istio control plane only installs in istio-system namespace using istio-operator #24037
Comments
|
The operator can only watch one namespace if you want to watch other namespaces set |
|
Where do you apply this option? During istio operator init? I have tried this during istio Operator init and the operator still looks for istio-system namespace. Please see below. |
|
Hi, you should create namespaces |
|
If you crate the istio-system namespace it will create the istio control plane resources in that namespace. It looks like there is no way to configure istio control plane in another namespace. |
|
Modify IstioOperator's global.istioNamespace |
|
I also tried all options to modify the istio control plane deployment into different namespace, none of the options are successful. |
|
I'm also hitting this problem. In the istio-operator deployment the following env var is set to ensure we are watching for policies in the correct (non-default) namespace: env:
- name: WATCH_NAMESPACE
value: "my-istio-system"On my policy I have tried @erdun 's suggestion by making my policy as such: apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
namespace: my-istio-system
name: example-istiocontrolplane
spec:
profile: demo
values:
global:
istioNamespace: my-istio-systemI've also tried the following policy per the API documentation found here. <- I'm on 1.7 by the way. apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
namespace: my-istio-system
name: example-istiocontrolplane
spec:
profile: demo
namespace: my-istio-systemas well as: apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
namespace: my-istio-system
name: example-istiocontrolplane
spec:
profile: demo
components:
pilot:
namespace: my-istio-systemI receive the same status error on all of these configurations as follows: $ kc describe istiooperator example-istiocontrolplane -n my-istio-system
Name: example-istiocontrolplane
Namespace: my-istio-system
Labels: <none>
Annotations: API Version: install.istio.io/v1alpha1
Kind: IstioOperator
Metadata:
Creation Timestamp: 2020-09-08T14:48:10Z
Deletion Grace Period Seconds: 0
Deletion Timestamp: 2020-09-08T21:56:05Z
Finalizers:
istio-finalizer.install.istio.io
Generation: 5
Managed Fields:
API Version: install.istio.io/v1alpha1
Fields Type: FieldsV1
fieldsV1:
f:metadata:
f:finalizers:
.:
v:"istio-finalizer.install.istio.io":
f:status:
.:
f:componentStatus:
f:status:
Manager: operator
Operation: Update
Time: 2020-09-08T21:50:45Z
API Version: install.istio.io/v1alpha1
Fields Type: FieldsV1
fieldsV1:
f:metadata:
f:annotations:
.:
f:kubectl.kubernetes.io/last-applied-configuration:
f:spec:
.:
f:profile:
f:values:
Manager: kubectl
Operation: Update
Time: 2020-09-08T23:26:41Z
Resource Version: 2521875
Self Link: /apis/install.istio.io/v1alpha1/namespaces/my-istio-system/istiooperators/example-istiocontrolplane
UID: 84492797-4531-4e2a-b8cd-421ad924e8d8
Spec:
Profile: demo
Values:
Global:
Istio Namespace: my-istio-system
Status:
Component Status:
Base:
Error: failed to create "ServiceAccount/istio-system/istio-reader-service-account": namespaces "istio-system" not found, failed to create "ServiceAccount/istio-system/istiod-service-account": namespaces "istio-system" not found, failed to create "Role/istio-system/istiod-istio-system": namespaces "istio-system" not found, failed to create "RoleBinding/istio-system/istiod-istio-system": namespaces "istio-system" not found
Status: ERROR
Egress Gateways:
Status: HEALTHY
Ingress Gateways:
Status: HEALTHY
Pilot:
Error: failed to create "EnvoyFilter/istio-system/metadata-exchange-1.6": namespaces "istio-system" not found, failed to create "EnvoyFilter/istio-system/metadata-exchange-1.7": namespaces "istio-system" not found, failed to create "EnvoyFilter/istio-system/stats-filter-1.6": namespaces "istio-system" not found, failed to create "EnvoyFilter/istio-system/stats-filter-1.7": namespaces "istio-system" not found, failed to create "EnvoyFilter/istio-system/tcp-metadata-exchange-1.6": namespaces "istio-system" not found, failed to create "EnvoyFilter/istio-system/tcp-metadata-exchange-1.7": namespaces "istio-system" not found, failed to create "EnvoyFilter/istio-system/tcp-stats-filter-1.6": namespaces "istio-system" not found, failed to create "EnvoyFilter/istio-system/tcp-stats-filter-1.7": namespaces "istio-system" not found
