Istio 1.4.7 - Kiali pod无法启动

Question

在安装了Istio 1.4.7之后，Kiali pod没有整齐地显示出来。它因错误而失败- signing key for login tokens is invalid

kubectl get po -n istio-system | gre kiali
NAME                                      READY   STATUS             RESTARTS   AGE
kiali-7ff568c949-v2qmq                    0/1     CrashLoopBackOff   56         4h22m

kubectl describe po kiali-7ff568c949-v2qmq  -n istio-system
Events:
  Type     Reason     Age                From                                               Message
  ----     ------     ----               ----                                               -------
  Normal   Scheduled  29s                default-scheduler                                  Successfully assigned istio-system/kiali-774d68d9c7-4trpd to ip-10-75-64-5.eu-west-2.compute.internal
  Normal   Pulling    28s                kubelet, ip-10-75-64-5.eu-west-2.compute.internal  Pulling image "quay.io/kiali/kiali:v1.15.2"
  Normal   Pulled     27s                kubelet, ip-10-75-64-5.eu-west-2.compute.internal  Successfully pulled image "quay.io/kiali/kiali:v1.15.2"
  Normal   Created    12s (x3 over 27s)  kubelet, ip-10-75-64-5.eu-west-2.compute.internal  Created container kiali
  Normal   Pulled     12s (x2 over 26s)  kubelet, ip-10-75-64-5.eu-west-2.compute.internal  Container image "quay.io/kiali/kiali:v1.15.2" already present on machine
  Normal   Started    11s (x3 over 26s)  kubelet, ip-10-75-64-5.eu-west-2.compute.internal  Started container kiali
  Warning  BackOff    5s (x5 over 25s)   kubelet, ip-10-75-64-5.eu-west-2.compute.internal  Back-off restarting failed container

kubectl logs  -n istio-system kiali-7ff568c949-v2qmq 
I0429 21:23:11.024691       1 kiali.go:66] Kiali: Version: v1.15.2, Commit: 718aedca76e612e2f95498d022fab1e116613792
I0429 21:23:11.025039       1 kiali.go:205] Using authentication strategy [login]
F0429 21:23:11.025057       1 kiali.go:83] signing key for login tokens is invalid

Answer 1

正如@Joel在评论中提到的那样

查看此issue，特别是此comment

并提到了here

Istio 1.4.7版本不包含ISTIO-

-2020-004修复

Istio 1.4.7的发行说明指出，与Kiali相关的安全漏洞已修复；但是，此版本中未提供修复此漏洞的提交。

据我所知，如果你使用istioctl，comment应该可以工作。

已修复istioctl安装程序。

而不是

如果你安装了旧的舵图，那么它就不是固定的。我还以为舵表已经过时了呢。无论如何，将这两行添加到helm图表中的kiali configmap模板中：

login_token:
  signing_key: {{ randAlphaNum 10 | quote }}

如果这不起作用，我建议升级到istio版本1.5.1，它应该可以解决这个问题。