Istio资源配置相关诊断项说明

异常示例

以下是一个有错误的VirtualService资源配置。

apiVersion: networking.istio.io/v1
kind: VirtualService
metadata:
  name: ratings-bogus-weight-default
  namespace: default
spec:
  hosts:
  - ratings
  http:
  - route:
    - destination:
        host: ratings
        subset: v1
      weight: 999
    - destination:
        host: ratings
        subset: v2
      weight: 888

在实际创建资源时，您会收到以下错误。

Error [IST0106] (VirtualService ratings-bogus-weight-default.default) Schema validation error: percentage 888 is not in range 0..100
Error [IST0106] (VirtualService ratings-bogus-weight-default.default) Schema validation error: percentage 999 is not in range 0..100

出现此错误的原因是在进行结构检查时，发现weight 属性的取值错误或无效。您可以根据错误信息中的描述对资源进行更正并重试。

异常示例

当您的集群中包含以下 DestinationRule 时：

apiVersion: networking.istio.io/v1
kind: DestinationRule
metadata:
  name: db-tls
spec:
  host: mydbserver.prod.svc.cluster.local
  trafficPolicy:
    tls:
      mode: SIMPLE
      clientCertificate: /etc/certs/myclientcert.pem
      privateKey: /etc/certs/client_private_key.pem
      # caCertificates 未设置

您会收到此消息：

Error [IST0128] (DestinationRule db-tls.default) DestinationRule default/db-tls in namespace default has TLS mode set to SIMPLE but no caCertificates are set to validate server identity for host: mydbserver.prod.svc.cluster.local

错误原因是示例中DestinationRule 的 db-tls 被明确为 TLS，但是没有设置 CA 证书文件。

修复方式

• 提供 CA 证书的文件名

• 修改流量策略为不需要证书的类型

异常示例

当您的集群中具有以下 DestinationRule 时：

apiVersion: networking.istio.io/v1
kind: DestinationRule
metadata:
  name: db-tls
spec:
  host: mydbserver.prod.svc.cluster.local
  trafficPolicy:
    portLevelSettings:
      - port:
          number: 443
        tls:
          mode: SIMPLE
          clientCertificate: /etc/certs/myclientcert.pem
          privateKey: /etc/certs/client_private_key.pem
          sni: my-nginx.mesh-external.svc.cluster.local
          # caCertificates 未设置

您将会收到此消息：

Error [IST0129] (DestinationRule db-tls.default) DestinationRule default/db-tls in namespace default has TLS mode set to SIMPLE but no caCertificates are set to validate server identity for host: mydbserver.prod.svc.cluster.local at port number:4430

在此示例中，DestinationRule的db-tls被指定为TLS，但是没有提供相关CA证书文件。

异常示例

当您的集群中包含下列 Virtual Service 时：

apiVersion: networking.istio.io/v1
kind: VirtualService
metadata:
  name: sample-foo-cluster01
  namespace: foo
spec:
  hosts:
  - sample.foo.svc.cluster.local
  http:
  - fault:
      delay:
        fixedDelay: 5s
        percentage:
          value: 100
    route:
    - destination:
        host: sample.foo.svc.cluster.local
  - mirror:
      host: sample.bar.svc.cluster.local
    route:
    - destination:
        host: sample.bar.svc.cluster.local
        subset: v1

您将会收到以下消息：

Warning [IST0130] (VirtualService sample-foo-cluster01.default) VirtualService rule #1 not used (only the last rule can have no matches).

在这个示例中，VirtualService 同时指定了 fault 和 mirror。 允许同时使用，但是必须在同一个路由下。用户在此处使用了两个不同的 http 路由条目（每个 - 一个条目），第一个会覆盖第二个。

修复方式

当 HTTP 路由未指定 match 条件时，只能存在一个 HTTP 路由。在这种情况下，移除 mirror 前的 - 符号表示这是一个单个无匹配条件的路由，它同时执行“注入故障”和“流量镜像”操作，而非创建两个独立的路由（一个仅注入故障，另一个仅镜像流量）。

注意 YAML 格式在复杂路由配置中的重要性：

• 请重新调整路由顺序，确保最具体的路由规则（如精确匹配路径或头信息的规则）优先排列。

• 将“通配路由”（catch all，即匹配所有流量的默认路由）置于列表末尾。

异常示例

当您的集群中包含下列 Virtual Service 时：

apiVersion: networking.istio.io/v1
kind: VirtualService
metadata:
  name: tls-routing
spec:
  hosts:
  - www1.googleapis.com
  - api1.facebook.com
  tls:
  - match:
    - port: 2443
      sniHosts:
      - www1.googleapis.com
    route:
    - destination:
        host: www1.googleapis.com
  - match:
    - port: 2443
      sniHosts:
      - www1.googleapis.com
    route:
    - destination:
        host: api1.facebook.com

您将会收到以下消息：

Info [IST0131] (VirtualService tls-routing.default) VirtualService rule #1 match #0 is not used (duplicates a match in rule #0).

在此示例中，虚拟服务为同一匹配条件配置了两个不同目标。Istio 仅采用第一个匹配规则，后续流量将不会路由到第二个目标。

修复方式

若需将流量分发至多个目标，请使用流量镜像功能（mirror）。

请重新排序路由规则，使最具体的匹配条件（如特定路径或头信息）优先匹配，并将通用的“通配路由”（catch all）置于列表末尾。

异常示例

当您的集群中包含下列ServiceEntry 时：

apiVersion: networking.istio.io/v1
kind: ServiceEntry
metadata:
  name: service-entry
  namespace: default
spec:
  hosts:
    - 'istio.io'
  exportTo:
    - "."
  ports:
    - number: 443
      name: https
  location: MESH_EXTERNAL
  resolution: DNS

apiVersion: networking.istio.io/v1
kind: ServiceEntry
metadata:
  name: service-entry
  namespace: default
spec:
  hosts:
    - 'istio.io'
  exportTo:
    - "."
  ports:
    - number: 443
      name: https
      protocol: TCP
  location: MESH_EXTERNAL
  resolution: DNS

您将收到以下消息：

Warning [IST0134] (ServiceEntry service-entry.default serviceentry.yaml:13) ServiceEntry addresses are required for this protocol.

修复方式

请确保在 protocol 未设置或设置为 TCP 时，在 ServiceEntry 中设置 addresses。 如果未设置 addresses，则将匹配 ServiceEntry 所定义的端口上的所有流量，与主机无关。

异常示例

以一个带有 INSERT_BEFORE 补丁操作的 EnvoyFilter 为例：

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: test-relative
  namespace: bookinfo
spec:
  workloadSelector:
    labels:
      app: reviews2
  configPatches:
    # 第一个补丁将 Lua 过滤器添加到 listener/http 连接管理器
  - applyTo: HTTP_FILTER
    match:
      context: SIDECAR_INBOUND
      listener:
        portNumber: 8080
        filterChain:
          filter:
            name: "envoy.filters.network.http_connection_manager"
            subFilter:
              name: "envoy.filters.http.router"
    patch:
      operation: INSERT_BEFORE
      value: # Lua 过滤器规范
       name: envoy.lua
       typed_config:
          "@type": "type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua"
          inlineCode: |
            function envoy_on_request(request_handle)
              -- Make an HTTP call to an upstream host with the following headers, body, and timeout.
              local headers, body = request_handle:httpCall(
               "lua_cluster",
               {
                [":method"] = "POST",
                [":path"] = "/acl",
                [":authority"] = "internal.org.net"
               },
              "authorize call",
              5000)
            end

修复方式

由于原来使用了 INSERT_BEFORE 的相对操作，所以现在将其更改为 INSERT_FIRST 的绝对操作将解决这个问题：

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: test-relative
  namespace: bookinfo
spec:
  workloadSelector:
    labels:
      app: reviews2
  configPatches:
    # 第一个补丁将 Lua 过滤器添加到 listener/http 连接管理器
  - applyTo: HTTP_FILTER
    match:
      context: SIDECAR_INBOUND
      listener:
        portNumber: 8080
        filterChain:
          filter:
            name: "envoy.filters.network.http_connection_manager"
            subFilter:
              name: "envoy.filters.http.router"
    patch:
      operation: INSERT_FIRST
      value: # Lua 过滤器规范
       name: envoy.lua
       typed_config:
          "@type": "type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua"
          inlineCode: |
            function envoy_on_request(request_handle)
              -- Make an HTTP call to an upstream host with the following headers, body, and timeout.
              local headers, body = request_handle:httpCall(
               "lua_cluster",
               {
                [":method"] = "POST",
                [":path"] = "/acl",
                [":authority"] = "internal.org.net"
               },
              "authorize call",
              5000)
            end

异常示例

以一个带有 REPLACE 补丁操作的 EnvoyFilter 为例，这个 EnvoyFilter 将被忽略：

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: test-replace-2
  namespace: bookinfo
spec:
  workloadSelector:
    labels:
      app: reviews2
  priority: 10
  configPatches:
    # 第一个补丁将 Lua 过滤器添加到 listener/http 连接管理器
  - applyTo: HTTP_FILTER
    match:
      context: SIDECAR_INBOUND
      listener:
        portNumber: 8080
        filterChain:
          filter:
            name: "envoy.filters.network.http_connection_manager"
            subFilter:
              name: "envoy.filters.http.router"
    patch:
      operation: REPLACE
      value: # Lua 过滤器规范
       name: envoy.lua
       typed_config:
          "@type": "type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua"
          inlineCode: |
            function envoy_on_request(request_handle)
              -- Make an HTTP call to an upstream host with the following headers, body, and timeout.
              local headers, body = request_handle:httpCall(
               "lua_cluster",
               {
                [":method"] = "POST",
                [":path"] = "/acl",
                [":authority"] = "internal.org.net"
               },
              "authorize call",
              5000)
            end