Status: ERROR
Status: ERROR
Events: <none>Is there something I'm missing, or is the documentation not correct on the ability to choose an alternative namespace than istio-system? |
|
After some further debugging it seems that it's the pilot component specifically (at least in 1.7.0) that is not receiving any of the namespace updates on manifest generation. I was attempting to patch with an overlay configuration on the pilot component and apparently not doing it right, however I was seeing all objects update when there was a namespace change with exception to pilot (istio-operator logs): 2020-09-09T01:33:18.772037Z error installer Error during reconcile: overlay for : does not match any object in output manifest. Available objects are:
HorizontalPodAutoscaler:my-istio-system:istiod
ConfigMap:my-istio-system:istio
Deployment:my-istio-system:istiod
ConfigMap:my-istio-system:istio-sidecar-injector
MutatingWebhookConfiguration::istio-sidecar-injector-my-istio-system
PodDisruptionBudget:my-istio-system:istiod
Service:my-istio-system:istiod
EnvoyFilter:istio-system:metadata-exchange-1.6
EnvoyFilter:istio-system:tcp-metadata-exchange-1.6
EnvoyFilter:istio-system:stats-filter-1.6
EnvoyFilter:istio-system:tcp-stats-filter-1.6
EnvoyFilter:istio-system:metadata-exchange-1.7
EnvoyFilter:istio-system:tcp-metadata-exchange-1.7
EnvoyFilter:istio-system:stats-filter-1.7
EnvoyFilter:istio-system:tcp-stats-filter-1.7
EnvoyFilter:istio-system:metadata-exchange-1.8
EnvoyFilter:istio-system:tcp-metadata-exchange-1.8
EnvoyFilter:istio-system:stats-filter-1.8
EnvoyFilter:istio-system:tcp-stats-filter-1.8Notice specifically all of the EnvoyFilter objects. Finally I decided to take a look into what's actually causing this in the source code. I hunted it down to the Helm charts here It seems that the only charts that are inconsistent with the namespace being set to the value of And without further ado, here's a work-around configuration until the charts are fixed: 1.) Make sure you have your watch namespace configured properly on your istio-operator deployment apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
name: example-istiocontrolplane
namespace: my-istio-system
spec:
profile: demo
values:
global:
istioNamespace: my-istio-system
meshConfig:
rootNamespace: my-istio-system |
|
🚧 This issue or pull request has been closed due to not having had activity from an Istio team member since 2020-05-22. If you feel this issue or pull request deserves attention, please reopen the issue. Please see this wiki page for more information. Thank you for your contributions. Created by the issue and PR lifecycle manager. |
istio-policy-bot
added
the
lifecycle/automatically-closed
|
This should not be closed. |
This worked for me. |
|
I agree @ahuffman, there is an obvious issue with docs not specifying how to use different namespace. Could we please reopen this one? |
Bug description
When trying to create the IstioOperator CR in a different namespace than istio-system, the operator does not create the control plane resources. Neither creating a component in a specific namespace described here https://istio.io/docs/setup/install/istioctl/#configure-component-settings does not work.
Expected behavior
Istio control plane or components should install in any system using the IstioOperator CRD.
Steps to reproduce the bug
Version (include the output of
istioctl version --remoteandkubectl versionandhelm versionif you used Helm)How was Istio installed?
IstioOperator
Environment where bug was observed (cloud vendor, OS, etc)
vanilla Kubernetes 1.16.6, Rhel 7.8, Openstack VM
The text was updated successfully, but these errors were encountered: