CNI Troubleshooting

NetworkAttachmentDefinition resources required for namespaces in service mesh

In CNI mode you must also create a NetworkAttachmentDefinition in each namespace where sidecar injection should occur:

cat <<EOF | kubectl apply -f -
apiVersion: "k8s.cni.cncf.io/v1"
kind: NetworkAttachmentDefinition
metadata:
  name: istio-cni
spec:
  config: ''
EOF

Aspen Mesh istio pods won’t start up in istio-system namespace

Inspect the events using

kubectl get events -n istio-system

If you see events similar to

3m30s       Warning   FailedCreate                   replicaset/istiod-76f7cf9cc6                              Error creating: pods "istiod-76f7cf9cc6-" is forbidden: unable to validate against any security context constraint: [fsGroup: Invalid value: []int64{1337}: 1337 is not an allowed group spec.containers[0].securityContext.securityContext.runAsUser: Invalid value: 1337: must be in the ranges: [1000620000, 1000629999]]

then you are missing prerequisite security context constraints. To fix this run the following commands:

oc adm policy add-scc-to-group anyuid system:serviceaccounts:istio-system

and then re-install Aspen Mesh.

For OpenShift

For OpenShift clusters specifically, the user ID of the istio sidecar injected into each application is blocked by default. To allow the use of additional namespaces, you must add security context constraints to them as well. Replace <target-namespace> with the namespace you would like to allow:

oc adm policy add-scc-to-group anyuid system:serviceaccounts:<target-namespace>

When removing your applications, remove the constraints:

oc adm policy remove-scc-from-group anyuid system:serviceaccounts:<target-namespace>