{"action":"opened","issue":{"url":"https://api.github.com/repos/istio/istio/issues/7409","repository_url":"https://api.github.com/repos/istio/istio","labels_url":"https://api.github.com/repos/istio/istio/issues/7409/labels{/name}","comments_url":"https://api.github.com/repos/istio/istio/issues/7409/comments","events_url":"https://api.github.com/repos/istio/istio/issues/7409/events","html_url":"https://github.com/istio/istio/issues/7409","id":344678778,"node_id":"MDU6SXNzdWUzNDQ2Nzg3Nzg=","number":7409,"title":"Unable to inject sidecar automatically due to x509 error","user":{"login":"nixgadget","id":2648624,"node_id":"MDQ6VXNlcjI2NDg2MjQ=","avatar_url":"https://avatars1.githubusercontent.com/u/2648624?v=4","gravatar_id":"","url":"https://api.github.com/users/nixgadget","html_url":"https://github.com/nixgadget","followers_url":"https://api.github.com/users/nixgadget/followers","following_url":"https://api.github.com/users/nixgadget/following{/other_user}","gists_url":"https://api.github.com/users/nixgadget/gists{/gist_id}","starred_url":"https://api.github.com/users/nixgadget/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nixgadget/subscriptions","organizations_url":"https://api.github.com/users/nixgadget/orgs","repos_url":"https://api.github.com/users/nixgadget/repos","events_url":"https://api.github.com/users/nixgadget/events{/privacy}","received_events_url":"https://api.github.com/users/nixgadget/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-07-26T03:11:16Z","updated_at":"2018-07-26T03:11:16Z","closed_at":null,"author_association":"NONE","body":"**Describe the bug**\r\nUnable to inject sidecar automatically as it throws the following error in the sidecar service,\r\n```\r\n2018-07-26T03:02:04.046142Z\tinfo\thttp: TLS handshake error from 192.168.0.0:47716: remote error: tls: bad certificate\r\n2018-07-26T03:02:04.249249Z\tinfo\thttp: TLS handshake error from 192.168.0.0:47718: remote error: tls: bad certificate\r\n```\r\n\r\nThe pod's replicaset shows the following error,\r\n```\r\n  Warning  FailedCreate  1m (x15 over 2m)  replicaset-controller  Error creating: Internal error occurred: failed calling admission webhook \"sidecar-injector.istio.io\": Post https://is-sidecar.control.svc:443/inject?timeout=30s: x509: certificate is not valid for any names, but wanted to match is-sidecar.control.svc\r\n```\r\n\r\nLooking at the `mutatingwebhook` shows the following\r\n```\r\nWebhooks:\r\n  Client Config:\r\n    Ca Bundle:  LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUM1VENDQWMyZ0F3SUJBZ0lRVUZZZ3JEVGtObXU3amI1MkorMG1MVEFOQmdrcWhraUc5dzBCQVFzRkFEQWMKTVJvd0dBWURWUVFLRXhGck9ITXVZMngxYzNSbGNpNXNiMk5oYkRBZUZ3MHhPREEzTWpZd01qVTROVEZhRncweApPVEEzTWpZd01qVTROVEZhTUJ3eEdqQVlCZ05WQkFvVEVXczRjeTVqYkhWemRHVnlMbXh2WTJGc01JSUJJakFOCkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQTNGeEFFTWsybkp4VnpwZjA1VyszVVlDWVEwa3IKRW1zTmcvR2VRV2FEUWZkeWY1TmMwaU8wL3JJcExJbG9BYWdQelRxenZSRVhKMDNDc1pRQ25PU0JwWmRqVUMvRQo4aGZaVkdrZGxVYVNTSk93cUN3L2JadVRBNzladGxVQWJOZUNuTDkrSHFubm83ZGlER0ExQ3U2SVY5OXd1VXNHCkc2Tzg4Vk9MdDVic1FUMXhkYVBjQzN4UHN0K1kycWpXdUQxdlo0Mi9jZk9ZdXZDTFdpYkZYTW5PNEF3cTludlAKT1NycnFOUS9tZlYvNHpTR0c2TTRTdG9GcDVZMFU2OCtxTDdXYmNySWJUTERZRDYxOVptQ2xIWEZHdlA0RHN1QQpmRWxibHA2OTRBdGFUTk9rWUxTVDV6MjBuanJRSnRvR0o5NFp4ZWlHaDk0dm5lamVYMWR0UW8rSXNRSURBUUFCCm95TXdJVEFPQmdOVkhROEJBZjhFQkFNQ0FnUXdEd1lEVlIwVEFRSC9CQVV3QXdFQi96QU5CZ2txaGtpRzl3MEIKQVFzRkFBT0NBUUVBSWpOaVdZZVBuRFpLU2RYM0pDNjlVZURSa2hxM3BtODN6ZFJIZ2V3SUFEbStNNTFlR2FlbAoyZlIraGZqTC8rY3RzR1ArcUNwaXdTQTZEYngvWk9kcndWcHBuamJaWWliNHZUNU5McW9Gd1RBTVRQN3hNV0t1CkFONW1wY0c0eUk3SGxrV3N4MzZwSHRkektuVUdBWWN1T3ZJWm56bFZYZ0k3UlVXWG00OFh3NithRFBmc1JTT2gKQzdCMGJPakhvNUsyOTJYVGxOZFJqY3ZIbGRPU1kxRlVGSUdIVmxza3VDQ05LblIxWXV0TmpnQjNNd0lFcklRQwpDYnZtTE9MUXhlNnBRUnpZT1h1NFBLWFNyTTRrTWNyMnBTQ1gxUTd5YkJTS2dBSkpMY1l4ZlgvRWs4ZjN3V0JmCkk3UWlIUzhLTGpIa3RwZFBDZkpmTXlPZkR5bkNDZnhXalE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==\r\n    Service:\r\n      Name:        is-sidecar\r\n      Namespace:   control\r\n      Path:        /inject\r\n  Failure Policy:  Fail\r\n  Name:            sidecar-injector.istio.io\r\n  Namespace Selector:\r\n    Match Labels:\r\n      Sidecar - Injection:  enabled\r\n  Rules:\r\n    API Groups:\r\n\r\n    API Versions:\r\n      v1\r\n    Operations:\r\n      CREATE\r\n    Resources:\r\n      pods\r\n```\r\n\r\nLook at this caBundle I can see the following x509.\r\n```\r\nopenssl x509 -noout -text -in ~/webhooks.crt                                                                                        \r\nCertificate:\r\n    Data:\r\n        Version: 3 (0x2)\r\n        Serial Number:\r\n            50:56:20:ac:34:e4:36:6b:bb:8d:be:76:27:ed:26:2d\r\n    Signature Algorithm: sha256WithRSAEncryption\r\n        Issuer: O=k8s.cluster.local\r\n        Validity\r\n            Not Before: Jul 26 02:58:51 2018 GMT\r\n            Not After : Jul 26 02:58:51 2019 GMT\r\n        Subject: O=k8s.cluster.local\r\n        Subject Public Key Info:\r\n            Public Key Algorithm: rsaEncryption\r\n                Public-Key: (2048 bit)\r\n                Modulus:\r\n                    00:dc:5c:40:10:c9:36:9c:9c:55:ce:97:f4:e5:6f:\r\n                    b7:51:80:98:43:49:2b:12:6b:0d:83:f1:9e:41:66:\r\n                    83:41:f7:72:7f:93:5c:d2:23:b4:fe:b2:29:2c:89:\r\n                    68:01:a8:0f:cd:3a:b3:bd:11:17:27:4d:c2:b1:94:\r\n                    02:9c:e4:81:a5:97:63:50:2f:c4:f2:17:d9:54:69:\r\n                    1d:95:46:92:48:93:b0:a8:2c:3f:6d:9b:93:03:bf:\r\n                    59:b6:55:00:6c:d7:82:9c:bf:7e:1e:a9:e7:a3:b7:\r\n                    62:0c:60:35:0a:ee:88:57:df:70:b9:4b:06:1b:a3:\r\n                    bc:f1:53:8b:b7:96:ec:41:3d:71:75:a3:dc:0b:7c:\r\n                    