consul-connect-injector-webhook-deployment crash-loop about consul-helm

[adilyse]

@TheMacStack Would you be willing to share the helm chart you used that resulted in this error?

It looks like you're missing either the

global:
  image:

variable or the

connectInject:
  imageConsul: 

variable in your values file, which is what is causing this issue. Setting either of these to a Consul image (consul:1.3.0 is the default) should fix this without needing to modify the Helm chart logic.

The reason that it works to remove the line you've mentioned, is that there is a default provided within the consul-k8s binary. Unfortunately, this also removes the option for users to specify the version of Consul they would like to use, so it is not a broadly applicable solution.

[TheMacStack]

If I recall I was sourcing directly from the 0.3.0 release on this repo using the default values.yaml,

The error indicates the flag "-consul-image" is not supported by the "consul-k8s inject-connect" command/subcommand which is used in the "command" block for the sidecar-injector container but digging through the source for this "consul-k8s" utility it seems it is a valid flag (although the error plainly states otherwise) (https://github.com/hashicorp/consul-k8s/blob/master/subcommand/inject-connect/command.go) although i havnt dug much deeper to see the version of consul-k8s util in the image used here as i have just proceeded with a fork of this repo with that particular flag removed..

[TheMacStack]

I have recreated the issue and will share some config and logs to help you ID where it is coming from

I am deploying the helm chart using the Terraform Helm provider, the config snippet:

resource "helm_release" "consul" {
  timeout   = "600"
  name      = "consul"
  namespace = "${kubernetes_namespace.shared_services.metadata.0.name}"
  chart     = "https://github.com/hashicorp/consul-helm/archive/v0.3.0.tar.gz"

 set {
    name  = "connectInject.enabled"
    value = "true"
  }
  set {
    name  = "global.datacenter"
    value = "tf-k8s-az-1"
  }
  set {
    name  = "client.enabled"
    value = "true"
  }
  set {
    name  = "client.grpc"
    value = "true"
  }
  set {
    name  = "syncCatalog.enabled"
    value = "true"
  }
}

after running the deployment the pods show like:

consul-6vzzq                                                       0/1     CrashLoopBackOff   9          23m
consul-connect-injector-webhook-deployment..       0/1     CrashLoopBackOff   9          23m
consul-fckm4                                                      0/1     CrashLoopBackOff   9          23m
consul-qf22k                                                       0/1     CrashLoopBackOff   9          23m

pulling the logs of one of the crashed pods

PS /home/Terraform/single-state/aks-single-state> kubectl logs consul-connect-injector-webhook-deployment-858f897768-jjtpm -n shared
flag provided but not defined: -consul-image
Usage:
  -default-inject
        Inject by default. (default true)
  -listen string
        Address to bind listener to. (default ":8080")
  -tls-auto string
        MutatingWebhookConfiguration name. If specified, will auto generate cert bundle.
  -tls-auto-hosts string
        Comma-separated hosts for auto-generated TLS cert. If specified, will auto generate cert bundle.
  -tls-cert-file string
        PEM-encoded TLS certificate to serve. If blank, will generate random cert.
  -tls-key-file string
        PEM-encoded TLS private key to serve. If blank, will generate random cert.

[adilyse]

Thank you for the additional information! I haven't tried deploying with the Terraform Helm provider yet, so this gives me another layer to look at to see where things might have gone wrong.

[lkysow]

This issue is quite old so I'm going to close this. If it's still a problem then please comment and I'll re-open.