Skip to content

Deployment issue on OpenShift #283

@cmoulliard

Description

@cmoulliard

When we try to deploy istio on openshift, different issues are reported

Scenario followed

minishift start --memory 5000
oc new-project istio

oc apply -f install/kubernetes/istio-auth.yaml
oc apply -f install/kubernetes/addons/prometheus.yaml
oc apply -f install/kubernetes/addons/grafana.yaml
oc apply -f install/kubernetes/addons/servicegraph.yaml
oc apply -f install/kubernetes/addons/zipkin.yaml

oc expose svc/grafana
oc expose svc/servicegraph
oc expose svc/zipkin

Errors

  1. Permission denied

The docker user which is used by grafana/prometheus container doesn't has the permission to change ownership or create a folder.

oc logs grafana-851518138-z76l9
chown: changing ownership of '/data/grafana': Operation not permitted
chown: changing ownership of '/var/log/grafana': Operation not permitted

oc logs prometheus-3208567892-08nvd
time="2017-05-16T14:14:44Z" level=info msg="Starting prometheus (version=1.1.1, branch=release-1.0, revision=ab312a075f810e2ed124783c46d68674af071293)" source="main.go:73"
time="2017-05-16T14:14:44Z" level=info msg="Build context (go=go1.6.3, user=root@8ab14ddb4898, date=20160907-09:37:01)" source="main.go:74"
time="2017-05-16T14:14:44Z" level=info msg="Loading configuration file /etc/prometheus/prometheus.yml" source="main.go:221"
time="2017-05-16T14:14:44Z" level=error msg="Error opening memory series storage: mkdir data: permission denied" source="main.go:158"
  1. Waiting to start as they are looking abut the secrets

The ingress and egress contains can't be started

oc logs istio-egress-1575870412-s1rs7
Error from server (BadRequest): container "proxy" in pod "istio-egress-1575870412-s1rs7" is waiting to start: ContainerCreating
oc logs istio-ingress-2905358108-j1fl9
Error from server (BadRequest): container "istio-ingress" in pod "istio-ingress-2905358108-j1fl9" is waiting to start: ContainerCreating

Events reported

Unable to mount volumes for pod "istio-egress-1575870412-s1rs7_istio(50e9ec5e-3a38-11e7-9bb6-f23b3a6d93cf)": timeout expired waiting for volumes to attach/mount for pod "istio"/"istio-egress-1575870412-s1rs7". list of unattached/unmounted volumes=[istio-certs]
MountVolume.SetUp failed for volume "kubernetes.io/secret/50c6a34e-3a38-11e7-9bb6-f23b3a6d93cf-istio-certs" (spec.Name: "istio-certs") pod "50c6a34e-3a38-11e7-9bb6-f23b3a6d93cf" (UID: "50c6a34e-3a38-11e7-9bb6-f23b3a6d93cf") with: secrets "istio.default" not found
  1. istio manager

There is service account permission issue

I0516 14:19:15.164199       1 client.go:203] TPR "IstioConfig" is not ready (User "system:serviceaccount:istio:istio-manager-service-account" cannot list all istio.io.istioconfigs in the cluster). Waiting...
Error: 2 errors occurred:

* failed to register Third-Party Resources. User "system:serviceaccount:istio:istio-manager-service-account" cannot get extensions.thirdpartyresources at the cluster scope
* failed to register Third-Party Resources. Failed to create all TPRs
Usage:
  manager discovery [flags]

Flags:
      --discovery_cache   Enable caching discovery service responses (default true)
      --port int          Discovery service port (default 8080)
      --profile           Enable profiling via web interface host:port/debug/pprof (default true)

Global Flags:
      --kubeconfig string                Use a Kubernetes configuration file instead of in-cluster configuration
      --log_backtrace_at traceLocation   when logging hits line file:N, emit a stack trace (default :0)
      --meshConfig string                ConfigMap name for Istio mesh configuration, config key should be "mesh" (default "istio")
  -n, --namespace string                 Select a namespace for the controller loop. If not set, uses ${POD_NAMESPACE} environment variable
      --resync duration                  Controller resync interval (default 1s)
  -v, --v Level                          log level for V logs (default 0)
      --vmodule moduleSpec               comma-separated list of pattern=N settings for file-filtered logging

E0516 14:19:16.165480       1 main.go:245] 2 errors occurred:

* failed to register Third-Party Resources. User "system:serviceaccount:istio:istio-manager-service-account" cannot get extensions.thirdpartyresources at the cluster scope
* failed to register Third-Party Resources. Failed to create all TPRs

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions