istio-ingressgateway always Waiting for Istio Pilot information

Question

I'm trying to deploy kubeflow on and OVH managed k8 cluster.

After the initial setup of the k8 cluster, I ran the following commands to install kubeflow, as suggested here:

# install
snap install juju --classic

# get cluster name (should be data-workflow)
# check using `cat ~/.kube/config` 
juju add-k8s data-workflow

# create a controller
juju bootstrap data-workflow tp-controller

# add the model
juju add-model kubeflow

# deploy kubeflow
juju deploy cs:kubeflow

# set url in authentication methods
juju config dex-auth public-url=http://foo.k8s.ovh.net
juju config oidc-gatekeeper public-url=http://foo.k8s.ovh.net

I see that the istio-ingress charm is always waiting- is this normal? how can i get this to start?

$ juju status
Model     Controller     Cloud/Region   Version  SLA          Timestamp
kubeflow  tp-controller  data-workflow  2.9.3    unsupported  12:18:03+02:00

App                        Version                    Status   Scale  Charm                 Store       Channel  Rev  OS          Address       Message
... 
istio-ingressgateway                                  waiting      1  istio-ingressgateway  charmstore  stable    20  kubernetes                Waiting for Istio Pilot information
...

Unit                          Workload  Agent  Address    Ports                                   Message
...                             
istio-ingressgateway/0*       waiting   idle                                                      Waiting for Istio Pilot information
...

Answer 1

This seems like a bug. Incredibly, it's mentioned in the video (at 6:40), but not in the docs (on the same page). It's also not actually written anywhere on the video description. Wonderful.

You need to open a terminal on the machine with kubectl installed, then run:

kubectl patch role -n kubeflow istio-ingressgateway-operator -p '{"apiVersion":"rbac.authorization.k8s.io/v1","kind":"Role","metadata":{"name":"istio-ingressgateway-operator"},"rules":[{"apiGroups":["*"],"resources":["*"],"verbs":["*"]}]}'

The istio-ingressgateway service will come up a couple of mins later.