Error installing Apigee Hybrid on EKS

Google Cloud Apigee
1

Hi All ,

I am new to this community, We are trying to install Apigee Hybrid on EKS following the google documentation.

https://cloud.google.com/apigee/docs/hybrid/v1.7/install-hybrid-runtime

While performing the last step , we get the error .

Error from server (InternalError): error when creating “STDIN”: Internal error occurred: failed calling webhook “validation.istio.io”: Post “https://istiod.istio-system.svc:443/validate?timeout=10s”: service “istiod” not found .

We did follow the ASM installation
https://cloud.google.com/apigee/docs/hybrid/v1.7/install-asm#eks

even though the installation is successful, I don’t see svc with name istiod instead we see other two services ,

istio-ingressgateway

istiod-asm-1128-2

Also the overlay.yaml file is messed up so I need to fix it first.

Kubectl version

Client Version: version.Info{Major:“1”, Minor:“20”, GitVersion:“v1.20.15”, GitCommit:“8f1e5bf0b9729a899b8df86249b56e2c74aebc55”, GitTreeState:“clean”, BuildDate:“2022-01-19T17:27:39Z”, GoVersion:“go1.15.15”, Compiler:“gc”, Platform:“darwin/amd64”}

Server Version: version.Info{Major:“1”, Minor:“21+”, GitVersion:“v1.21.13-eks-84b4fe6”, GitCommit:“e1318dce57b3e319a2e3fecf343677d1c4d4aa75”, GitTreeState:“clean”, BuildDate:“2022-06-09T18:22:07Z”, GoVersion:“go1.16.15”, Compiler:“gc”, Platform:“linux/amd64”}

Any help is appreciated.

Thanks,

Hanu

2

  1. Get the manifests generated and confirm the istiod svc is listed in it.
    https://istio.io/latest/docs/setup/install/istioctl/#generate-a-manifest-before-installation

  2. Run the istioctl verify-install option to check its results
    https://istio.io/latest/docs/setup/install/istioctl/#verify-a-successful-installation

Thanks
Gana

3

Hi Gana,

Thanks for reply .

I did generate and verify the manifest files.

$ istioctl manifest generate --set profile=asm-multicloud --set revision=“asm-1128-2” --filename overlay.yaml > generated-manifest.yaml

$ istioctl verify-install -f generated-manifest.yaml

:check_mark: CustomResourceDefinition: authorizationpolicies.security.istio.io.istio-system checked successfully

:check_mark: CustomResourceDefinition: dataplanecontrols.mesh.cloud.google.com.istio-system checked successfully

:check_mark: CustomResourceDefinition: destinationrules.networking.istio.io.istio-system checked successfully

:check_mark: CustomResourceDefinition: envoyfilters.networking.istio.io.istio-system checked successfully

:check_mark: CustomResourceDefinition: gateways.networking.istio.io.istio-system checked successfully

:check_mark: CustomResourceDefinition: istiooperators.install.istio.io.istio-system checked successfully

:check_mark: CustomResourceDefinition: peerauthentications.security.istio.io.istio-system checked successfully

:check_mark: CustomResourceDefinition: requestauthentications.security.istio.io.istio-system checked successfully

:check_mark: CustomResourceDefinition: serviceentries.networking.istio.io.istio-system checked successfully

:check_mark: CustomResourceDefinition: sidecars.networking.istio.io.istio-system checked successfully

:check_mark: CustomResourceDefinition: telemetries.telemetry.istio.io.istio-system checked successfully

:check_mark: CustomResourceDefinition: virtualservices.networking.istio.io.istio-system checked successfully

:check_mark: CustomResourceDefinition: wasmplugins.extensions.istio.io.istio-system checked successfully

:check_mark: CustomResourceDefinition: workloadentries.networking.istio.io.istio-system checked successfully

:check_mark: CustomResourceDefinition: workloadgroups.networking.istio.io.istio-system checked successfully

:check_mark: ServiceAccount: istio-ingressgateway-service-account.istio-system checked successfully

:check_mark: ServiceAccount: istio-reader-service-account.istio-system checked successfully

