启用 Arc 的 kubernetes - Envoy 松了？证书 ？集群重新启动并返回监听器上的连接重置后

如何解决启用 Arc 的 kubernetes - Envoy 松了？证书 ？集群重新启动并返回监听器上的连接重置后

与我的原始问题有关（那里有更多日志和安装命令）https://github.com/envoyproxy/envoy/issues/17484

安装脚本：https://pastebin.com/igCc5KwR

connect error or disconnect/reset before headers. reset reason: connection failure,transport failure reason: TLS error: CERTIFICATE_VERIFY_FAILED

首次部署后，集群重启前

集群重启后几分钟，当“某事”同步时

问题 你部署启用了 arc 的 k8s，连接位置，启用扩展，一切正常，你可以通过 URL 访问你的应用服务，很好！ 然后重新启动集群，重新创建 pod，并在几分钟内全部中断。 根据我的观察，要么

• app-controller 与 Azure 同步（或不同步）证书/令牌，
• OR envoy 在挂载应用服务 pod 提供的 XDR 证书时遇到问题（它们共享卷）
• 或者服务帐户令牌可能没有刷新？

我想，由于我不清楚缺少什么，我认为这是一些秘密，但没有发现任何...... 但这很奇怪

"envoy","msg":"error reading default cert","error":"140261821150336:error:0D06B08E:asn1 编码例程:asn1_d2i_read_bio:数据不足

Arc 上有少量文档：/ 对于一个开放项目，我很想看到源舵图 我注意到你在集群秘密中存储了一个，但我解密失败，有什么建议吗？

kubectl get secret sh.helm.release.v1.appservice-ext-node1-v1.v3   --namespace appservice-ns-node1-v1  -o=jsonpath={.data.release}   |base64 -d > /tmp/helm.base

为什么 Envoy 会给出 ERROR_CONN_RESET：

https://www.envoyproxy.io/docs/envoy/latest/configuration/security/secret#config-secret-discovery-service

如果 SDS 需要远程获取监听服务器证书， 它不会被标记为活动的，它的端口之前不会被打开 获取证书。如果 Envoy 无法获取证书 由于连接失败或错误的响应数据，侦听器将 标记为活动的，端口将打开，但与 端口将被重置。

最有趣的错误，发现于 appservice-ext-node1-v1-k8se-app-controller-85cb587976-nwr6h

{"level":"info","ts":1627301876.563232,"logger":"controller-runtime.metrics","msg":"metrics server is starting to listen","addr":"127.0.0.1:8080"}
{"level":"error","ts":1627301876.6502664,"logger":"envoy","msg":"Error reading default cert","error":"140453565756544:error:0D06B08E:asn1 encoding routines:asn1_d2i_read_bio:not enough data:../crypto/asn1/a_d2i_fp.c:198:\n\nexit status 1","stacktrace":"main.main\n\t/__w/k4a
pps/k4apps/cmd/appcontroller/main.go:124\nruntime.main\n\t/usr/local/go/src/runtime/proc.go:225"}
{"level":"error","ts":1627301876.6528075,"msg":"error reading dapr cert","error":"secrets "dapr-trust-bundle" not found","stacktrace":"main.main\n\t/__w/k4apps/k4apps/cmd/appcontroller/main.go:124\nruntime.main\n\t/usr/local/go/src/runtime/proc.go:225"}
{"level":"info","ts":1627301876.7418113,"logger":"setup","msg":"starting manager"}
I0726 12:17:56.741905 1 leaderelection.go:243] attempting to acquire leader lease appservice-ns-node1-v1/appservice-ns-node1-v1-appservice-ns-node1-v1...
{"level":"info","ts":1627301876.7421775,"logger":"controller-runtime.manager","msg":"starting metrics server","path":"/metrics"}
{"level":"error","ts":1627301877.841797,"error":"140261821150336:error:0D06B08E:asn1 encoding routines:asn1_d2i_read_bio:not enough data:../crypto/asn1/a_d2i_fp.c:198:\n\nexit status 1","stacktrace":"github.com/microsoft/k
4apps/pkg/envoy.(*XDSManagementServer).updateTLSCert\n\t/__w/k4apps/k4apps/pkg/envoy/envoy.go:379\ngithub.com/microsoft/k4apps/pkg/envoy.(*XDSManagementServer).watchDefaultTLSCert.func3\n\t/__w/k4apps/k4apps/pkg/envoy/envoy.go:336\nk8s.io/client-go/tools/cache.ResourceEvent
HandlerFuncs.OnAdd\n\t/go/pkg/mod/k8s.io/client-go@v0.20.4/tools/cache/controller.go:231\nk8s.io/client-go/tools/cache.(*processorListener).run.func1\n\t/go/pkg/mod/k8s.io/client-go@v0.20.4/tools/cache/shared_informer.go:777\nk8s.io/apimachinery/pkg/util/wait.BackoffUntil.f
unc1\n\t/go/pkg/mod/k8s.io/apimachinery@v0.20.5/pkg/util/wait/wait.go:155\nk8s.io/apimachinery/pkg/util/wait.BackoffUntil\n\t/go/pkg/mod/k8s.io/apimachinery@v0.20.5/pkg/util/wait/wait.go:156\nk8s.io/apimachinery/pkg/util/wait.JitterUntil\n\t/go/pkg/mod/k8s.io/apimachinery@v
0.20.5/pkg/util/wait/wait.go:133\nk8s.io/apimachinery/pkg/util/wait.Until\n\t/go/pkg/mod/k8s.io/apimachinery@v0.20.5/pkg/util/wait/wait.go:90\nk8s.io/client-go/tools/cache.(*processorListener).run\n\t/go/pkg/mod/k8s.io/client-go@v0.20.4/tools/cache/shared_informer.go:771\nk
8s.io/apimachinery/pkg/util/wait.(*Group).Start.func1\n\t/go/pkg/mod/k8s.io/apimachinery@v0.20.5/pkg/util/wait/wait.go:73"}
{"level":"info","ts":1627301877.8429492,"msg":"Processed on startup","count":2}
{"level":"info","ts":1627301877.8429906,"logger":"envoy.stopwatch","msg":"measured: ","Initializing snapshot":1101}
{"level":"info","ts":1627301877.8430026,"msg":"starting xds and auth server on port 9090"}
I0726 12:18:13.706604 1 leaderelection.go:253] successfully acquired lease appservice-ns-node1-v1/appservice-ns-node1-v1-appservice-ns-node1-v1