{"action":"created","issue":{"url":"https://api.github.com/repos/istio/istio/issues/4866","repository_url":"https://api.github.com/repos/istio/istio","labels_url":"https://api.github.com/repos/istio/istio/issues/4866/labels{/name}","comments_url":"https://api.github.com/repos/istio/istio/issues/4866/comments","events_url":"https://api.github.com/repos/istio/istio/issues/4866/events","html_url":"https://github.com/istio/istio/issues/4866","id":313127331,"number":4866,"title":"Pods fail to init without debug flag","user":{"login":"ayj","id":116378,"avatar_url":"https://avatars1.githubusercontent.com/u/116378?v=4","gravatar_id":"","url":"https://api.github.com/users/ayj","html_url":"https://github.com/ayj","followers_url":"https://api.github.com/users/ayj/followers","following_url":"https://api.github.com/users/ayj/following{/other_user}","gists_url":"https://api.github.com/users/ayj/gists{/gist_id}","starred_url":"https://api.github.com/users/ayj/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ayj/subscriptions","organizations_url":"https://api.github.com/users/ayj/orgs","repos_url":"https://api.github.com/users/ayj/repos","events_url":"https://api.github.com/users/ayj/events{/privacy}","received_events_url":"https://api.github.com/users/ayj/received_events","type":"User","site_admin":false},"labels":[{"id":670442116,"url":"https://api.github.com/repos/istio/istio/labels/area/environments","name":"area/environments","color":"0e8a16","default":false}],"state":"open","locked":false,"assignee":{"login":"cmluciano","id":4790487,"avatar_url":"https://avatars1.githubusercontent.com/u/4790487?v=4","gravatar_id":"","url":"https://api.github.com/users/cmluciano","html_url":"https://github.com/cmluciano","followers_url":"https://api.github.com/users/cmluciano/followers","following_url":"https://api.github.com/users/cmluciano/following{/other_user}","gists_url":"https://api.github.com/users/cmluciano/gists{/gist_id}","starred_url":"https://api.github.com/users/cmluciano/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cmluciano/subscriptions","organizations_url":"https://api.github.com/users/cmluciano/orgs","repos_url":"https://api.github.com/users/cmluciano/repos","events_url":"https://api.github.com/users/cmluciano/events{/privacy}","received_events_url":"https://api.github.com/users/cmluciano/received_events","type":"User","site_admin":false},"assignees":[{"login":"cmluciano","id":4790487,"avatar_url":"https://avatars1.githubusercontent.com/u/4790487?v=4","gravatar_id":"","url":"https://api.github.com/users/cmluciano","html_url":"https://github.com/cmluciano","followers_url":"https://api.github.com/users/cmluciano/followers","following_url":"https://api.github.com/users/cmluciano/following{/other_user}","gists_url":"https://api.github.com/users/cmluciano/gists{/gist_id}","starred_url":"https://api.github.com/users/cmluciano/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cmluciano/subscriptions","organizations_url":"https://api.github.com/users/cmluciano/orgs","repos_url":"https://api.github.com/users/cmluciano/repos","events_url":"https://api.github.com/users/cmluciano/events{/privacy}","received_events_url":"https://api.github.com/users/cmluciano/received_events","type":"User","site_admin":false}],"milestone":null,"comments":1,"created_at":"2018-04-10T23:50:53Z","updated_at":"2018-04-11T13:48:05Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"@doncorsean commented on [Tue Apr 10 2018](https://github.com/istio/issues/issues/279)\n\n<!-- This form is for bug reports and feature requests ONLY! \r\nIf you're looking for help check https://istio.io/help/\r\n-->\r\n\r\n**Is this a BUG or FEATURE REQUEST?:**\r\n\r\n**Did you review https://istio.io/help/ and existing issues to identify if this is already solved or being worked on?**:\r\n\r\n**Bug:**\r\nY\r\n\r\n**What Version of Istio and Kubernetes are you using, where did you get Istio from, Installation details**\r\n```\r\n$ istioctl version\r\nVersion: 0.7.1\r\nGitRevision: 62110d4f0373a7613e57b8a4d559ded9cb6a1cc8\r\nUser: root@c5207293dc14\r\nHub: docker.io/istio\r\nGolangVersion: go1.9\r\nBuildStatus: Clean\r\n```\r\n```\r\n$ oc version\r\noc v3.7.2+282e43f\r\nkubernetes v1.7.6+a08f5eeb62\r\nfeatures: Basic-Auth GSSAPI Kerberos SPNEGO\r\n\r\nServer https://192.168.99.100:8443\r\nopenshift v3.7.2+5eda3fa-5\r\nkubernetes v1.7.6+a08f5eeb62\r\n```\r\n\r\n**Is Istio Auth enabled or not ?**\r\nDid you install the stable istio.yaml, istio-auth.yaml....  or if using the Helm chart please provide full command line input.