Ingress is constantly warning about some JSON schema violation

[mclarke47]

[2017-05-30 12:30:59.264][14][warning][router] rds: fetch failure: JSON at lines 21-27 does not conform to schema.
 Invalid schema: #/properties/routes
 Schema violation: type
 Offending document key: #/routes
[2017-05-30 12:31:00.463][14][warning][router] rds: fetch failure: JSON at lines 21-27 does not conform to schema.
 Invalid schema: #/properties/routes
 Schema violation: type
 Offending document key: #/routes
[2017-05-30 12:31:01.762][14][warning][router] rds: fetch failure: JSON at lines 21-27 does not conform to schema.
 Invalid schema: #/properties/routes
 Schema violation: type
 Offending document key: #/routes
[2017-05-30 12:31:03.490][14][warning][router] rds: fetch failure: JSON at lines 21-27 does not conform to schema.
 Invalid schema: #/properties/routes
 Schema violation: type
 Offending document key: #/routes

Output of kubectl get deployment istio-ingress -o=yaml

apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  annotations:
    deployment.kubernetes.io/revision: "1"
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"extensions/v1beta1","kind":"Deployment","metadata":{"annotations":{},"name":"istio-ingress","namespace":"default"},"spec":{"replicas":1,"template":{"metadata":{"annotations":{"alpha.istio.io/sidecar":"ignore"},"labels":{"istio":"ingress"}},"spec":{"containers":[{"args":["proxy","ingress","-v","2"],"env":[{"name":"POD_NAMESPACE","valueFrom":{"fieldRef":{"apiVersion":"v1","fieldPath":"metadata.namespace"}}}],"image":"docker.io/istio/proxy_debug:0.1.5","imagePullPolicy":"Always","name":"istio-ingress","ports":[{"containerPort":80},{"containerPort":443}]}],"serviceAccountName":"istio-ingress-service-account"}}}}
  creationTimestamp: 2017-05-30T10:50:18Z
  generation: 1
  labels:
    istio: ingress
  name: istio-ingress
  namespace: default
  resourceVersion: "26658"
  selfLink: /apis/extensions/v1beta1/namespaces/default/deployments/istio-ingress
  uid: c53613c2-4525-11e7-8884-0aa00da65f28
spec:
  replicas: 1
  selector:
    matchLabels:
      istio: ingress
  strategy:
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 1
    type: RollingUpdate
  template:
    metadata:
      annotations:
        alpha.istio.io/sidecar: ignore
      creationTimestamp: null
      labels:
        istio: ingress
    spec:
      containers:
      - args:
        - proxy
        - ingress
        - -v
        - "2"
        env:
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
        image: docker.io/istio/proxy_debug:0.1.5
        imagePullPolicy: Always
        name: istio-ingress
        ports:
        - containerPort: 80
          protocol: TCP
        - containerPort: 443
          protocol: TCP
        resources: {}
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
      dnsPolicy: ClusterFirst
      restartPolicy: Always
      schedulerName: default-scheduler
      securityContext: {}
      serviceAccount: istio-ingress-service-account
      serviceAccountName: istio-ingress-service-account
      terminationGracePeriodSeconds: 30
status:
  availableReplicas: 1
  conditions:
  - lastTransitionTime: 2017-05-30T10:50:18Z
    lastUpdateTime: 2017-05-30T10:50:18Z
    message: Deployment has minimum availability.
    reason: MinimumReplicasAvailable
    status: "True"
    type: Available
  observedGeneration: 1
  readyReplicas: 1
  replicas: 1
  updatedReplicas: 1

[kyessenov]

@mclarke47 do you mind listing all ingresses that result in this failure? You can use kubectl get ingress --all.

[Crevil]

I'm hitting the same when using the following ingress object.

The following ingress objects are in place

$ kubectl -n local get ing

NAME            HOSTS                         ADDRESS   PORTS     AGE
supportsystem   support2-local.company.com             80, 443   11m

This is the ingress object:

$ kubectl -n local get ing supportsystem -o yaml

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.class: istio
  creationTimestamp: 2017-06-07T08:32:07Z
  generation: 1
  name: supportsystem
  namespace: local
  resourceVersion: "31763"
  selfLink: /apis/extensions/v1beta1/namespaces/local/ingresses/supportsystem
  uid: ca917407-4b5b-11e7-b55e-080027069e42
spec:
  rules:
  - host: support2-local.company.com
    http:
      paths:
      - backend:
          serviceName: support2-oauth2
          servicePort: 80
        path: /.*
  tls:
  - hosts:
    - support2-local.company.com
    secretName: cert
status:
  loadBalancer: {}

I'm running the ingress controller in a DaemonSet with the following configuration.

$ kubectl -n local get ds istio-ingress -o yaml

apiVersion: extensions/v1beta1
kind: DaemonSet
metadata:
  creationTimestamp: 2017-06-06T11:16:01Z
  generation: 1
  labels:
    istio: ingress
  name: istio-ingress
  namespace: local
  resourceVersion: "7085"
  selfLink: /apis/extensions/v1beta1/namespaces/local/daemonsets/istio-ingress
  uid: 85adf314-4aa9-11e7-b55e-080027069e42
spec:
  selector:
    matchLabels:
      istio: ingress
  template:
    metadata:
      annotations:
        alpha.istio.io/sidecar: ignore
      creationTimestamp: null
      labels:
        istio: ingress
    spec:
      containers:
      - args:
        - proxy
        - ingress
        - -v
        - "2"
        env:
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
        image: docker.io/istio/proxy_debug:0.1.5
        imagePullPolicy: Always
        name: istio-ingress
        ports:
        - containerPort: 80
          hostPort: 80
          protocol: TCP
        - containerPort: 443
          hostPort: 443
          protocol: TCP
        resources: {}
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
      dnsPolicy: ClusterFirst
      restartPolicy: Always
      schedulerName: default-scheduler
      securityContext: {}
      serviceAccount: istio-ingress-service-account
      serviceAccountName: istio-ingress-service-account
      terminationGracePeriodSeconds: 30
  templateGeneration: 1
  updateStrategy:
    type: OnDelete
status:
  currentNumberScheduled: 1
  desiredNumberScheduled: 1
  numberAvailable: 1
  numberMisscheduled: 0
  numberReady: 1
  observedGeneration: 1
  updatedNumberScheduled: 1

[dmcqueen]

Also getting this same error

[2017-06-15 18:19:19.867][21][warning][router] rds: fetch failure: JSON at lines 3-9 does not conform to schema.
Invalid schema: #/properties/routes
Schema violation: type
Offending document key: #/routes

[dmcqueen]

Just a basic ingress.

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: gateway
  annotations:
    kubernetes.io/ingress.class: "istio"
spec:
  rules:
  - http:
      paths:
      - path: /docs
        backend:
          serviceName: docs
          servicePort: 8889

[mattbates]

I experienced the same error and fixed it by adding name: http to the port on the Service. The Service I used didn't have this set, but it's required - see here:

Kubernetes Services are required for properly functioning Istio service. Service ports must be named and these names must begin with http or grpc prefix to take advantage of Istio’s L7 routing features, e.g. name: http-foo or name: http is good. Services with non-named ports or with ports that do not have a http or grpc prefix will be routed as L4 traffic.

Perhaps this might help for you too.

[kyessenov]

Isaiah, can you tell a quick summary of why schema fails for TCP ports?

[mclarke47]

See the reference for the fix