I then have to add the following configuration |
This comment has been minimized.
This comment has been minimized.
|
I saw the same but I didn't find some time to debug this issue hopefully I will be able to debug this during this week. You could try to set |
This comment has been minimized.
This comment has been minimized.
|
Retried again on two VM's (ubuntu 16.04.3 LTS ) and setup istio-proxy from start. After making the sym link for the iptables scripts, it seems to work fine and i can see the iptables rule setup and istio-proxy starting up as well. |
This comment has been minimized.
This comment has been minimized.
|
I still got the error it seems like the issue is in the clean up script (if I return with It seems like the clean script does something strange since I can see the following debug output: + /usr/local/bin/istio-clean-iptables
+ trap dump EXIT
+ for cmd in iptables ip6tables
+ iptables -t nat -D PREROUTING -p tcp -j ISTIO_INBOUND
+ iptables -t mangle -D PREROUTING -p tcp -j ISTIO_INBOUND
+ iptables -t nat -D OUTPUT -p tcp -j ISTIO_OUTPUT
+ iptables -t nat -F ISTIO_OUTPUT
+ iptables -t nat -X ISTIO_OUTPUT
+ iptables -t nat -F ISTIO_INBOUND
+ iptables -t nat -X ISTIO_INBOUND
+ iptables -t mangle -F ISTIO_INBOUND
+ iptables -t mangle -X ISTIO_INBOUND
+ iptables -t mangle -F ISTIO_DIVERT
+ iptables -t mangle -X ISTIO_DIVERT
+ iptables -t mangle -F ISTIO_TPROXY
+ iptables -t mangle -X ISTIO_TPROXY
+ iptables -t nat -F ISTIO_REDIRECT
+ iptables -t nat -X ISTIO_REDIRECT
+ iptables -t nat -F ISTIO_IN_REDIRECT
+ iptables -t nat -X ISTIO_IN_REDIRECT
+ for cmd in iptables ip6tables
+ ip6tables -t nat -D PREROUTING -p tcp -j ISTIO_INBOUND
+ ip6tables -t mangle -D PREROUTING -p tcp -j ISTIO_INBOUND
+ ip6tables -t nat -D OUTPUT -p tcp -j ISTIO_OUTPUT
+ ip6tables -t nat -F ISTIO_OUTPUT
+ ip6tables -t nat -X ISTIO_OUTPUT
+ ip6tables -t nat -F ISTIO_INBOUND
+ ip6tables -t nat -X ISTIO_INBOUND
+ ip6tables -t mangle -F ISTIO_INBOUND
+ ip6tables -t mangle -X ISTIO_INBOUND
+ ip6tables -t mangle -F ISTIO_DIVERT
+ ip6tables -t mangle -X ISTIO_DIVERT
+ ip6tables -t mangle -F ISTIO_TPROXY
+ ip6tables -t mangle -X ISTIO_TPROXY
+ ip6tables -t nat -F ISTIO_REDIRECT
+ ip6tables -t nat -X ISTIO_REDIRECT
+ ip6tables -t nat -F ISTIO_IN_REDIRECT
+ ip6tables -t nat -X ISTIO_IN_REDIRECT
+ dump
+ iptables-save
+ ip6tables-saveand after this the script stops. On Ubuntu 18.04 I got the following iptables version: sudo iptables -V
iptables v1.6.1 |
This comment has been minimized.
This comment has been minimized.
|
If I change the dump function in the clean script to: function dump {
iptables-save
ip6tables-save
exit $?
}it works again |
This comment has been minimized.
This comment has been minimized.
|
Just stumbled on this as well. Tried around a bit as well and found the following chain of errors:
and return code 3.
From what I can see, the solution here should be to add a |
This comment has been minimized.
This comment has been minimized.
|
My current workaround is the following before calling istio-start.sh: |
This comment has been minimized.
This comment has been minimized.
|
Has this made it's way to a release? Recently upgraded from 1.3.0 and things broke |
This comment has been minimized.
This comment has been minimized.
|
@mkoppanen my understanding is that this will be released with 1.4.4 this month |
This comment has been minimized.
This comment has been minimized.
|
My understanding is this is fixed. If not, please let me know note: on the 1.6 roadmap is VM hardening so hopefully we don't have these issues |
Bug description
The
/usr/local/bin/istio-start.shscript uses already the go implementation of the iptables but it is missing it in the/usr/local/bin/dir:sudo journalctl -fu istio Dec 16 17:44:50 expand-vm systemd[1]: istio.service: Scheduled restart job, restart counter is at 38. Dec 16 17:44:50 expand-vm systemd[1]: Stopped istio-sidecar: The Istio sidecar. Dec 16 17:44:50 expand-vm systemd[1]: Started istio-sidecar: The Istio sidecar. Dec 16 17:44:50 expand-vm istio-start.sh[4486]: /usr/local/bin/istio-start.sh: line 83: /usr/local/bin/istio-clean-iptables: No such file or directory Dec 16 17:44:50 expand-vm systemd[1]: istio.service: Main process exited, code=exited, status=127/n/a Dec 16 17:44:50 expand-vm systemd[1]: istio.service: Failed with result 'exit-code'.This means the debian package for the 1.4.2 release can't be used (I check if the error still persist on the master branch)
Expected behavior
All dependencies should be installed.
Steps to reproduce the bug
Install a VM (Ubuntu or Debian) and install the debian package for 1.4.2:
curl -L https://storage.googleapis.com/istio-release/releases/1.4.2/deb/istio-sidecar.deb > istio-sidecar.deb sudo dpkg -i istio-sidecar.debnow simply run:
sudo /usr/local/bin/istio-start.shVersion (include the output of
istioctl version --remoteandkubectl versionandhelm versionif you used Helm)How was Istio installed?
Environment where bug was observed (cloud vendor, OS, etc)