\r\n```\r\noc login -u system:admin\r\noc new-project istio-system\r\noc project istio-system\r\nprintf \"${YELLOW}Set security policies${NC}\\n\"\r\noc policy add-role-to-user cluster-admin developer\r\n\r\noc adm policy add-scc-to-user anyuid -z default\r\noc adm policy add-scc-to-user anyuid -z default                                       -n istio-system\r\noc adm policy add-scc-to-user anyuid -z istio-manager-service-account                 -n istio-system\r\noc adm policy add-scc-to-user anyuid -z istio-ingress-service-account                 -n istio-system\r\noc adm policy add-scc-to-user anyuid -z istio-egress-service-account                  -n istio-system\r\noc adm policy add-scc-to-user anyuid -z istio-pilot-service-account                   -n istio-system\r\noc adm policy add-scc-to-user anyuid -z prometheus                                    -n istio-system\r\noc adm policy add-scc-to-user anyuid -z grafana                                       -n istio-system\r\n\r\noc adm policy add-scc-to-user privileged -z default\r\noc adm policy add-scc-to-user privileged -z default                                   -n istio-system\r\noc adm policy add-scc-to-user privileged -z istio-ingress-service-account             -n istio-system\r\noc adm policy add-scc-to-user privileged -z istio-egress-service-account              -n istio-system\r\noc adm policy add-scc-to-user privileged -z istio-pilot-service-account               -n istio-system\r\noc adm policy add-scc-to-user privileged -z istio-manager-service-account             -n istio-system\r\noc adm policy add-scc-to-user privileged -z prometheus                                -n istio-system\r\noc adm policy add-scc-to-user privileged -z grafana                                   -n istio-system\r\n\r\noc adm policy add-cluster-role-to-user cluster-admin -z default\r\noc adm policy add-cluster-role-to-user cluster-admin -z default                       -n istio-system\r\noc adm policy add-cluster-role-to-user cluster-admin -z istio-manager-service-account -n istio-system\r\noc adm policy add-cluster-role-to-user cluster-admin -z istio-ingress-service-account -n istio-system\r\noc adm policy add-cluster-role-to-user cluster-admin -z istio-egress-service-account  -n istio-system\r\n\r\noc patch scc/privileged --patch {\\\"allowedCapabilities\\\":[\\\"NET_ADMIN\\\"]}\r\n\r\nprintf \"${YELLOW}Install Istio${NC}\\n\"\r\noc apply -f $ISTIO_HOME/install/kubernetes/istio.yaml\r\nprintf \"${YELLOW}Install addons${NC}\\n\"\r\noc create -f $ISTIO_HOME/install/kubernetes/addons/prometheus.yaml\r\noc create -f $ISTIO_HOME/install/kubernetes/addons/grafana.yaml\r\noc create -f $ISTIO_HOME/install/kubernetes/addons/servicegraph.yaml\r\noc create -f $ISTIO_HOME/install/kubernetes/addons/zipkin.yaml\r\nprintf \"${CYAN}Expose services${NC}\\n\"\r\noc expose svc grafana\r\noc expose svc servicegraph\r\noc expose svc zipkin\r\nSERVICEGRAPH=$(oc get route servicegraph -o jsonpath='{.spec.host}{\"\\n\"}')/dotviz\r\nGRAFANA=$(oc get route grafana -o jsonpath='{.spec.host}{\"\\n\"}')\r\nZIPKIN=$(oc get route zipkin -o jsonpath='{.spec.host}{\"\\n\"}')\r\noc new-project bookinfo\r\noc login -u system:admin\r\noc adm policy add-scc-to-user privileged -z default -n bookinfo\r\noc create -f <(istioctl kube-inject -f /opt/Istio/Home/samples/bookinfo/kube/bookinfo.yaml)\r\n```\r\n**What happened**:\r\nPods report iptables: Chain already exists.\r\nAlthough if I provide --debug to kube-inject they start successfully. What specifically is --debug doing? I'd like to understand.\r\n\r\n**What you expected to happen:**\r\nPods to start successfully\r\n\r\n\n\n---\n\n@ayj commented on [Tue Apr 10 2018](https://github.com/istio/issues/issues/279#issuecomment-380282659)\n\nPossibly related https://github.com/istio/istio/issues/4500. `--debug` enables privileges in the init container. \r\ncc @cmluciano \n\n"},"comment":{"url":"https://api.github.com/repos/istio/istio/issues/comments/380458112","html_url":"https://github.com/istio/istio/issues/4866#issuecomment-380458112","issue_url":"https://api.github.com/repos/istio/istio/issues/4866","id":380458112,"user":{"login":"doncorsean","id":495237,"avatar_url":"https://avatars1.githubusercontent.com/u/495237?v=4","gravatar_id":"","url":"https://api.github.com/users/doncorsean","html_url":"https://github.com/doncorsean","followers_url":"https://api.github.com/users/doncorsean/followers","following_url":"https://api.github.com/users/doncorsean/following{/other_user}","gists_url":"https://api.github.com/users/doncorsean/gists{/gist_id}","starred_url":"https://api.github.com/users/doncorsean/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/doncorsean/subscriptions","organizations_url":"https://api.github.com/users/doncorsean/orgs","repos_url":"https://api.github.com/users/doncorsean/repos","events_url":"https://api.github.com/users/doncorsean/events{/privacy}","received_events_url":"https://api.github.com/users/doncorsean/received_events","type":"User","site_admin":false},"created_at":"2018-04-11T13:48:05Z","updated_at":"2018-04-11T13:48:05Z","author_association":"NONE","body":"Some of the policies above were in the blog post [here](https://blog.openshift.com/evaluate-istio-openshift/) and I was under the impression they were needed. Apparently they are no longer required so I've removed the ones I believe to be unnecessary.\r\n```\r\noc adm policy add-scc-to-user anyuid -z istio-ingress-service-account -n istio-system\r\noc adm policy add-scc-to-user anyuid -z prometheus -n istio-system\r\noc adm policy add-scc-to-user anyuid -z grafana -n istio-system\r\noc adm policy add-scc-to-user privileged -z default -n <target-namespace>\r\n```\r\nIs there some other policy I should apply so the -debug flag isn't required?\r\n"}}
{"actor":{"display_login":"doncorsean"}}