google-cloud-platformistioservicemeshgoogle-anthos-service-mesh

Is 'No Workload identity for a node level' or 'failure to load CA secret' stopping service mesh from working?

This is the first time I have been trying to install managed Anthos into one of the clusters in GKE. I admit I do not fully understand the full process of installation and troubleshooting I have already done.

It looks like a managed service has failed to install. When I run:

kubectl describe controlplanerevision asm-managed -n istio-system

I get this status:

Status:
  Conditions:
    Last Transition Time:  2022-03-15T14:16:21Z
    Message:               The provisioning process has not completed successfully
    Reason:                NotProvisioned
    Status:                False
    Type:                  Reconciled
    Last Transition Time:  2022-03-15T14:16:21Z
    Message:               Provisioning has finished
    Reason:                ProvisioningFinished
    Status:                True
    Type:                  ProvisioningFinished
    Last Transition Time:  2022-03-15T14:16:21Z
    Message:               Workload identity is not enabled at node level
    Reason:                PreconditionFailed
    Status:                True
    Type:                  Stalled
Events:                    <none>

However, I have Workload identity enabled on a cluster level and I cannot see any options in GCP Console to set that for just a node level.

enter image description here

I am not sure if this is related to istiod-asm-1125-0 logging some errors. One of them is about failure to load CA secret:

enter image description here

Nevertheless, the service mesh does not show as added or connected in Anthos Dashboard. The cluster is registered with Anthos.enter image description here

Solution

    1. I created a new node pool with more CPU and more nodes as I was getting warning about not having enough CPU. Istio service mesh increases the need for CPU.

    2. I migrated my deployment from old node pool to the new one.

    3. I run istioctl analyze -A and found a few warnings about istio-injection not being enabled in a few namespaces. I fixed that.

    4. I re run asmcli install command without CA

    ./asmcli install --project_id my-app --cluster_name my-cluster --cluster_location europe-west1-b --fleet_id my-app --output_dir anthos-service-mesh --enable_all

    All or some of the above did the trick.