Skip to content

Automator: update istio@ test reference #16580

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Automator: update istio@ test reference #16580

wants to merge 1 commit into from

Conversation

istio-testing
Copy link
Contributor

@istio-testing istio-testing commented Jun 15, 2025 •
edited
Loading

Generated by Automator - 2025-06-22T02:01:19+00:00

@istio-testing istio-testing requested a review from a team as a code owner June 15, 2025 02:07
@istio-testing istio-testing added release-notes-none Indicates a PR that does not require release notes. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Jun 15, 2025
@dhawton
Copy link
Member

dhawton commented Jun 15, 2025

/retest

@AritraDey-Dev
Copy link
Member

/retest

@dhawton
Copy link
Member

dhawton commented Jun 16, 2025

/test doc.test.profile-none

still flaking.. not sure why.. containerd seems to indicate the curl pod started.

AritraDey-Dev
AritraDey-Dev reviewed Jun 16, 2025
View reviewed changes
Copy link
Member

@AritraDey-Dev AritraDey-Dev left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not appears to be a flake now...need to check the tests once

@craigbox
Copy link
Contributor

Is it relevant that it's being installed with kube-inject?

+snip_apply_curl(): istioctl kube-inject --filename samples/security/spire/curl-spire.yaml
+snip_apply_curl(): kubectl apply -f -
+_wait_for_deployment default curl
+_wait_for_deployment(): local namespace=default
+_wait_for_deployment(): local name=curl
+_wait_for_deployment(): local context=
+_wait_for_deployment(): kubectl --context= -n default rollout status deployment curl --timeout 5m
+_wait_for_deployment(): echo 'Failed rollout of deployment curl in namespace default'
+_wait_for_deployment(): exit 1

I would have thought most of our examples would have had the injector running automatically

@AritraDey-Dev
Copy link
Member

AritraDey-Dev commented Jun 17, 2025 •
edited
Loading

running the specific test that failed (automatic_registration_test.sh) in my local setup, I checked the logs at:

/work/out/linux_amd64/tests-setup-profile-none-460828/TestDocs/ops/integrations/spire/automatic_registration_test.sh/automatic_registration_test.sh/_test_context/automatic_registration_test.sh_output.txt
The last few lines show:

- Processing resources for Istio core.
✔ Istio core installed ⛵️
- Processing resources for Istiod.
- Processing resources for Istiod. Waiting for Deployment/istio-system/istiod
✘ Istiod encountered an error: failed to wait for resource: resources not ready after 5m0s: context deadline exceeded
  Deployment/istio-system/istiod (container failed to start: ImagePullBackOff: Back-off pulling image "istio/pilot:1.27-alpha.ebe60fc2d88e483f2b0bf88392b145ec7f36cb31": ErrImagePull: rpc error: code = NotFound desc = failed to pull and unpack image "docker.io/istio/pilot:1.27-alpha.ebe60fc2d88e483f2b0bf88392b145ec7f36cb31": failed to resolve reference "docker.io/istio/pilot:1.27-alpha.ebe60fc2d88e483f2b0bf88392b145ec7f36cb31": docker.io/istio/pilot:1.27-alpha.ebe60fc2d88e483f2b0bf88392b145ec7f36cb31: not found)
- Processing resources for Ingress gateways.
- Processing resources for Ingress gateways. Waiting for Deployment/istio-system/istio-ingressgateway
✘ Ingress gateways encountered an error: failed to wait for resource: resources not ready after 5m0s: context deadline exceeded
  Deployment/istio-system/istio-ingressgateway (container failed to start: PodInitializing: )Error: failed to install manifests: 2 errors occurred:
	* failed to wait for resource: resources not ready after 5m0s: context deadline exceeded
  Deployment/istio-system/istiod (container failed to start: ImagePullBackOff: Back-off pulling image "istio/pilot:1.27-alpha.ebe60fc2d88e483f2b0bf88392b145ec7f36cb31": ErrImagePull: rpc error: code = NotFound desc = failed to pull and unpack image "docker.io/istio/pilot:1.27-alpha.ebe60fc2d88e483f2b0bf88392b145ec7f36cb31": failed to resolve reference "docker.io/istio/pilot:1.27-alpha.ebe60fc2d88e483f2b0bf88392b145ec7f36cb31": docker.io/istio/pilot:1.27-alpha.ebe60fc2d88e483f2b0bf88392b145ec7f36cb31: not found)
	* failed to wait for resource: resources not ready after 5m0s: context deadline exceeded
  Deployment/istio-system/istio-ingressgateway (container failed to start: PodInitializing: )

It seems the test is trying to pull the image istio/pilot:1.27-alpha.ebe60fc2d88e483f2b0bf88392b145ec7f36cb31, but it's not available. Even when I try pulling it locally using Docker, it fails with "manifest not known." So it appears this specific image tag does not exist or has not been pushed.

And the errImagebackoff error leads to another error in podInitializing.

@craigbox
Copy link
Contributor

What you're seeing is a common problem with running the tests locally, but isn't the problem in this PR. You can see that Prow (our CI system) is able to pull the containers and start running but your error is that the Istio control plane can't start running at all. That suggests something different.

@AritraDey-Dev
Copy link
Member

I would have thought most of our examples would have had the injector running automatically

it is not true for all examples,for spire test the label istio-injection=enabled is not applied anywhere in the test setup like other setups:

kubectl label namespace default istio-injection=enabled

Instead, these tests use istioctl kube-inject in the setup steps.
I'm not entirely sure about the exact reason behind explicitly doing this, but I believe it's because the SPIRE integration does not use the default Istio sidecar injector webhook. Instead, SPIRE is used as the CA, and the SPIRE agent is injected manually as a sidecar using istioctl kube-inject.

@AritraDey-Dev
Copy link
Member

/test doc.test.profile-none

@istio-testing istio-testing force-pushed the none-master-automator-1313598d branch from e221908 to 7d56f49 Compare June 22, 2025 02:03
@istio-testing
Copy link
Contributor Author

@istio-testing: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
doc.test.profile-none_istio.io 7d56f49 link true /test doc.test.profile-none

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@kfaseela
Copy link
Member

The failure does not seem to be the usual flakes

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@AritraDey-Dev AritraDey-Dev AritraDey-Dev left review comments

@dhawton dhawton dhawton approved these changes

Assignees
No one assigned
Labels
release-notes-none Indicates a PR that does not require release notes. size/M Denotes a PR that changes 30-99 lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@istio-testing @dhawton @AritraDey-Dev @craigbox @kfaseela