init container failed to start when pod run on edge node (KubeEdge) #11666
-
|
Background:
But I do not know what is the root cause and how to fix it. |
Beta Was this translation helpful? Give feedback.
Replies: 5 comments 19 replies
-
|
init container failed with below message: |
Beta Was this translation helpful? Give feedback.
-
|
I'm experiencing the same issue but with simply trying to have a workflow deploy a kubernetes job. I get the exact same error: Reading around has lead me to nothing really helpful. So hopefully this conversation will lead to some good findings. |
Beta Was this translation helpful? Give feedback.
-
|
Does anyone know on the above? I have been battling with this for the past 9 hours now. |
Beta Was this translation helpful? Give feedback.
-
|
The error sounds like the kubeconfig is not properly configured. Why it's not configured correctly though, I don't know |
Beta Was this translation helpful? Give feedback.
-
|
But this is already inside of kubernetes, that doesn't make a lot of sense to me.... |
Beta Was this translation helpful? Give feedback.
-
|
Given your answer below regarding |
Beta Was this translation helpful? Give feedback.
-
|
What happens when you create that Job without Argo? |
Beta Was this translation helpful? Give feedback.
-
Your template's SA will need to have RBAC to |
Beta Was this translation helpful? Give feedback.
-
|
I have this permission already: |
Beta Was this translation helpful? Give feedback.
-
|
I'm getting this stack trace from the init container I mentioned above. Seems like an argo thing to me. |
Beta Was this translation helpful? Give feedback.
-
|
Here is the config map that was asked for on slack: https://app.slack.com/client/T08PSQ7BQ/C01QW9QSSSK/thread/C01QW9QSSSK-1693416866.758019 apiVersion: v1
data:
config: |
artifactRepository:
archiveLogs: true
s3:
bucket: {s3_bucket_name}
endpoint: s3.amazonaws.com
insecure:
region: {region}
roleARN: {aws_role_arn}
metricsConfig:
enabled: true
path: /metrics
port: 9090
ignoreErrors: false
secure: false
workflowDefaults:
spec:
activeDeadlineSeconds: 7200
ttlStrategy:
secondsAfterCompletion: 172800
sso:
issuer: {issuer}
clientId:
name: argo-workflows-sso
key: client-id
clientSecret:
name: argo-workflows-sso
key: client-secret
redirectUrl: {oauth_callback}
rbac:
enabled: true
scopes:
- profile
- groups
- email
nodeEvents:
enabled: true
kind: ConfigMap
metadata:
{...I removed this section as deemed no necessary...}
creationTimestamp: '2023-06-09T22:41:12Z'
labels:
app.kubernetes.io/component: workflow-controller
app.kubernetes.io/instance: argo-workflows
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: argo-workflows-0-33-1-cm
app.kubernetes.io/part-of: argo-workflows
argocd.argoproj.io/instance: argo-workflows
helm.sh/chart: argo-workflows-0-33-1-0.33.1
name: argo-workflows-workflow-controller-configmap
namespace: argo-workflows
resourceVersion: '1234375504' |
Beta Was this translation helpful? Give feedback.
-
As I mentioned in the other thread above, that is a k8s credentials error. It's coming from the k8s client initialization. That adds up with your current answer regarding |
Beta Was this translation helpful? Give feedback.
-
|
@Jackie-Haiyu A solution was posted on the slack channel , I tried it and it worked!!! Simply remove the following from your ServiceAccount: automountServiceAccountToken: falseAs soon as I remove that one line it deployed successfully. |
Beta Was this translation helpful? Give feedback.
-
|
The SA mount gives a Pod credentials to the k8s API, so that adds up. See also the k8s docs on this: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#opt-out-of-api-credential-automounting |
Beta Was this translation helpful? Give feedback.
-
|
I have removed the line from automountServiceAccountToken: falseand I grant But I cann't run my pod in kubeEdge cluster,here is the mistake: the apiVersion: argoproj.io/v1alpha1
kind: Workflow
metadata:
generateName: output-parameter-
spec:
entrypoint: output-parameter
templates:
- name: output-parameter
steps:
- - name: generate-parameter
template: nginx
- - name: consume-parameter
template: print-message
arguments:
parameters:
- name: message
value: "{{steps.generate-parameter.outputs.parameters.nginx-index}}"
- name: nginx
nodeSelector:
kubernetes.io/hostname: "edge1"
container:
image: docker.m.daocloud.io/nginx:latest
command: [sh, -c]
args: ["sleep 1; cat /usr/share/nginx/html/index.html"]
outputs:
parameters:
- name: nginx-index
valueFrom:
default: "Foobar"
path: /usr/share/nginx/html/index.html
- name: print-message
nodeSelector:
kubernetes.io/hostname: "edge1"
inputs:
parameters:
- name: message
container:
image: docker.m.daocloud.io/alpine:latest
command: [echo]
args: ["{{inputs.parameters.message}}"]Any helps would be appreciated. |
Beta Was this translation helpful? Give feedback.
-
|
Try assigning one of your SAs to the Workflow by specifying a |
Beta Was this translation helpful? Give feedback.
-
|
I'm experiencing the same issue with http template, and I found the agent pod initialilzed AutomountServiceAccountToken with false. |
Beta Was this translation helpful? Give feedback.
@Jackie-Haiyu A solution was posted on the slack channel , I tried it and it worked!!!
Simply remove the following from your ServiceAccount:
As soon as I remove that one line it deployed successfully.