kiali: More than one Gateway, but cannot find duplicate.

Kiali reports for a few Gateway Objects that we have a duplicate host and port conflict.
Capture d’écran, le 2022-06-15 à 09 01 50

Capture d’écran, le 2022-06-15 à 09 11 10

But, I cannot find the conflict. Istioctl analyze -A does not report anything on more than one gateway :

istioctl analyze -A | grep -i Error
Error: Analyzers found issues when analyzing all namespaces.
See https://istio.io/v1.13/docs/reference/config/analysis for more information about causes and resolutions.
Error [IST0101] (Gateway istio-gateways/gateway-for-all-apis) Referenced selector not found: "istio=ingressgateway"
Error [IST0101] (Gateway istio-gateways/gateway-for-services) Referenced selector not found: "istio=ingressgateway"
Error [IST0101] (Gateway istio-squelette/httpbin-gateway) Referenced selector not found: "istio=ingressgateway"
Error [IST0101] (Gateway test-automatique/test-automatique-gateway) Referenced selector not found: "app=istio-ingressgateway"

As can be seen in the screen capture above, there are a few Validation References, but if one clicks on the links, kiali cannot find the ressource :

Capture d’écran, le 2022-06-15 à 09 01 59

Warnings are not more helpful. kubectl does not help either :

> kc get gateways.networking.istio.io -n istio-system
No resources found in istio-system namespace.
> kc get ingress -n istio-system                                                                                   
No resources found in istio-system namespace.

Nor in the namespace :

> kc get gw -n istio-squelette
NAME              AGE
httpbin-gateway   26d
> kc get virtualservices.networking.istio.io -n istio-squelette 
NAME       GATEWAYS                                  HOSTS                                 AGE
httpbin    ["istio-gateways/gateway-for-all-apis"]   ["api.kube.lab.ile.montreal.qc.ca"]   28d
httpbin2   ["httpbin-gateway"]                       ["httpbin.squl"]                      14d

Yes, we have an ingressclass named istio, but I cannot find any conflict.

Finally, the gateway-virtualService pair works correctly and has been published in the ingress-gateway.

So, either I need help to help me find the duplicate entry ( hopefully straight in Kiali’s Gui ), or there this is a false positive.

Here are our versions :

Capture d’écran, le 2022-06-14 à 17 11 31

> istioctl version                     
client version: 1.13.2
istiod version: 1.13.2
istiod version: 1.13.2
istiod version: 1.14.1
istiod version: 1.14.1
data plane version: 1.13.2 (108 proxies), 1.14.1 (2 proxies)
>

> kc version --short
Client Version: v1.23.5
Server Version: v1.21.5
WARNING: version difference between client (1.23) and server (1.21) exceeds the supported minor version skew of +/-1

We have had this problem in version 1.13.2 and version 1.14.1 of istio, this is just the state this morning.

About this issue

  • Original URL
  • State: closed
  • Created 2 years ago
  • Comments: 23 (12 by maintainers)

Most upvoted comments

@ldemailly the Kiali validations are designed in a way, that if any of gateways has “*” in hosts, then it will have conflict with any other gateway, and the opposite. Gateways are by default exported to all namespaces (unless exportTo specifies other), as shown in example here: https://kiali.io/docs/features/validations/#kia0301---more-than-one-gateway-for-the-same-host-port-combination.

But there is a way to skip showing particular errors by specifying them in “kiali” configuration section “validations: ignore:”