envoyproxy / gateway 部署实践

问题描述

参考QuickStart

 kubectl apply -f https://github.com/envoyproxy/gateway/releases/download/latest/install.yaml
 kubectl apply -f https://github.com/envoyproxy/gateway/releases/download/latest/quickstart.yaml

主要是解决在这一步的问题，因为国内屏蔽了一些容器官方站点，所以会出现很多问题。
这篇文章主要解决的问题是在issue#384中提到的相关问题。

图里的这三个都会因为镜像拉取失败出现问题。

其中admission会一直处在容器创建中，原因是secret未生成，而未生成secret的原因是gateway-api-admission-patch和gateway-api-admission这两个task因为镜像拉取失败而一直处在进行中的状态。

解决方案

这里提供的解决方案思路就是事先从镜像源里拉取镜像，然后直接使用本地镜像
参考轻松下载k8s.gcr.io，gcr.io，quay.io镜像首先使用docker describe podxxx挨个查看失败的镜像，然后将url中开头的站点网址换成镜像地址。
拉取镜像之后：

1. 因为install.yaml和quickstart.yaml中镜像的拉取策略有几个是Always，所以将这两个文件下载下来，然后将其中的五个imagePullPolicy全部改成IfNotPresent,然后直接部署本地的这两个文件。
2. 需要先将容器镜像下载到本地，并修改标签。

docker pull gcr.lank8s.cn/kubebuilder/kube-rbac-proxy:v0.11.0
docker tag gcr.lank8s.cn/kubebuilder/kube-rbac-proxy:v0.11.0 gcr.io/kubebuilder/kube-rbac-proxy:v0.11.0

docker pull gcr.lank8s.cn/k8s-staging-ingressconformance/echoserver:v20220815-e21d1a4
docker tag gcr.lank8s.cn/k8s-staging-ingressconformance/echoserver:v20220815-e21d1a4 gcr.io/k8s-staging-ingressconformance/echoserver:v20220815-e21d1a4

docker pull lank8s.cn/ingress-nginx/kube-webhook-certgen:v1.1.1
docker tag lank8s.cn/ingress-nginx/kube-webhook-certgen:v1.1.1 k8s.gcr.io/ingress-nginx/kube-webhook-certgen:v1.1.1

docker pull gcr.lank8s.cn/k8s-staging-gateway-api/admission-server:v0.5.1
docker tag gcr.lank8s.cn/k8s-staging-gateway-api/admission-server:v0.5.1 gcr.io/k8s-staging-gateway-api/admission-server:v0.5.1

相关报错

gatewayclass.gateway.networking.k8s.io/eg unchanged
serviceaccount/backend unchanged
service/backend unchanged
deployment.apps/backend unchanged
Error from server (InternalError): error when applying patch:
{"spec":{"listeners":[{"name":"http","port":8080,"protocol":"HTTP"}]}}
to:
Resource: "gateway.networking.k8s.io/v1beta1, Resource=gateways", GroupVersionKind: "gateway.networking.k8s.io/v1beta1, Kind=Gateway"
Name: "eg", Namespace: "default"
for: "./quickstart.yaml": Internal error occurred: failed calling webhook "validate.gateway.networking.k8s.io": Post "https://gateway-api-admission-server.gateway-system.svc:443/validate?timeout=10s": dial tcp 10.96.102.145:443: connect: connection refused
Error from server (InternalError): error when applying patch:
{"spec":{"parentRefs":[{"name":"eg"}]}}
to:
Resource: "gateway.networking.k8s.io/v1beta1, Resource=httproutes", GroupVersionKind: "gateway.networking.k8s.io/v1beta1, Kind=HTTPRoute"
Name: "backend", Namespace: "default"
for: "./quickstart.yaml": Internal error occurred: failed calling webhook "validate.gateway.networking.k8s.io": Post "https://gateway-api-admission-server.gateway-system.svc:443/validate?timeout=10s": dial tcp 10.96.102.145:443: connect: connection refused

Error from server (InternalError): error when creating "./quickstart.yaml": Internal error occurred: failed calling webhook "validate.gateway.networking.k8s.io": Post "https://gateway-api-admission-server.gateway-system.svc:443/validate?timeout=10s": dial tcp 10.96.149.219:443: connect: connection refused
Error from server (InternalError): error when creating "./quickstart.yaml": Internal error occurred: failed calling webhook "validate.gateway.networking.k8s.io": Post "https://gateway-api-admission-server.gateway-system.svc:443/validate?timeout=10s": dial tcp 10.96.149.219:443: connect: connection refused

当然如果仅仅是为了体验，也可以考虑直接删掉

kubectl delete -A ValidatingWebhookConfiguration gateway-api-admission