Azure-docs: When using Istio with Avaliability Zone AKS cluster, it was failed.

[kyanagimoto]

Even if I do the same as described, Istio Install was failed.
My kubernetes cluster was build with AvailabilityZone cluster.

Situation is istio-policy, Istio-security-post and istio-tracing are doing crashLoopBackOff.

How can I avoid this situation?

kubernetes version: 1.14.8
helm: 2.14.3
istio: 1.3.3

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 6d64cf65-bf33-ff76-3ece-47c758479506
• Version Independent ID: c2db9de5-62ef-5bd0-83dc-1832113ae37c
• Content: Install Istio in Azure Kubernetes Service (AKS)
• Content Source: articles/aks/servicemesh-istio-install.md
• Service: container-service
• GitHub Login: @paulbouwer
• Microsoft Alias: pabouwer

[mimckitt]

Thanks for the question! We are investigating and will update you shortly.

[mimckitt]

@kyanagimoto can you share the error messages and the point in the doc you are getting stuck? Some screenshots might be useful as well to better help me understand your issue.

[kyanagimoto]

Hi, @MicahMcKittrick-MSFT .
Thanks to reply.

Situation is when input helm install command, pods are like this.

% kubectl get pods -n istio-system
NAME                                      READY   STATUS             RESTARTS   AGE
grafana-77f4648c67-95hgg                  1/1     Running            0          6m3s
istio-citadel-5c479b75dc-qgdqw            1/1     Running            0          6m2s
istio-galley-56874c7d4b-l8nfb             1/1     Running            0          6m3s
istio-grafana-post-install-1.3.3-kt7xv    0/1     Completed          0          6m2s
istio-ingressgateway-8c4ccf4f7-fbdx9      0/1     Running            0          6m3s
istio-init-crd-10-1.3.3-9kkvx             0/1     Completed          0          22m
istio-init-crd-11-1.3.3-thczw             0/1     Completed          0          22m
istio-init-crd-12-1.3.3-sq24w             0/1     Completed          0          22m
istio-pilot-6dc8d8c745-qf4sl              1/2     Running            0          6m3s
istio-policy-64b6f6f646-wgl7l             1/2     CrashLoopBackOff   6          6m3s
istio-security-post-install-1.3.3-sxpck   0/1     Error              2          5m31s
istio-sidecar-injector-874dcc9fb-25m8f    1/1     Running            0          6m2s
istio-telemetry-c667865c5-64zhg           2/2     Running            2          6m3s
istio-tracing-57f99f8bdb-8s4jq            0/1     Running            6          6m2s
kiali-5cf9664d6c-cj7xp                    1/1     Running            0          6m3s
prometheus-6d76f584cf-rk4ml               1/1     Running            0          6m2s

istio-policy, istio-pilot, istio-telemetry and istio-tracing is not stable, restart again and again, then

% helm install istio.io/istio --name istio --namespace istio-system --version 1.3.3 \
  --set global.controlPlaneSecurityEnabled=true \
  --set global.mtls.enabled=true \
  --set grafana.enabled=true --set grafana.security.enabled=true \
  --set tracing.enabled=true \
  --set kiali.enabled=true \
  --set global.defaultNodeSelector."beta\.kubernetes\.io/os"=linux

Error: timed out waiting for the condition

helm install command return timeout error.

These are the situation I faced.

Please let me know If you need more information.

Thanks.

[mimckitt]

@kyanagimoto thanks for that. Last thing to check, this doc has a few different versions depending on the Client OS. Windows, Linux and MacOS

Can you confirm you are selecting the correct doc to follow based on your OS?

[kyanagimoto]

Yes, I'm choosing MacOS.

[mimckitt]

Adding @raduart who opened another issue regarding the same section.

@paulbouwer can you take a look at these? Seems we have multiple users hitting issues at the same point in the document.

[paulbouwer]

@kyanagimoto @MicahMcKittrick-MSFT

I created an 1.14.7 AKS cluster with zones, and used Helm 2.15.2 with Istio 1.3.3. I didn't get any errors.

In Issue #42366, there was an issue with successfully deploying with Helm 2.16.0. I would suggest retrying with Istio 1.3.3 and Helm 2.15.2.

I created the cluster as follows:

az group create --name $RESOURCEGROUP --location $LOCATION

MONITORING_WORKSPACE_RESOURCEID=$(az resource create -g $RESOURCEGROUP --resource-type=Microsoft.OperationalInsights/workspaces -n $RESOURCEGROUP --api-version "2015-11-01-preview" -l $LOCATION -p '{ "sku":{ "Name": "Standalone"} }' --query "id" -o tsv)

az aks create --name $AKS_NAME \
     --resource-group $RESOURCEGROUP \
     --kubernetes-version $KUBERNETES_VERSION --location $LOCATION \
     --nodepool-name linux --node-count 3 --node-vm-size "Standard_D4s_v3" \
     --load-balancer-sku standard \
     --vm-set-type VirtualMachineScaleSets --enable-addons monitoring \
     --network-plugin azure --network-policy azure \
     --workspace-resource-id $MONITORING_WORKSPACE_RESOURCEID \
     --ssh-key-value "~/.ssh/id_rsa.pub" \
     --service-principal $SERVICEPRINCIPAL_APPID --client-secret $SERVICEPRINCIPAL_SECRET \
     --zones 1 2 3

[mimckitt]

Thanks @paulbouwer I saw your comment about the helm version in the other issue and confirmed that appears to fix the error I was seeing. @kyanagimoto it will likely fix yours as well. Can you test and let us know?

[raduart]

Hi
On my case I was using Helm 2.16.0 but for installing ISTIO 1.3.2 and it was failling...
I will try to use ISTIO 1.3.3 version...
Thanks

[kyanagimoto]

@MicahMcKittrick-MSFT
Got it. I'll try to :)

Thanks.

[kyanagimoto]

Hi, @paulbouwer
@MicahMcKittrick-MSFT

I have a question about "--network-plugin azure" option.
Is it required?

I used "kubenet" for this option, but after changed to "azure", istio installation works.

Thanks.

[paulbouwer]

@kyanagimoto - I always tend to use the Azure CNI --network-plugin azure option, but I don't remember there if there were issues with kubenet.

Are you happy to close this issue?

[kyanagimoto]

@paulbouwer - Sure, NP.
Now using with azure CNI :)