New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Failed calling admission webhook "sidecar-injector.istio.io":certificate signed by unknown authority #5828
Comments
We're encountering this issue when using the default istio-demo.yaml (from the release tarball) as well as the istio.yaml generated by the updateVersion.sh from the 0.8.0 tag. What is supposed to be the value of caBundle when using the self signed cert? |
The |
Ah, thanks for the clarification. Bounced the sidecar-injector pod and now the auto injection is working. |
Duplicate of #6069 |
@wattli another possibility with this bug is your servers are not running NTP. Can you verify NTP was running in this scenario? Cheers |
I had the same issue. After playing around a bit I realized that the example does not set the proper labels for automated sidecar injection. Use kubectl label namespace default istio-injection=enabled and it should work. |
I ran into this issue as well, turned out to be the kube-apiserver manifest and not the injector container. I did not have |
@CRYSON, you're not the first to have problems with no_proxy and kube-apiserver. Would you be willing to contribute your findings to either the k8s webhooks ops guide or quick start guide for your particular k8s distribution / install method? |
put the no_proxy settings in /etc/kubernetes/manifests . specifically the api manifest/config. Then systemctl restart kubelet. Might have to whack the pods too (EXCEPT DNS!!!) to get it to roll. @ayj feel free to update that.
|
Let me know if that's acceptable, I saw a lot of people talking about that issue so I believe it'd be good to at least have some information on where to begin troubleshooting. This was an on-premise cluster, therefore proxies become an issue when inside a corporate network. |
istio-release-0.8-20180520-18-17
website: https://preliminary.istio.io/docs/setup/kubernetes/sidecar-injection.html#automatic-sidecar-injection
message: 'Internal error occurred: failed calling admission webhook "sidecar-injector.istio.io":
Post https://istio-sidecar-injector.istio-system.svc:443/inject?timeout=30s:
The text was updated successfully, but these errors were encountered: