fail to run istio-ingressgateway, got Readiness probe failed: connection refused

user_7086030 0
Viewed 2199

I fail to deploy istio and met this problem. When I tried to deploy istio using istioctl install --set profile=default -y. The output is like:

➜  istio-1.11.4 istioctl install --set profile=default -y
✔ Istio core installed                                                                                                                                                                        
✔ Istiod installed                                                                                                                                                                            
✘ Ingress gateways encountered an error: failed to wait for resource: resources not ready after 5m0s: timed out waiting for the condition                                                     
  Deployment/istio-system/istio-ingressgateway (containers with unready status: [istio-proxy])
- Pruning removed resources                                                                                                                                                                   Error: failed to install manifests: errors occurred during operation

After running kubectl get pods -n=istio-system, I found the pod of istio-ingressgateway was created, and the result of describe:

Events:
  Type     Reason     Age                     From               Message
  ----     ------     ----                    ----               -------
  Normal   Scheduled  4m36s                   default-scheduler  Successfully assigned istio-system/istio-ingressgateway-8dbb57f65-vc85p to k8s-slave
  Normal   Pulled     4m35s                   kubelet            Container image "docker.io/istio/proxyv2:1.11.4" already present on machine
  Normal   Created    4m35s                   kubelet            Created container istio-proxy
  Normal   Started    4m35s                   kubelet            Started container istio-proxy
  Warning  Unhealthy  3m56s (x22 over 4m34s)  kubelet            Readiness probe failed: Get "http://10.244.1.4:15021/healthz/ready": dial tcp 10.244.1.4:15021: connect: connection refused

And I can't get the log of this pod:

➜  ~ kubectl logs pods/istio-ingressgateway-8dbb57f65-vc85p -n=istio-system
Error from server: Get "https://192.168.0.154:10250/containerLogs/istio-system/istio-ingressgateway-8dbb57f65-vc85p/istio-proxy": dial tcp 192.168.0.154:10250: i/o timeout

I run all this command on two VM in Huawei Cloud, with a 2C8G master and a 2C4G slave in ubuntu18.04. I have reinstall the environment and the kubernetes cluster, but that doesn't help.

Without ingressgateway

I also tried istioctl install --set profile=minimal -y that only run istiod. But when I try to run httpbin(kubectl apply -f samples/httpbin/httpbin.yaml) with auto injection on, the deployment can't create pod.

➜  istio-1.11.4 kubectl get deployment
NAME      READY   UP-TO-DATE   AVAILABLE   AGE
httpbin   0/1     0            0           5m24s
➜  istio-1.11.4 kubectl describe deployment/httpbin 
...
Events:
  Type    Reason             Age   From                   Message
  ----    ------             ----  ----                   -------
  Normal  ScalingReplicaSet  6m6s  deployment-controller  Scaled up replica set httpbin-74fb669cc6 to 1

When I unlabel the default namespace(kubectl label namespace default istio-injection-), everything works fine.

I hope to deploy istio ingressgateway and run demo like istio-ingressgateway, but I have no idea to solve this situation. Thanks for any help.

istio kubernetes
1 Answers

I made a silly mistake Orz.

After communiation with my cloud provider, I was informed that there was a network security policy of my cloud server. It's strange that one server has full access and the other has partial access (which only allow for port like 80, 443 and so on). After I change the policy, everything works fine.

For someone who may meet the similar question, I found all these questions seem to come with network problems like dns configuration, k8s configuration or server network problem after hours of searching in google. Like what howardjohn said in this issue, this is not a istio problem.

user_70860300
Related