Question

K8S版本：1.14.2

Istio版本：1.12.4

OS：CentOS 7

遵循本指南，但发生错误。

https://istio.io/docs/examples/bookinfo/

$ kubectl describe rs details-v1-c5b5f496d
....
Events:
  Type     Reason        Age                   From                   Message
  ----     ------        ----                  ----                   -------
  Warning  FailedCreate  8m38s (x18 over 19m)  replicaset-controller  Error creating: Internal error occurred: failed calling webhook "sidecar-injector.istio.io": Post https://istio-sidecar-injector.istio-system.svc:443/inject?timeout=30s: x509: certificate signed by unknown authority

[root@centos-10-90-152-38 k8s]# kubectl get mutatingwebhookconfiguration istio-sidecar-injector -o yaml -o jsonpath='{.webhooks[0].clientConfig.caBundle}' | md5sum
7a67a48a97a2c079958225147a65d7cb  -
[root@centos-10-90-152-38 k8s]# kubectl -n istio-system get secret istio.istio-sidecar-injector-service-account -o jsonpath='{.data.root-cert\.pem}' | md5sum
7a67a48a97a2c079958225147a65d7cb  -

Answer 1

来自istio.io：

“ x509：由未知权限相关的错误签名的证书通常是由Webhook配置中的空caBundle引起的。”

以下链接中提供了故障排除提示：

istio.io: creating-configuration-fails-with-x509-certificate-errors

在istio中创建吊舱时发生“ x509：证书由未知权限签名”错误

1 个答案: