-
Notifications
You must be signed in to change notification settings - Fork 8k
Closed
Milestone
Description
When we try to deploy istio on openshift, different issues are reported
Scenario followed
minishift start --memory 5000
oc new-project istio
oc apply -f install/kubernetes/istio-auth.yaml
oc apply -f install/kubernetes/addons/prometheus.yaml
oc apply -f install/kubernetes/addons/grafana.yaml
oc apply -f install/kubernetes/addons/servicegraph.yaml
oc apply -f install/kubernetes/addons/zipkin.yaml
oc expose svc/grafana
oc expose svc/servicegraph
oc expose svc/zipkin
Errors
- Permission denied
The docker user which is used by grafana/prometheus container doesn't has the permission to change ownership or create a folder.
oc logs grafana-851518138-z76l9
chown: changing ownership of '/data/grafana': Operation not permitted
chown: changing ownership of '/var/log/grafana': Operation not permitted
oc logs prometheus-3208567892-08nvd
time="2017-05-16T14:14:44Z" level=info msg="Starting prometheus (version=1.1.1, branch=release-1.0, revision=ab312a075f810e2ed124783c46d68674af071293)" source="main.go:73"
time="2017-05-16T14:14:44Z" level=info msg="Build context (go=go1.6.3, user=root@8ab14ddb4898, date=20160907-09:37:01)" source="main.go:74"
time="2017-05-16T14:14:44Z" level=info msg="Loading configuration file /etc/prometheus/prometheus.yml" source="main.go:221"
time="2017-05-16T14:14:44Z" level=error msg="Error opening memory series storage: mkdir data: permission denied" source="main.go:158"
- Waiting to start as they are looking abut the secrets
The ingress and egress contains can't be started
oc logs istio-egress-1575870412-s1rs7
Error from server (BadRequest): container "proxy" in pod "istio-egress-1575870412-s1rs7" is waiting to start: ContainerCreating
oc logs istio-ingress-2905358108-j1fl9
Error from server (BadRequest): container "istio-ingress" in pod "istio-ingress-2905358108-j1fl9" is waiting to start: ContainerCreating
Events reported
Unable to mount volumes for pod "istio-egress-1575870412-s1rs7_istio(50e9ec5e-3a38-11e7-9bb6-f23b3a6d93cf)": timeout expired waiting for volumes to attach/mount for pod "istio"/"istio-egress-1575870412-s1rs7". list of unattached/unmounted volumes=[istio-certs]
MountVolume.SetUp failed for volume "kubernetes.io/secret/50c6a34e-3a38-11e7-9bb6-f23b3a6d93cf-istio-certs" (spec.Name: "istio-certs") pod "50c6a34e-3a38-11e7-9bb6-f23b3a6d93cf" (UID: "50c6a34e-3a38-11e7-9bb6-f23b3a6d93cf") with: secrets "istio.default" not found
- istio manager
There is service account permission issue
I0516 14:19:15.164199 1 client.go:203] TPR "IstioConfig" is not ready (User "system:serviceaccount:istio:istio-manager-service-account" cannot list all istio.io.istioconfigs in the cluster). Waiting...
Error: 2 errors occurred:
* failed to register Third-Party Resources. User "system:serviceaccount:istio:istio-manager-service-account" cannot get extensions.thirdpartyresources at the cluster scope
* failed to register Third-Party Resources. Failed to create all TPRs
Usage:
manager discovery [flags]
Flags:
--discovery_cache Enable caching discovery service responses (default true)
--port int Discovery service port (default 8080)
--profile Enable profiling via web interface host:port/debug/pprof (default true)
Global Flags:
--kubeconfig string Use a Kubernetes configuration file instead of in-cluster configuration
--log_backtrace_at traceLocation when logging hits line file:N, emit a stack trace (default :0)
--meshConfig string ConfigMap name for Istio mesh configuration, config key should be "mesh" (default "istio")
-n, --namespace string Select a namespace for the controller loop. If not set, uses ${POD_NAMESPACE} environment variable
--resync duration Controller resync interval (default 1s)
-v, --v Level log level for V logs (default 0)
--vmodule moduleSpec comma-separated list of pattern=N settings for file-filtered logging
E0516 14:19:16.165480 1 main.go:245] 2 errors occurred:
* failed to register Third-Party Resources. User "system:serviceaccount:istio:istio-manager-service-account" cannot get extensions.thirdpartyresources at the cluster scope
* failed to register Third-Party Resources. Failed to create all TPRs
Metadata
Metadata
Assignees
Labels
No labels