Anthos Service Mesh 1.6

Resolving webhook issues in Anthos Service Mesh

This section explains common Anthos Service Mesh problems and how to resolve them. If you need additional assistance, see Getting support.

Anthos Service Mesh contains two webhooks:

  • The validating webhook ensures applied Istio configuration is valid.
  • The mutating webhook sets automatic sidecar injection on new pods.

A configuration issue in one of these webhooks might cause new pods to fail start up, or kubectl apply generating error messages.

Pods fail to be created

If you observe that pods are not being created successfully, look for error messages that might give clues to the root problem, using the following command:

kubectl describe replicaset YOUR_REPLICA_SET

Webhook error messages

Error messages when using the kubectl apply command can provide a hint about their root cause. See the following table for common error messages, their causes and potential resolutions.

Error message Cause Resolution
net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers) This might be a network connectivity issue. Ensure that your firewall rules provide connectivity to Istiod on port 15017.
no endpoints available for service 'istiod' This can occur if the Istiod pod is not available or not ready. Check the Istiod pods to ensure they are running and ready.
Service "istiod" not found This can occur if the Istiod service does not exist. Verify that your Istio installation was successful and correct.
x509: certificate signed by unknown authority This might be a webhook certificate issue. Check that caBundle is correctly set on the webhook.