:check_mark: ServiceAccount: istiod-asm-1128-2.istio-system checked successfully

:check_mark: ServiceAccount: istiod-service-account.istio-system checked successfully

:check_mark: ClusterRole: istio-reader-clusterrole-asm-1128-2-istio-system.istio-system checked successfully

:check_mark: ClusterRole: istio-reader-istio-system.istio-system checked successfully

:check_mark: ClusterRole: istiod-clusterrole-asm-1128-2-istio-system.istio-system checked successfully

:check_mark: ClusterRole: istiod-gateway-controller-asm-1128-2-istio-system.istio-system checked successfully

:check_mark: ClusterRole: istiod-istio-system.istio-system checked successfully

:check_mark: ClusterRoleBinding: istio-reader-clusterrole-asm-1128-2-istio-system.istio-system checked successfully

:check_mark: ClusterRoleBinding: istio-reader-istio-system.istio-system checked successfully

:check_mark: ClusterRoleBinding: istiod-clusterrole-asm-1128-2-istio-system.istio-system checked successfully

:check_mark: ClusterRoleBinding: istiod-gateway-controller-asm-1128-2-istio-system.istio-system checked successfully

:check_mark: ClusterRoleBinding: istiod-istio-system.istio-system checked successfully

:check_mark: ValidatingWebhookConfiguration: istio-validator-asm-1128-2-istio-system.istio-system checked successfully

:check_mark: EnvoyFilter: stats-filter-1.10-asm-1128-2.istio-system checked successfully

:check_mark: EnvoyFilter: stats-filter-1.11-asm-1128-2.istio-system checked successfully

:check_mark: EnvoyFilter: stats-filter-1.12-asm-1128-2.istio-system checked successfully

:check_mark: EnvoyFilter: stats-filter-1.13-asm-1128-2.istio-system checked successfully

:check_mark: EnvoyFilter: tcp-stats-filter-1.10-asm-1128-2.istio-system checked successfully

:check_mark: EnvoyFilter: tcp-stats-filter-1.11-asm-1128-2.istio-system checked successfully

:check_mark: EnvoyFilter: tcp-stats-filter-1.12-asm-1128-2.istio-system checked successfully

:check_mark: EnvoyFilter: tcp-stats-filter-1.13-asm-1128-2.istio-system checked successfully

:check_mark: ConfigMap: istio-asm-1128-2.istio-system checked successfully

:check_mark: ConfigMap: istio-sidecar-injector-asm-1128-2.istio-system checked successfully

:check_mark: MutatingWebhookConfiguration: istio-sidecar-injector-asm-1128-2.istio-system checked successfully

:check_mark: Deployment: istio-ingressgateway.istio-system checked successfully

:check_mark: Deployment: istiod-asm-1128-2.istio-system checked successfully

:check_mark: PodDisruptionBudget: istio-ingressgateway.istio-system checked successfully

:check_mark: PodDisruptionBudget: istiod-asm-1128-2.istio-system checked successfully

:check_mark: Role: istio-ingressgateway-sds.istio-system checked successfully

:check_mark: Role: istiod-asm-1128-2.istio-system checked successfully

:check_mark: Role: istiod-istio-system.istio-system checked successfully

:check_mark: RoleBinding: istio-ingressgateway-sds.istio-system checked successfully

:check_mark: RoleBinding: istiod-asm-1128-2.istio-system checked successfully

:check_mark: RoleBinding: istiod-istio-system.istio-system checked successfully

:check_mark: HorizontalPodAutoscaler: istio-ingressgateway.istio-system checked successfully

:check_mark: HorizontalPodAutoscaler: istiod-asm-1128-2.istio-system checked successfully

:check_mark: Service: istio-ingressgateway.istio-system checked successfully

:check_mark: Service: istiod-asm-1128-2.istio-system checked successfully

Checked 15 custom resource definitions

Checked 2 Istio Deployments

:check_mark: Istio is installed and verified successfully

I see only 2 services compared 3 as shown in installation Doc .

Should apigeectl look for svc istiod-asm-1128-2 instead of svc istiod ? is this value configurable ?