3.2.1 ISTIO灰度发布完全无效

lijibo

创建部署问题时，请参考下面模板，你提供的信息越多，越容易及时获得解答。如果未按模板创建问题，管理员有权关闭问题。
确保帖子格式清晰易读，用 markdown code block 语法格式化代码块。
你只花一分钟创建的问题，不能指望别人花上半个小时给你解答。

操作系统信息
例如：虚拟机/物理机，Centos7.5/Ubuntu18.04，4C/8G

Kubernetes版本信息
将 kubectl version 命令执行结果贴在下方

容器运行时
将 docker version / crictl version / nerdctl version 结果贴在下方

KubeSphere版本信息
自建的K8S 1.19.18上安装的kubesphere 3.2.1 ,已经完成istio的安装

问题是什么
使用了灰度发布的权重,但是看流量完成无效

看了一下表空间下的destinationrule都没有自动创建

RolandMa1986

lijibo 可以先测试一下demo project。
https://kubesphere.com.cn/docs/project-user-guide/grayscale-release/canary-release/
另外需要查询 ks-controller-manager 的日志

lijibo

我用KS部署的demo项目的bookinfo ,ks-controller-manager报错无法创建DestinationRule

I0112 09:29:32.218360 1 destinationrule_controller.go:107] Event([]interface {}{v1.ObjectReference{Kind:“DestinationRule”, Namespace:"", Name:“reviews”, UID:"", APIVersion:“networking.istio.io/v1alpha3”, ResourceVersion:"“, FieldPath:”"}, “Warning”, “FailedToCreateDestinationRule”, "Failed to create destinationrule for service demo/reviews: Internal error occurred: failed calling webhook \“validation.istio.io\”: Post \“https://istiod.istio-system.svc:443/validate?timeout=10s\”: service \“istiod\” not found"}): type: ‘%!v(MISSING)’ reason: ‘%!v(MISSING)’ %!v(MISSING)

I0112 09:29:33.315324 1 destinationrule_controller.go:107] Event([]interface {}{v1.ObjectReference{Kind:“DestinationRule”, Namespace:"", Name:“reviews”, UID:"", APIVersion:“networking.istio.io/v1alpha3”, ResourceVersion:"“, FieldPath:”"}, “Warning”, “FailedToCreateDestinationRule”, "Failed to create destinationrule for service demo/reviews: Internal error occurred: failed calling webhook \“validation.istio.io\”: Post \“https://istiod.istio-system.svc:443/validate?timeout=10s\”: service \“istiod\” not found"}): type: ‘%!v(MISSING)’ reason: ‘%!v(MISSING)’ %!v(MISSING)

I0112 09:29:39.630317 1 destinationrule_controller.go:107] Event([]interface {}{v1.ObjectReference{Kind:“DestinationRule”, Namespace:"", Name:“ratings”, UID:"", APIVersion:“networking.istio.io/v1alpha3”, ResourceVersion:"“, FieldPath:”"}, “Warning”, “FailedToCreateDestinationRule”, "Failed to create destinationrule for service demo/ratings: Internal error occurred: failed calling webhook \“validation.istio.io\”: Post \“https://istiod.istio-system.svc:443/validate?timeout=10s\”: service \“istiod\” not found"}): type: ‘%!v(MISSING)’ reason: ‘%!v(MISSING)’ %!v(MISSING)

lijibo

为什么KS默认会创建一个istiod-1-11-2的service而不是istiod,我又手工创建了一个istiod的service,但是又报认证错了

82] controllers/Helm “msg”=“Release reconciled” “nginx”={“Namespace”:“kubesphere-controls-system”,“Name”:“kubesphere-router-kubesphere-system-ingress”} “name”=“kubesphere-router-kubesphere-system-ingress” “version”=1

I0112 09:50:19.411183 1 destinationrule_controller.go:107] Event([]interface {}{v1.ObjectReference{Kind:“DestinationRule”, Namespace:"", Name:“nginx”, UID:"", APIVersion:“networking.istio.io/v1alpha3”, ResourceVersion:"“, FieldPath:”"}, “Warning”, “FailedToCreateDestinationRule”, "Failed to create destinationrule for service demo/nginx: Internal error occurred: failed calling webhook \“validation.istio.io\”: Post \“https://istiod.istio-system.svc:443/validate?timeout=10s\”: x509: certificate signed by unknown authority (possibly because of \“crypto/rsa: verification error\” while trying to verify candidate authority certificate \“cluster.local\”)"}): type: ‘%!v(MISSING)’ reason: ‘%!v(MISSING)’ %!v(MISSING)

I0112 09:50:25.441180 1 virtualservice_controller.go:276] destination rules for service not found, retrying.namespacedemonamenginx

I0112 09:50:39.899192 1 destinationrule_controller.go:107] Event([]interface {}{v1.ObjectReference{Kind:“DestinationRule”, Namespace:"", Name:“nginx”, UID:"", APIVersion:“networking.istio.io/v1alpha3”, ResourceVersion:"“, FieldPath:”"}, “Warning”, “FailedToCreateDestinationRule”, "Failed to create destinationrule for service demo/nginx: Internal error occurred: failed calling webhook \“validation.istio.io\”: Post \“https://istiod.istio-system.svc:443/validate?timeout=10s\”: x509: certificate signed by unknown authority (possibly because of \“crypto/rsa: verification error\” while trying to verify candidate authority certificate \“cluster.local\”)"}): type: ‘%!v(MISSING)’ reason: ‘%!v(MISSING)’ %!v(MISSING)

I0112 09:50:45.922335 1 virtualservice_controller.go:276] destination rules for service not found, retrying.namespacedemonamenginx

RolandMa1986

lijibo 不能自己手动安装istio。启用ServiceMesh后 ks-installer 会自动安装的。