Problems installing the istio chart

[empath]

I'm using 10.6

If I leave the requirements.yaml file in the directory, it fails on the helm dependency build step.
Since the requirements are all included in the directory, I can delete it, and helm template still produces the correct manifests and running kubectl works locally with what it produces.

Without the requirements.yaml file -- istio still fails on the dry run because it has lots of CRD's included. I thought that version 10 was supposed to resolve the CRD problem?

[amarrella]

A complete guide to install istio with argocd would be helpful if anyone has done it! I keep bumping into issues as well.

@empath so far we managed to do (for istio 1.0.3):

• get a copy of the istio chart in one of our repos pulled by argocd
• renamed the charts directory into "subcharts" to not create conflict
• changed requirements.yaml to the following:

dependencies:
  - name: sidecarInjectorWebhook
    version: 1.0.3
    condition: sidecarInjectorWebhook.enabled
    repository: file://subcharts/sidecarInjectorWebhook
  - name: security
    version: 1.0.3
    condition: security.enabled
    repository: file://subcharts/security
  - name: ingress
    version: 1.0.3
    condition: ingress.enabled
    repository: file://subcharts/ingress
  - name: gateways
    version: 1.0.3
    condition: gateways.enabled
    repository: file://subcharts/gateways
  - name: mixer
    version: 1.0.3
    condition: mixer.enabled
    repository: file://subcharts/mixer
  - name: pilot
    version: 1.0.3
    condition: pilot.enabled
    repository: file://subcharts/pilot
  - name: grafana
    version: 1.0.3
    condition: grafana.enabled
    repository: file://subcharts/grafana
  - name: prometheus
    version: 1.0.3
    condition: prometheus.enabled
    repository: file://subcharts/prometheus
  - name: servicegraph
    version: 1.0.3
    condition: servicegraph.enabled
    repository: file://subcharts/servicegraph
  - name: tracing
    version: 1.0.3
    condition: tracing.enabled
    repository: file://subcharts/tracing
  - name: galley
    version: 1.0.3
    condition: galley.enabled
    repository: file://subcharts/galley
  - name: kiali
    version: 1.0.3
    condition: kiali.enabled
    repository: file://subcharts/kiali
  - name: certmanager
    version: 1.0.3
    condition: certmanager.enabled
    repository: file://subcharts/certmanager

This should get you as far as seeing the application on argocd and pass the dependency build step, but sync will fail with a bunch of errors because the server could not find the requested resource.
If anyone knows how to get out of it without separating the crds it would be really helpful. I thought i solved it in #748 but that's not the case

[alexmt]

Tested istio installation and discovered following blocking issues:

• Istio helm chart annotates all CRDs with "helm.sh/hook": crd-install. Right now argocd ignores helm hooks. Should be solved by Map helm lifecycle hooks to ArgoCD pre/post/sync hooks #355
• Istio helm chart tries to install one resource into hardcoded namespace different from application namespace which is not supported yet. Should be solved by Ability for a single application to deploy into multiple namespaces #696
• ArgoCD stores state of each resource in app CRD. Istio helm chart defines more than 100 resources and app state does not feed into etcd limit. Should be solved by Error updating application <app>: etcdserver: request is too large #621
• Istio chart has dependencies in non-default repos. Should be solved by Declaratively add helm repositories #747
• Panic in application controller: Panic in application controller #790

[amarrella]

Thanks @alexmt . The pace at which you and the other contributors solve the issues and argocd improves is amazing!

[alexmt]

Looks like all issues are solved in master. I was able to successfully install istio from
repo https://github.com/istio/istio under install/kubernetes/helm/istio. The istio.io helm repo might be registered using helm.repositories field in argocd-cm ConfigMap.

  helm.repositories: |
    - url: https://storage.googleapis.com/istio-release/releases/1.1.0-snapshot.3/charts
      name: istio.io

[alexmt]

If certmanager is enabled then ClusterIssuer resources stays out-of-sync forever. Upsteam fix is required to solve it: istio/istio#10280 .