Istio injection failed

1

Hi all,
I have installed Istio 1.7.3 by using Istio operator. My cluster is a K8s versio 1.18.5. Im trying to run the sleep example on my cluster. Here is the description

  1. Im using a namespace istiotest
    [kubeadmin@proddev62 ~]$ kubectl get namespace -L istio-injection
    NAME STATUS AGE ISTIO-INJECTION
    …
    istiotest Active 73m enabled

  2. istiod pod and istiod service are running normally and istiod endpoints correspond to istiod pod ip

kubectl get pod -n istio-system -o=wide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
istio-egressgateway-66f8f6d69c-62klh 1/1 Running 0 2d23h 10.244.11.122 proddev77
istio-ingressgateway-758d8b79bd-dbzj7 1/1 Running 0 2d23h 10.244.5.146 proddev71
istiod-7556f7fddf-8tmpj 1/1 Running 0 37m 10.244.16.224 proddev53

[kubeadmin@proddev62 ~]$ kubectl get svc -n istio-system
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
istio-egressgateway ClusterIP 10.104.209.58 80/TCP,443/TCP,15443/TCP 2d23h
istio-ingressgateway NodePort 10.109.9.71 15021:31978/TCP,80:30058/TCP,443:32390/TCP,31400:32584/TCP,15443:30627/TCP 2d23h
istiod ClusterIP 10.106.117.90 15010/TCP,15012/TCP,443/TCP,15014/TCP,853/TCP 2d23h

[kubeadmin@proddev62 ~]$ kubectl get ep istiod -n istio-system
NAME ENDPOINTS AGE
istiod 10.244.16.224:15053,10.244.16.224:15010,10.244.16.224:15012 + 2 more… 2d23h

  1. istiod pod and istiod service are accessible with curl from other pods of other namespaces

sh-4.2$ curl -k https://10.244.16.224:15017/inject
no body found
sh-4.2$ curl -k https://istiod.istio-system.svc:443/inject
no body found

  1. Im using flannel cni and everything else works as expected. Im quite sure that istio samples were deployed successfully with istio 1.6.5 that was previously installed

  2. Im running the sample by using

kubectl apply -f samples/sleep/sleep.yaml -n istiotest
serviceaccount/sleep created
service/sleep created
deployment.apps/sleep created

  1. Im getting the following in the namespace events

      Normal    ScalingReplicaSet   deployment/sleep             Scaled up replica set sleep-8f795f47d to 1     
  Warning   FailedCreate        replicaset/sleep-8f795f47d   Error creating: Internal error occurred: failed calling webhook "sidecar-injector.istio.io": Post https://istiod.istio-system.svc:443/inject?timeout=30s: dial tcp 10.106.117.90:443: i/o timeout
                                                                                           
   Warning   FailedCreate        replicaset/sleep-8f795f47d   Error creating: Internal error occurred: failed calling webhook "sidecar-injector.istio.io": Post https://istiod.istio-system.svc:443/inject?timeout=30s: context deadline exceeded

  2. No pods are created

2

I have also to mention that looking in the logs of the api servers, I may also notice validation errors

E1005 14:01:45.631861 1 dispatcher.go:129] failed calling webhook “validation.istio.io”: Post https://istiod.istio-system.svc:443/validate?timeout=30s: context deadline exceeded
I1005 14:01:45.639855