I want to enable DNS proxying during Istio installation, but I can’t find figure out a working
istioctl install command using my current
--set approach to configuration.
The CLI help tries to provide guidance:
$ istioctl install --help ... # For setting boolean-string option, it should be enclosed quotes and escaped with a backslash (\). istioctl install --set meshConfig.defaultConfig.proxyMetadata.PROXY_XDS_VIA_AGENT=\"false\" ...
That’s great! It almost exactly matches what I want here. Here’s my command, with the last two lines being new:
istioctl install -y \ --set values.gateways.istio-ingressgateway.type=NodePort \ --set components.egressGateways.enabled=true \ --set components.egressGateways.name=istio-egressgateway \ --set hub=gcr.io/istio-release \ --set meshConfig.defaultConfig.proxyMetadata.ISTIO_META_DNS_CAPTURE=\"true\" \ --set meshConfig.defaultConfig.proxyMetadata.ISTIO_META_DNS_AUTO_ALLOCATE=\"true\"
This fails to install with a timeout on ingress/egress gateway setup:
✘ Ingress gateways encountered an error: failed to wait for resource: resources not ready after 5m0s: timed out waiting for the condition ✘ Egress gateways encountered an error: failed to wait for resource: resources not ready after 5m0s: timed out waiting for the condition
Sure enough, the gateways are in CrashLoopBackoff mode, with (filtered) log messages like so:
proxyMetadata: ISTIO_META_DNS_AUTO_ALLOCATE: \"true\" ISTIO_META_DNS_CAPTURE: \"true\" warn Invalid environment variable value `"true"`, expecting true/false, defaulting to false Error: failed to start envoy agent: failed to generate bootstrap metadata: strconv.ParseBool: parsing "\"true\"": invalid syntax
I think what’s going on here is a series of failed conversions between YAML and Go based on
true being a magic string in YAML. Given that the help message even attempts to address this exact issue, I assume it’s not just me. Is there a better way to fix this?
I’m not confident that I can convert from my current
--set installation to an explicit
IstioOperator resource, because I don’t know what my current one even looks like. Maybe I can dig one out of one of my existing clusters, but I’m hoping there’s a simpler solution.