发生内部错误：调用 webhook“validation.istio.io”失败

Question

通过使用 GCP Anthos，我在 GKE 集群上安装了 Anthos 1.11，并安装了 Online Boutique 应用程序，它按预期运行。然后尝试升级到 Anthos 1.12，升级后能够将新的 Envoy Sidecar 注入到部署中。问题是当我尝试创建如下服务条目时：

apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata: # kpt-merge: /allow-egress-googleapis
  name: allow-egress-googleapis
spec:
  hosts:
  - "accounts.google.com" # Used to get token
  - "*.googleapis.com"
  ports:
  - number: 80
    protocol: HTTP
    name: http
  - number: 443
    protocol: HTTPS
    name: https
---
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata: # kpt-merge: /allow-egress-google-metadata
  name: allow-egress-google-metadata
spec:
  hosts:
  - metadata.google.internal
  addresses:
  - 169.254.169.254 # GCE metadata server
  ports:
  - number: 80
    name: http
    protocol: HTTP
  - number: 443
    name: https
    protocol: HTTPS

我遇到以下错误：

Error from server (InternalError): error when creating "online-boutique/istio-manifests/allow-egress-googleapis.yaml": Internal error occurred: failed calling webhook "validation.istio.io": Post "https://istiod-asm-1118-0.istio-system.svc:443/validate?timeout=10s": service "istiod-asm-1118-0" not found
Error from server (InternalError): error when creating "online-boutique/istio-manifests/allow-egress-googleapis.yaml": Internal error occurred: failed calling webhook "validation.istio.io": Post "https://istiod-asm-1118-0.istio-system.svc:443/validate?timeout=10s": service "istiod-asm-1118-0" not found

不知道为什么它选择已清理的旧版本，我没有明确提及 asm 版本，它是如何选择旧版本的？我该如何解决这个问题？

Online Boutique 应用程序部署为https://cloud.google.com/service-mesh/docs/onlineboutique-install-kpt#using-ingress-gateway

谢谢 ！

Answer 1

我遇到了同样的问题。升级后，我有一些validatingwebhookconfiguration带有旧 istio 版本标记的挥之不去的对象

Name:         istiod-default-validator
Namespace:    
Labels:       app=istiod
              istio=istiod
              istio.io/rev=asm-1124-2
              istio.io/tag=default
              operator.istio.io/component=Pilot

手动删除它解决了我的问题

kubectl delete validatingwebhookconfiguration istiod-default-validator