echoing the same frustration with istio... but it sure is making me try to understand what is going on under the covers. helm install --namespace=istio-system --timeout=10m0s --values=/home/shell/helm/values-rancher-istio-100.3.0-up1.13.3.yaml --version=100.3.0+up1.13.3 --wait=true rancher-istio /home/shell/helm/rancher-istio-100.3.0-up1.13.3.tgzFri, Jul 29 2022 123257 amW0729 043257.676804 22 warnings.go:70] policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+Fri, Jul 29 2022 123257 amW0729 043257.680264 22 warnings.go:70] policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+Fri, Jul 29 2022 123257 amW0729 043257.683708 22 warnings.go:70] policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+Fri, Jul 29 2022 123257 amW0729 043257.687063 22 warnings.go:70] policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+Fri, Jul 29 2022 123257 amcreating 29 resource(s)Fri, Jul 29 2022 123257 amW0729 043257.808827 22 warnings.go:70] policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+Fri, Jul 29 2022 123257 amW0729 043257.816151 22 warnings.go:70] policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+Fri, Jul 29 2022 123257 amW0729 043257.816707 22 warnings.go:70] policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+Fri, Jul 29 2022 123257 amW0729 043257.823168 22 warnings.go:70] policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+Fri, Jul 29 2022 123258 ambeginning wait for 29 resources with timeout of 10m0sFri, Jul 29 2022 123258 amStarting delete for "istioctl-installer" JobFri, Jul 29 2022 123258 amjobs.batch "istioctl-installer" not foundFri, Jul 29 2022 123258 amcreating 1 resource(s)Fri, Jul 29 2022 123258 amWatching for changes to Job istioctl-installer with timeout of 10m0sFri, Jul 29 2022 123258 amAdd/Modify event for istioctl-installer: ADDEDFri, Jul 29 2022 123258 amistioctl-installer: Jobs active: 0, jobs failed: 0, jobs succeeded: 0Fri, Jul 29 2022 123258 amAdd/Modify event for istioctl-installer: MODIFIEDFri, Jul 29 2022 123258 amistioctl-installer: Jobs active: 1, jobs failed: 0, jobs succeeded: 0Fri, Jul 29 2022 123901 amAdd/Modify event for istioctl-installer: MODIFIEDFri, Jul 29 2022 123901 amistioctl-installer: Jobs active: 1, jobs failed: 1, jobs succeeded: 0Fri, Jul 29 2022 124258 amError: INSTALLATION FAILED: failed post-install: timed out waiting for the condition is this just a timeout issue? kubectl shows a timeout. Anyone have a link to common istio and sidecar issues so I can learn more about where it's taking so long... maybe it's just the machine types I'm using on GKE or maybe because I selected CNI integtration. Any ideas? I'd love to solve this myself cause that's pretty much all I am using Rancher server for but wouldn't mind some free breadcrumbs to help me figure it out.

nevermind... I see the extra steps documented for using an overlay in both Istio and Rancher docs. I bet that is it!

also, the masterclasses help 😉

Hi , I have setup multi cluster istio mesh. ( Install Multi-Primary on different networks) Staring with 2 clusters both acting as primary. These clusters are managed through Rancher. Deployed sample httpbin app and while testing noticed that traffic is going to local cluster only. Seeing some x509 certificate errors in istiod pod related to unable to read CRDS. any idea what's going on?

It appears that the istio project is using an istio-operator for it's installs after istio 1.4. However rancher continues to maintain a downstream helm chart which I like and prefer. But hitting on an issue where I cannot install istio-csr without using the operator. Is there some documentation for doing that in the rancher-istio? What is rancher-istio best practice for certificate management?

Hi All, looking for some help with an issue we are seeing; Rancher was reinstalled and the previously existing cluster re-imported. That cluster had istio installed through the UI, and after importing the rancher UI now reports istio as not being enabled. Can see this in the api, istioEnabled is definitely set to False. Is there a way we can get the UI/Rancher to recognise the existing istio installation?

Hi , getting below error while rbac depolyment on istio leads to api version issues & crd's also missing. please suggest me any thing need to add. OS & version -RHEL & 8 istio version -1.15.0 Kubernetes version- 1.23 error: unable to recognize "rbac-config.yaml": no matches for kind "RbacConfig" in version "rbac.istio.io/v1alpha1"

Hi Team, getting below error while install Istio using helm charts. please suggest me. doc link - https://istio.io/latest/docs/setup/install/helm/ os -- ubuntu-20 helm version-v3

@worried-motorcycle-14532 has left the channel

Upgrading the Istio chart from last release to rancher-istio:102.0.0+up1.15.3 on RKE2 with CNI enabled results in the istio-cni-node pods faulting with CrashLoopBackOff Looking at the pod log it appears to be something basic that's wrong with the setup. Error: unknown flag: --log_output_level │ │ Usage: │ │ install-cni [flags] <and all the flags>

Never mind - solved it.

another istio question. I want to mess around and learn the thing every says not to, "never go full service mesh" What is the best CNI to start off with on a RKE2 cluster when installing istio and it's CNI to avoid any host issues I see in the notes?

@big-ram-67315 has left the channel

Having a heck of a time with gateways and virtual services and a cluster that already has standard ingress (nginx)

using RKE2 cluster deployed via Rancher (v1.26.5+rke2r1)

using istio

I'm missing a step somewhere

so it uses the istio gateway

the instructions are lacking in my opinion

but it most likely is lack of experience on my end as well with istio 🙂

also can the default ingress controller and istio-ingressgateway run in parallel or do I have to kill the ingress controller (k8s - nginx)?

should have mentioned this is on prem

noticed that the gateway is type node-port 😭

so it is working, I can hit node-port on a node and can see it using the gateway/virtual service

I was assuming it was going to behave like ingress controller

for ingress into the cluster and opening ports (80/443)