Istio问题

Error: configmaps is forbidden

Error: configmaps is forbidden: User “system:serviceaccount:kube-system:default” cannot list configmaps in the namespace “kube-system”

#在kube-system命名空间中创建tiller账户
kubectl create serviceaccount --namespace kube-system tiller

#创建角色并授予cluster-admin权限
kubectl create clusterrolebinding tiller-cluster-rule --clusterrole=cluster-admin --serviceaccount=kube-system:tiller

#指定账户进行初始化，还要指定tiller镜像
helm init --service-account tiller --tiller-image registry.cn-hangzhou.aliyuncs.com/google_containers/tiller:v2.12.1

#最后验证一下，是否有报错，执行以下命令没报错则表示成功了
helm ls

创建rule错误

Error from server (InternalError): error when creating “destination-rule-all.yaml”: Internal error occurred: failed calling admission webhook “pilot.validation.istio.io”: Post https://istio-galley.istio-system.svc:443/admitpilot?timeout=30s: dial tcp 10.107.70.132:443: connect: connection refused

等待galley的重启（BackOff原因目前不明），gally作为配置管理，在创建rule和策略时如果没有Running，则连接被拒绝