Failed calling webhook "namespace.sidecar-injector.istio.io"

user_7215872 0
Viewed 3087

I have make my deployment work with istio ingressgateway before. I am not aware of any changes made in istio or k8s side.

When I tried to deploy, I see an error in replicaset side that's why it cannot create new pod.

Error creating: Internal error occurred: failed calling webhook "namespace.sidecar-injector.istio.io": Post "https://istiod.istio-system.svc:443/inject?timeout=10s": dial tcp 10.104.136.116:443: connect: no route to host

When I try to go inside api-server and ping 10.104.136.116 (istiod service IP) it just hangs.

What I have tried so far:

  • Deleted all coredns pods
  • Deleted all istiod pods
  • Deleted all weave pods
  • Reinstalling istio via istioctl x uninstall --purge
  • turning all of VMs firewall
  • sudo iptables -P INPUT ACCEPT sudo iptables -P FORWARD ACCEPT sudo iptables -P OUTPUT ACCEPT sudo iptables -F
  • restarted all of the nodes
  • manual istio pod injection

Setup

  • k8s version: 1.21.2
  • istio: 1.10.3
  • HA setup
  • CNI: weave
  • CRI: containerd
istio kubernetes
2 Answers

I don't have a definite answer unto why is this happening. But kube-apiserver cannot access istiod via service IP, wherein it can connect when I used the istiod pod IP.

Since I don't have the control over the VM and lower networking layer and not sure if they have changed something (because it is working before).

I made this work by changing my CNI from weave to flannel

user_72158720

In my case this was related to firewall. More info can be found here.

The gist of it is that on GKE at least you need to open another port 15017 in addition to 10250 and 443. This is to allow communication from your master node(s) to you VPC.

user_38620920
Related