Skip to content

Istioctl tag command can't find control plane service #38453

@joberdick-rcd

Description

@joberdick-rcd

Bug Description

When tagging a control plane with istioctl, it's not properly seeing the control plane service in it's check. This issue seems to only be with 1.13 binary. I don't have the issue in 1.12.

Steps to produce:

  1. download and install istioctl 1.13
  2. run commands
➜  ~ istioctl install --set revision=1-13-2
WARNING: Istio is being upgraded from 1.11.4 -> 1.13.2.
WARNING: Before upgrading, you may wish to use 'istioctl analyze' to check for IST0002 and IST0135 deprecation warnings.This will install the Istio 1.13.2 default profile with ["Istio core" "Istiod" "Ingress gateways"] components into the cluster. Proceed? (y/N) y
✔ Istio core installed
✔ Istiod installed
✔ Ingress gateways installed
✔ Installation complete
Thank you for installing Istio 1.13.  Please take a few minutes to tell us about your install/upgrade experience!  https://forms.gle/pzWZpAvMVBecaQ9h9
➜  ~ istioctl tag set canary --revision 1-13-2 --overwrite
creating tag would conflict, pass --skip-confirmation to proceed:
Error [IST0139] (MutatingWebhookConfiguration istio-revision-tag-canary ) Injector refers to a control plane service that does not exist: istio-system/istiod-1-13-2.
Apply anyways? [y/N] n

Service does exist:

➜  ~ kubectl get svc -n istio-system
NAME                   TYPE           CLUSTER-IP       EXTERNAL-IP                                                               PORT(S)                                      AGE
istio-ingressgateway   LoadBalancer   172.20.27.172    a0da3d6fce01d4955a3f1feeac35fcfe-1707683313.us-east-2.elb.amazonaws.com   15021:31370/TCP,80:31380/TCP,443:31987/TCP   13d
istiod-1-11-4          ClusterIP      172.20.156.128   <none>                                                                    15010/TCP,15012/TCP,443/TCP,15014/TCP        11d
istiod-1-13-2          ClusterIP      172.20.29.180    <none>                                                                    15010/TCP,15012/TCP,443/TCP,15014/TCP        5m50s

I can say yes to apply anyways and things seem to work. So it seem the service check is just bad.

Version

➜  ~ istioctl version
client version: 1.13.2
istiod version: 1.11.4
istiod version: 1.11.4
istiod version: 1.11.4
istiod version: 1.13.2
data plane version: 1.11.4 (26 proxies), 1.13.2 (3 proxies)
➜  ~ kubectl version --short
Client Version: v1.21.2
Server Version: v1.21.5-eks-bc4871b

Additional Information

No response

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions