Istio 1.4.7-Kiali pod无法启动

Question

安装Istio 1.4.7之后，Kiali pod不能正常启动。错误失败-signing key for login tokens is invalid

kubectl get po -n istio-system | gre kiali
NAME                                      READY   STATUS             RESTARTS   AGE
kiali-7ff568c949-v2qmq                    0/1     CrashLoopBackOff   56         4h22m

kubectl describe po kiali-7ff568c949-v2qmq  -n istio-system
Events:
  Type     Reason     Age                From                                               Message
  ----     ------     ----               ----                                               -------
  Normal   Scheduled  29s                default-scheduler                                  Successfully assigned istio-system/kiali-774d68d9c7-4trpd to ip-10-75-64-5.eu-west-2.compute.internal
  Normal   Pulling    28s                kubelet, ip-10-75-64-5.eu-west-2.compute.internal  Pulling image "quay.io/kiali/kiali:v1.15.2"
  Normal   Pulled     27s                kubelet, ip-10-75-64-5.eu-west-2.compute.internal  Successfully pulled image "quay.io/kiali/kiali:v1.15.2"
  Normal   Created    12s (x3 over 27s)  kubelet, ip-10-75-64-5.eu-west-2.compute.internal  Created container kiali
  Normal   Pulled     12s (x2 over 26s)  kubelet, ip-10-75-64-5.eu-west-2.compute.internal  Container image "quay.io/kiali/kiali:v1.15.2" already present on machine
  Normal   Started    11s (x3 over 26s)  kubelet, ip-10-75-64-5.eu-west-2.compute.internal  Started container kiali
  Warning  BackOff    5s (x5 over 25s)   kubelet, ip-10-75-64-5.eu-west-2.compute.internal  Back-off restarting failed container

kubectl logs  -n istio-system kiali-7ff568c949-v2qmq 
I0429 21:23:11.024691       1 kiali.go:66] Kiali: Version: v1.15.2, Commit: 718aedca76e612e2f95498d022fab1e116613792
I0429 21:23:11.025039       1 kiali.go:205] Using authentication strategy [login]
F0429 21:23:11.025057       1 kiali.go:83] signing key for login tokens is invalid

Answer 1

如@Joel在评论中所述

请参见此issue，尤其是此comment

和提到的here

Istio 1.4.7版本不包含ISTIO-SECURITY-2020-004修复

Istio 1.4.7的发行说明指出，与Kiali相关的安全漏洞已得到修复；但是，此版本中没有提供解决此问题的承诺。

---

据我了解，如果您使用此comment中的istioctl

istioctl安装程序已修复。

但是

如果您安装了旧的舵图，那么它并没有在那里固定。我认为不推荐使用舵表。无论如何，请将这两行添加到头盔图表中的kiali configmap模板中：

login_token:
  signing_key: {{ randAlphaNum 10 | quote }}

---

如果那行不通，我建议升级到istio 1.5.1版，它应该可以解决问题。