Ben Leggett
Ben Leggett
> failed to add route: permission denied That's not related yea - that's just the `istio-cni` pod not having privileges to create a netlink route, for some reason. Odd that...
> Guessing something between 1.23-alpha.b781a1822bda8eaf883f25348bda15c7ef621101 and 1.23-alpha.cc059c426f1e48eba0d07ede07a489a964e142c2 20 hours ago broke it for me on EKS. There weren't any changes to these components between those two SHAs so I doubt...
Nope, that means it's either the `istio-cni` pod not actually running as privileged, or some weird problem with the netlink library/API that's only manifesting here.
> Looks like there were changes in istio/istio that broke doc tests again... I don't have cycles at the moment to look in to it, but if another docs maintainer...
It looks like the injected sidecars in the doctests are failing to come up because the webhook name is wrong (somehow, despite https://github.com/istio/istio/pull/53542, something is expecting a Service named `istiod-remote`...
> @bleggett you sure this is running against the Istio version that includes the changes in [istio/istio#5](https://github.com/istio/istio/pull/53542)? According to the logs, the test ran against `ISTIO_VERSION=1.24-alpha.1c546ae8a14a9a64f171c7fe228925ebaf3a3348`, which is a week...
/test doc.test.profile-default
> That should only happen in the automated PRs.. do not do it in regular docs PRs.. especially if there is something that could be broken. (for my own understanding)...
There _may_ be some tests that depend on the experimental ones, and some tests that depend on the stable ones. Outside of that (which may not be a thing) this...
It looks like from the logs CNI and ztunnel are both ready/healthy, and both of these use normal K8S healthchecks, there's nothing fancy involved. Do other pods in that namespace...