Replies: 6 comments 2 replies
-
|
@surajssd the errors suggest that Contour is not listening on the port (8002). Can you telnet to that port? |
Beta Was this translation helpful? Give feedback.
-
|
@grampelberg the port on the evnoy pod is open, otherwise in following outputs I would have received I have this envoy pod: $ kubectl get pods envoy-wwpkx -o wide -n projectcontour
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
envoy-wwpkx 2/2 Running 0 11m 10.2.216.9 suraj-lk-cluster-general-worker-1 <none> <none>I started a debug pod to connect to this envoy pod: $ kubectl -n default run -it --rm debug-network-$RANDOM --image-pull-policy=Always --image=surajd/fedora-networki
ng --restart=Never bash
If you don't see a command prompt, try pressing enter.
# curl -I 10.2.216.9:8002
HTTP/1.1 404 Not Found
date: Thu, 05 Nov 2020 08:54:31 GMT
server: envoy
transfer-encoding: chunkedTelnet to envoy pod from debug pod: # telnet 10.2.216.9 8002
Trying 10.2.216.9...
Connected to 10.2.216.9.
Escape character is '^]'.
|
Beta Was this translation helpful? Give feedback.
-
|
@surajssd Can you confirm that the issue persists with stable-2.9.0 (released yesterday)? Also, can you share the output of |
Beta Was this translation helpful? Give feedback.
-
|
Yep the issue persists on the latest stable as well. Output as you have requested: $ linkerd metrics -n projectcontour po/envoy-hv6ck | grep ^process_
process_start_time_seconds 1605088156
process_cpu_seconds_total 0
process_open_fds 24
process_max_fds 1048576
process_virtual_memory_bytes 95715328
process_resident_memory_bytes 17563648I have updated the output of |
Beta Was this translation helpful? Give feedback.
-
|
With edge-21.6.1, I get an additional error message in the linkerd-proxy logs that might be a hint as to what's going on: As I understand it (and I'm not an expert on Contour so this could be wrong), Contour has two parts to its ingress controller, the actual ingress proxy, and the controller which is deployed as a separate component. The proxy connects to the ingress controller using gRPC, and I think this is not a grpc plaintext connection, it's an mTLS connection with a cert managed by contour. So the problem then appears to be that linkerd is preventing the contour proxy from connecting to its ingress controller because contour is using TLS. I guess the work around here is to exclude this communication via the linkerd skip ports annotation. I'll try this. |
Beta Was this translation helpful? Give feedback.
-
|
Yep, that fixed it, added the following annotation: And now it works. |
Beta Was this translation helpful? Give feedback.
-
|
@jroper Another suggestion is you should be able to mark 8001 as an opaque port and keep certain features Linkerd provides by default like metrics and load balancing |
Beta Was this translation helpful? Give feedback.
-
|
I take this back actually. I'd be curious if you can test this easily, but we may actually still error if 8001 is marked as opaque on the Contour controller. I think skip ports is the only solution here. |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
Bug Report
What is the issue?
When I try to follow the guide to install the contour with linkerd proxy these are the errors I see in the linkerd-proxy container of the envoy pod:
And the errors that I see in the envoy container are as follows:
Envoy's readiness fails with following event:
The readiness probe:
How can it be reproduced?
Follow guidelines in https://linkerd.io/2/tasks/using-ingress/#contourz.
But for me I installed the contour first. And then followed above guideline.
linkerd checkoutputEnvironment
1.19.3.Beta Was this translation helpful? Give feedback.
All reactions