Istio Installation Failed - Apple Silicon M1

user_3900248 0
Viewed 773

istio-1.12.2

istioctl install --set profile=demo -y

Not sure why the pod is still pending and didn't match Pod's node affinity.

   SecretName:  istio-ingressgateway-ca-certs
  Optional:    true
  kube-api-access-sfpw2:
    Type:                    Projected (a volume that contains injected data from multiple sources)
    TokenExpirationSeconds:  3607
    ConfigMapName:           kube-root-ca.crt
    ConfigMapOptional:       <nil>
    DownwardAPI:             true
QoS Class:                   Burstable
Node-Selectors:              <none>
Tolerations:                 node.kubernetes.io/not-ready:NoExecute op=Exists for 300s
                             node.kubernetes.io/unreachable:NoExecute op=Exists for 300s
Events:
  Type     Reason            Age                  From               Message
  ----     ------            ----                 ----               -------
  Warning  FailedScheduling  55s (x4 over 4m31s)  default-scheduler  0/1 nodes are available: 1 node(s) didn't match Pod's node affinity/selector.

From the pod here is the affinity

spec:
      affinity:
        nodeAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - preference:
              matchExpressions:
              - key: kubernetes.io/arch
                operator: In
                values:
                - amd64
            weight: 2
          - preference:
              matchExpressions:
              - key: kubernetes.io/arch
                operator: In
                values:
                - ppc64le
            weight: 2
          - preference:
              matchExpressions:
              - key: kubernetes.io/arch
                operator: In
                values:
                - s390x
            weight: 2
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: kubernetes.io/arch
                operator: In
                values:
                - amd64
                - ppc64le
                - s390x

When I check node ( Single node )

NAME       STATUS   ROLES                  AGE   VERSION   LABELS
minikube   Ready    control-plane,master   11m   v1.23.3   beta.kubernetes.io/arch=arm64,beta.kubernetes.io/os=linux,kubernetes.io/arch=arm64,kubernetes.io/hostname=minikube,kubernetes.io/os=linux,minikube.k8s.io/commit=362d5fdc0a3dbee389b3d3f1034e8023e72bd3a7,minikube.k8s.io/name=minikube,minikube.k8s.io/primary=true,minikube.k8s.io/updated_at=2022_05_01T10_16_33_0700,minikube.k8s.io/version=v1.25.2,node-role.kubernetes.io/control-plane=,node-role.kubernetes.io/master=,node.kubernetes.io/exclude-from-external-load-balancers=
istio
2 Answers

As of June 2022, there is no support for istio on MacOS m1 chip. Istio init containers fail initialization because of iptables. Command error output: xtables parameter problem: iptables-restore: unable to initialize table 'nat'.

The temporary fix for this is to use istio operator with hub pointing to RESF's repo.

After you have installed/downloaded the istioctl command line. Run following commands -

  1. Set hub for istio operator.
istioctl operator init --hub=ghcr.io/resf/istio
  1. Create namespace for istio insatallation.
kubectl create ns istio-system
  1. Install istio
kubectl apply -f - <<EOF
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  namespace: istio-system
  name: example-istiocontrolplane
spec:
  hub: ghcr.io/resf/istio
  profile: demo
EOF

This temporary fix is by RESF until official fix and all credit goes to them.

user_14896380
user_153232860
Related