4f:b2:df:98:da:a8:d6:b8:3d:6f:67:8d:bf:71:f3:\r\n                    98:ba:f0:8b:5a:26:c5:5c:c9:ce:e0:0c:2a:f6:7b:\r\n                    cf:39:2a:eb:a8:d4:3f:99:f5:7f:e3:34:86:1b:a3:\r\n                    38:4a:da:05:a7:96:34:53:af:3e:a8:be:d6:6d:ca:\r\n                    c8:6d:32:c3:60:3e:b5:f5:99:82:94:75:c5:1a:f3:\r\n                    f8:0e:cb:80:7c:49:5b:96:9e:bd:e0:0b:5a:4c:d3:\r\n                    a4:60:b4:93:e7:3d:b4:9e:3a:d0:26:da:06:27:de:\r\n                    19:c5:e8:86:87:de:2f:9d:e8:de:5f:57:6d:42:8f:\r\n                    88:b1\r\n                Exponent: 65537 (0x10001)\r\n        X509v3 extensions:\r\n            X509v3 Key Usage: critical\r\n                Certificate Sign\r\n            X509v3 Basic Constraints: critical\r\n                CA:TRUE\r\n    Signature Algorithm: sha256WithRSAEncryption\r\n         22:33:62:59:87:8f:9c:36:4a:49:d5:f7:24:2e:bd:51:e0:d1:\r\n         92:1a:b7:a6:6f:37:cd:d4:47:81:ec:08:00:39:be:33:9d:5e:\r\n         19:a7:a5:d9:f4:7e:85:f8:cb:ff:e7:2d:b0:63:fe:a8:2a:62:\r\n         c1:20:3a:0d:bc:7f:64:e7:6b:c1:5a:69:9e:36:d9:62:26:f8:\r\n         bd:3e:4d:2e:aa:05:c1:30:0c:4c:fe:f1:31:62:ae:00:de:66:\r\n         a5:c1:b8:c8:8e:c7:96:45:ac:c7:7e:a9:1e:d7:73:2a:75:06:\r\n         01:87:2e:3a:f2:19:9f:39:55:5e:02:3b:45:45:97:9b:8f:17:\r\n         c3:af:9a:0c:f7:ec:45:23:a1:0b:b0:74:6c:e8:c7:a3:92:b6:\r\n         f7:65:d3:94:d7:51:8d:cb:c7:95:d3:92:63:51:54:14:81:87:\r\n         56:5b:24:b8:20:8d:2a:74:75:62:eb:4d:8e:00:77:33:02:04:\r\n         ac:84:02:09:bb:e6:2c:e2:d0:c5:ee:a9:41:1c:d8:39:7b:b8:\r\n         3c:a5:d2:ac:ce:24:31:ca:f6:a5:20:97:d5:0e:f2:6c:14:8a:\r\n         80:02:49:2d:c6:31:7d:7f:c4:93:c7:f7:c1:60:5f:23:b4:22:\r\n         1d:2f:0a:2e:31:e4:b6:97:4f:09:f2:5f:33:23:9f:0f:29:c2:\r\n         09:fc:56:8d\r\n```\r\n\r\nI have tried reloading the sidecar pod and also tried redeploying Istio after deleting all the relevant service names.\r\n\r\n**Expected behavior**\r\nI would expect to inject the sidecar automatically when deploying an app to the namespace listened to by the webhook.\r\n\r\n**Steps to reproduce the bug**\r\nAs described above just trying to deploy a new application.\r\n\r\n**Version**\r\nKubernetes:\r\nClient Version: version.Info{Major:\"1\", Minor:\"9\", GitVersion:\"v1.9.7\", GitCommit:\"dd5e1a2978fd0b97d9b78e1564398aeea7e7fe92\", GitTreeState:\"clean\", BuildDate:\"2018-04-19T00:05:56Z\", GoVersion:\"go1.9.3\", Compiler:\"gc\", Platform:\"darwin/amd64\"}\r\nServer Version: version.Info{Major:\"1\", Minor:\"11\", GitVersion:\"v1.11.1\", GitCommit:\"b1b29978270dc22fecc592ac55d903350454310a\", GitTreeState:\"clean\", BuildDate:\"2018-07-17T18:43:26Z\", GoVersion:\"go1.10.3\", Compiler:\"gc\", Platform:\"linux/amd64\"}\r\nIstio: 0.8.0 installed via Helm\r\n\r\n**Is Istio Auth enabled or not?**\r\nmTLS is enabled\r\n\r\n**Environment**\r\nBaremetal\r\n"}}
{"actor":{"display_login":"nixgadget"}}