Istio helm chart install failed when enable sidecar-injector #3864
Description
env:
centos: 7.2
istio version: 0.6.0
kubenetes version: v1.9.1
action:
helm install --name istio --namespace istio-system --set sidecar-injector.enabled=true ./istio
problem:
Error: release istio failed: MutatingWebhookConfiguration in version "v1beta1" cannot be handled as a MutatingWebhookConfiguration: v1beta1.MutatingWebhookConfiguration: Webhooks: []v1beta1.Webhook: v1beta1.Webhook: ClientConfig: v1beta1.WebhookClientConfig: Service: CABundle: decode base64: illegal base64 data at input byte 0, parsing 339 ...A_BUNDLE}"... at {"apiVersion":"admissionregistration.k8s.io/v1beta1","kind":"MutatingWebhookConfiguration","metadata":{"labels":{"app":"sidecar-injector","chart":"sidecar-injector-0.5.0","heritage":"Tiller","istio":"sidecar-injector","release":"istio"},"name":"istio-sidecar-injector","namespace":""},"webhooks":[{"clientConfig":{"caBundle":"${CA_BUNDLE}","service":{"name":"istio-sidecar-injector","namespace":"istio-system","path":"/inject"}},"name":"sidecar-injector.istio.io","namespaceSelector":{"matchLabels":{"istio-injection":"enabled"}},"rules":[{"apiGroups":[""],"apiVersions":["v1"],"operations":["CREATE"],"resources":["pods"]}]}]}
While the admissionregistration.k8s.io/v1beta1 API enabled:
[admin@mstnode helm]# kubectl api-versions | grep admissionregistration
admissionregistration.k8s.io/v1alpha1
admissionregistration.k8s.io/v1beta1
And kube-apiserver process has the admission-control flag set with the MutatingAdmissionWebhook and ValidatingAdmissionWebhook admission controllers added and listed in the correct order:
--admission-control=Initializers,NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,PodSecurityPolicy,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota