Istio 설치 방법, 그리고 삽질 (EKS)

Tech Note 정보: 스벅오늘의커피 님이 작성하신 글입니다.; 카테고리: [ Cloud Computing & MSA ]; 게시됨: 16 June 2022; 작성됨: 16 June 2022; 최종 변경: 16 June 2022; 조회수: 5443

Kubernetes

1. 개요

Istio 설치 방법이다.
설치 환경은 EKS이다.

2. 다운로드 및 설치

$ curl -sL https://istio.io/downloadIstioctl | sh -

Downloading istioctl-1.14.1 from https://github.com/istio/istio/releases/download/1.14.1/istioctl-1.14.1-linux-amd64.tar.gz ...
istioctl-1.14.1-linux-amd64.tar.gz download complete!

Add the istioctl to your path with:
  export PATH=$PATH:$HOME/.istioctl/bin

Begin the Istio pre-installation check by running:
     istioctl x precheck

Need more information? Visit https://istio.io/docs/reference/commands/istioctl/

정상적으로 다운로드하고 나면 다음과 같이 어딘가에 복사해준다.

$ sudo cp ~/.istioctl/bin/istioctl /usr/local/bin

3. YAML 파일 설정

3.1. YAML 파일

apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  namespace: istio-system
  name: istiocontrolplane
spec:
  profile: default
  components:
    egressGateways:
    - name: istio-egressgateway
      enabled: true
      k8s:
        hpaSpec:
          minReplicas: 2
    ingressGateways:
    - name: istio-ingressgateway
      enabled: true
      k8s:
        hpaSpec:
          minReplicas: 2
    pilot:
      enabled: true
      k8s:
        hpaSpec:
          minReplicas: 2
  meshConfig:
    enableTracing: true
    defaultConfig:
      holdApplicationUntilProxyStarts: true
    accessLogFile: /dev/stdout
    outboundTrafficPolicy:
      mode: REGISTRY_ONLY

3.2. YAML 파일 설치

$ istioctl install -f istio.yaml
This will install the Istio 1.14.1 default profile with ["Istio core" "Istiod" "Ingress gateways" "Egress gateways"] components into the cluster. Proceed? (y/N) y
✔ Istio core installed
- Processing resources for Istiod. Waiting for Deployment/istio-system/istiod

하지만 정상적으로 설치되지 않았다.

3.3. 트러블 슈팅

$ istioctl install -f istio.yaml
This will install the Istio 1.14.1 default profile with ["Istio core" "Istiod" "Ingress gateways" "Egress gateways"] components into the cluster. Proceed? (y/N) y
✔ Istio core installed
✘ Istiod encountered an error: failed to wait for resource: resources not ready after 5m0s: timed out waiting for the condition

✘ Egress gateways encountered an error: failed to wait for resource: resources not ready after 5m0s: timed out waiting for the condition
  Deployment/istio-system/istio-egressgateway (container failed to start: ContainerCreating: )
✘ Ingress gateways encountered an error: failed to wait for resource: resources not ready after 5m0s: timed out waiting for the condition
  Deployment/istio-system/istio-ingressgateway (container failed to start: ContainerCreating: )
- Pruning removed resources                                                                                            Error: failed to install manifests: errors occurred during operation

하지만 Namespace나 Pod를 확인하면 일단 리소스는 생성되는 상태이다. 파드 생성 중 걸린 상황으로 추정.

$ kubectl get ns
NAME              STATUS   AGE
default           Active   5h11m
istio-system      Active   12m
kube-node-lease   Active   5h11m
kube-public       Active   5h11m
kube-system       Active   5h11m
$ kubectl get pods -A
NAMESPACE      NAME                                   READY   STATUS              RESTARTS   AGE
istio-system   istio-egressgateway-f48d65b7b-9wxrk    0/1     ContainerCreating   0          7m29s
istio-system   istio-egressgateway-f48d65b7b-f7ldf    0/1     ContainerCreating   0          7m44s
istio-system   istio-ingressgateway-778f44479-6ql4q   0/1     ContainerCreating   0          7m44s
istio-system   istio-ingressgateway-778f44479-dvgzr   0/1     ContainerCreating   0          7m29s
istio-system   istiod-6d67d84bc7-4mn82                0/1     Pending             0          12m
istio-system   istiod-6d67d84bc7-5zksw                0/1     Pending             0          12m
kube-system    aws-node-5wz6c                         1/1     Running             0          5h2m
kube-system    aws-node-r6dbq                         1/1     Running             0          5h2m
kube-system    coredns-6dbb778559-wk9w2               1/1     Running             0          5h11m
kube-system    coredns-6dbb778559-z5ckv               1/1     Running             0          5h11m
kube-system    kube-proxy-2k56c                       1/1     Running             0          5h2m
kube-system    kube-proxy-7v9fb                       1/1     Running             0          5h2m

컨테이너 시작 단계에 있는 Pod 상태를 확인해보았다.

Events:
  Type     Reason       Age                 From               Message
  ----     ------       ----                ----               -------
  Normal   Scheduled    10m                 default-scheduler  Successfully assigned istio-system/istio-egressgateway-f48d65b7b-9wxrk to ip-10-21-130-46.ap-northeast-2.compute.internal
  Warning  FailedMount  8m40s               kubelet            Unable to attach or mount volumes: unmounted volumes=[istiod-ca-cert], unattached volumes=[workload-socket egressgateway-ca-certs workload-certs istio-envoy config-volume egressgateway-certs podinfo kube-api-access-kmrb7 istio-token istio-data istiod-ca-cert]: timed out waiting for the condition
  Warning  FailedMount  6m25s               kubelet            Unable to attach or mount volumes: unmounted volumes=[istiod-ca-cert], unattached volumes=[egressgateway-ca-certs workload-certs istiod-ca-cert config-volume workload-socket istio-token istio-data egressgateway-certs istio-envoy podinfo kube-api-access-kmrb7]: timed out waiting for the condition
  Warning  FailedMount  4m9s                kubelet            Unable to attach or mount volumes: unmounted volumes=[istiod-ca-cert], unattached volumes=[workload-certs kube-api-access-kmrb7 config-volume istiod-ca-cert istio-token istio-data workload-socket egressgateway-certs egressgateway-ca-certs istio-envoy podinfo]: timed out waiting for the condition
  Warning  FailedMount  112s                kubelet            Unable to attach or mount volumes: unmounted volumes=[istiod-ca-cert], unattached volumes=[egressgateway-ca-certs podinfo workload-socket istio-token istio-data istio-envoy egressgateway-certs kube-api-access-kmrb7 workload-certs config-volume istiod-ca-cert]: timed out waiting for the condition
  Warning  FailedMount  27s (x13 over 10m)  kubelet            MountVolume.SetUp failed for volume "istiod-ca-cert" : configmap "istio-ca-root-cert" not found

자, 문제는 istiod가 실행되어 있지 않아서이다. 펜딩 걸려있는 istiod 상태를 보자.

QoS Class:                   Burstable
Node-Selectors:              
Tolerations:                 node.kubernetes.io/not-ready:NoExecute op=Exists for 300s
                             node.kubernetes.io/unreachable:NoExecute op=Exists for 300s
Events:
  Type     Reason            Age                 From               Message
  ----     ------            ----                ----               -------
  Warning  FailedScheduling  17s (x20 over 18m)  default-scheduler  0/2 nodes are available: 2 Insufficient memory.

메모리 부족으로 스케줄링이 안되었다.

메모리 상태를 확인하였다.

$ kubectl edit replicaset/istiod-6d67d84bc7 -n istio-system

        resources:
          requests:
            cpu: 500m
            memory: 2Gi

2G 메모리를 512M로 변경하였다.

$ kubectl get pods -A
NAMESPACE      NAME                                   READY   STATUS    RESTARTS   AGE
istio-system   istio-egressgateway-f48d65b7b-9wxrk    1/1     Running   0          21m
istio-system   istio-egressgateway-f48d65b7b-f7ldf    1/1     Running   0          22m
istio-system   istio-ingressgateway-778f44479-6ql4q   1/1     Running   0          22m
istio-system   istio-ingressgateway-778f44479-dvgzr   1/1     Running   0          21m
istio-system   istiod-5c6c78b9f6-gq924                0/1     Pending   0          65s
istio-system   istiod-5c6c78b9f6-v4rqv                0/1     Pending   0          65s
kube-system    aws-node-5wz6c                         1/1     Running   0          5h17m
kube-system    aws-node-r6dbq                         1/1     Running   0          5h17m
kube-system    coredns-6dbb778559-wk9w2               1/1     Running   0          5h25m
kube-system    coredns-6dbb778559-z5ckv               1/1     Running   0          5h25m
kube-system    kube-proxy-2k56c                       1/1     Running   0          5h17m
kube-system    kube-proxy-7v9fb                       1/1     Running   0          5h17m

전체 Running으로 전환 완료.

4. 특정 Namespace에 Istio 설정

$ kubectl label namespace <네임스페이스이름> istio-injection=enabled
namespace/community labeled

ID 생성

Istio 설치 방법, 그리고 삽질 (EKS)

1. 개요

2. 다운로드 및 설치

3. YAML 파일 설정

3.1. YAML 파일

3.2. YAML 파일 설치

3.3. 트러블 슈팅

4. 특정 Namespace에 Istio 설정

sarc.logo

Docker 가상 환경 구축 입문 (by snowball)

MySQL & MariaDB (by kimdubi)

Tech Note

Tech Note 인기 Tags

게시판

메시지함

Sponsor