Installing Istio for Knative(docs/install/installing-istio.md)

[romankolpak]

Hello, folks.

Running into a problem in the installation guide at the Installing Istio without sidecar injection step. This snippet doesn't work with istioctl v1.7.1:

cat << EOF > ./istio-minimal-operator.yaml
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  values:
    global:
      proxy:
        autoInject: disabled
      useMCP: false
      # The third-party-jwt is not enabled on all k8s.
      # See: https://istio.io/docs/ops/best-practices/security/#configure-third-party-service-account-tokens
      jwtPolicy: first-party-jwt

  addonComponents:
    pilot:
      enabled: true
    prometheus:
      enabled: false

  components:
    ingressGateways:
      - name: istio-ingressgateway
        enabled: true
      - name: cluster-local-gateway
        enabled: true
        label:
          istio: cluster-local-gateway
          app: cluster-local-gateway
        k8s:
          service:
            type: ClusterIP
            ports:
            - port: 15020
              name: status-port
            - port: 80
              name: http2
            - port: 443
              name: https
EOF

istioctl manifest apply -f istio-minimal-operator.yaml

produces:

Error: unknown shorthand flag: 'f' in -f'

error. Replacing apply command with install gets me further, but then I get I see a different problem:

✗ istioctl manifest install -f istio-minimal-operator.yaml
Detected that your cluster does not support third party JWT authentication. Falling back to less secure first party JWT. See https://istio.io/docs/ops/best-practices/security/#configure-third-party-service-account-tokens for details.
Error: failed to install manifests: generated config failed semantic validation: port http2/80 in gateway cluster-local-gateway invalid: targetPort is set to 0, which requires root. Set targetPort to be greater than 1024 or configure values.gateways.istio-ingressgateway.runAsRoot=true, port https/443 in gateway cluster-local-gateway invalid: targetPort is set to 0, which requires root. Set targetPort to be greater than 1024 or configure values.gateways.istio-ingressgateway.runAsRoot=true

Any ideas? I'm a using a wrong version of Istio?

[mjanickova]

release notes of istio 1.7 can help you: https://istio.io/latest/news/releases/1.7.x/announcing-1.7/upgrade-notes/
it is also written in the error log: targetPort is set to 0, which requires root. Set targetPort to be greater than 1024

[abrennan89]

@romankolpak did you manage to resolve the issue? Is there an actual documentation change required here?
maybe @nak3 or @markusthoemmes can also help?

[nak3]

@romankolpak The issue was fixed by #2775. (Sorry it was merged 7 days ago after you filed this issue...)

The current docs has the fix as @mjanickova mentioned.
https://knative.dev/docs/install/installing-istio/#installing-istio-without-sidecar-injection

snip

          service:
            type: ClusterIP
            ports:
            - port: 15020
              name: status-port
            - port: 80
              targetPort: 8080
              name: http2
            - port: 443
              targetPort: 8443
              name: https

[romankolpak]

@abrennan89 adding targetPort fixed the issue for me (see snippet in #2824 (comment)).

Closing since the docs snippet have targetPorts as well.

[landons-migo]

@nak3 Even though that PR was merged, the current docs haven't updated to reflect the change. This is super confusing for us newbies :)

[nak3]

@landons-migo Thank you for pointing out it. Yes, we need to cherry-pick the commit against release-0.18 branch and master branch.
I am working on it now as #2885 and #2886

[seufagner]

Great! But when I use targetPorts above, I still got the same error. Besides this, I believe that the error message is confuse.