异常示例

如果一个 EnvoyFilter 附带有 ADD 补丁操作，该 EnvoyFilter 将被忽略：

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: test-auth-2
  namespace: bookinfo
spec:
  configPatches:
  - applyTo: ROUTE_CONFIGURATION
    match:
      context: SIDECAR_INBOUND
    patch:
      operation: ADD
      filterClass: AUTHZ # 此过滤器将在 Istio 的 authz 过滤器之后运行。
      value:
        name: envoy.filters.http.ext_authz
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
          grpc_service:
            envoy_grpc:
              cluster_name: acme-ext-authz
            initial_metadata:
            - key: foo
              value: myauth.acme # required by local ext auth server.

异常示例

创建了带有 REMOVE 补丁操作的 EnvoyFilter，这个 EnvoyFilter 将被忽略：

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: test-remove-2
  namespace: bookinfo
spec:
  workloadSelector:
    labels:
      app: mysvc2
  configPatches:
  - applyTo: ROUTE_CONFIGURATION
    match:
      context: GATEWAY
      listener:
        filterChain:
          sni: app.example.com
          filter:
            name: "envoy.filters.network.http_connection_manager.InternalAddressConfig"
    patch:
      operation: REMOVE

异常示例

一个 EnvoyFilter 使用了补丁操作 REPLACE，并配置了proxyVersion：

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: test-replace-3
  namespace: bookinfo
spec:
  workloadSelector:
    labels:
      app: reviews4
  configPatches:
    # 第一个补丁将 Lua 过滤器添加到 listener/http 连接管理器
  - applyTo: HTTP_FILTER
    match:
      context: SIDECAR_OUTBOUND
      proxy:
        proxyVersion: '^1\.11.*'
      listener:
        portNumber: 8080
        filterChain:
          filter:
            name: "envoy.filters.network.http_connection_manager"
            subFilter:
              name: "envoy.filters.http.router"
    patch:
      operation: REPLACE
      value: # Lua 过滤器规范
       name: envoy.lua
       typed_config:
          "@type": "type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua"
          inlineCode: |
            function envoy_on_request(request_handle)
              -- Make an HTTP call to an upstream host with the following headers, body, and timeout.
              local headers, body = request_handle:httpCall(
               "lua_cluster",
               {
                [":method"] = "POST",
                [":path"] = "/acl",
                [":authority"] = "internal.org.net"
               },
              "authorize call",
              1000)
            end

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: test-replace-4
  namespace: bookinfo
spec:
  workloadSelector:
    labels:
      app: reviews4
  configPatches:
  - applyTo: HTTP_FILTER
    match:
      context: SIDECAR_OUTBOUND
    patch:
      operation: REPLACE
      value: # Lua 过滤器规范
       name: envoy.lua
       typed_config:
          "@type": "type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua"
          inlineCode: |
            function envoy_on_request(request_handle)
              -- Make an HTTP call to an upstream host with the following headers, body, and timeout.
              local headers, body = request_handle:httpCall(
               "lua_cluster",
               {
                [":method"] = "POST",
                [":path"] = "/acl",
                [":authority"] = "internal.org.net"
               },
              "authorize call",
              5000)
            end

修复方式

由于 REPLACE 的相关操作是与 proxyVersion 一起使用， 所以可以添加 priority 来解决这个问题：

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: test-replace-3
  namespace: bookinfo
spec:
  workloadSelector:
    labels:
      app: reviews4
  priority: 10
  configPatches:
    # 第一个补丁将 Lua 过滤器添加到 listener/http 连接管理器
  - applyTo: HTTP_FILTER
    match:
      context: SIDECAR_OUTBOUND
      proxy:
        proxyVersion: '^1\.11.*'
      listener:
        portNumber: 8080
        filterChain:
          filter:
            name: "envoy.filters.network.http_connection_manager"
            subFilter:
              name: "envoy.filters.http.router"
    patch:
      operation: REPLACE
      value: # Lua 过滤器规范
       name: envoy.lua
       typed_config:
          "@type": "type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua"
          inlineCode: |
            function envoy_on_request(request_handle)
              -- Make an HTTP call to an upstream host with the following headers, body, and timeout.
              local headers, body = request_handle:httpCall(
               "lua_cluster",
               {
                [":method"] = "POST",
                [":path"] = "/acl",
                [":authority"] = "internal.org.net"
               },
              "authorize call",
              1000)
            end

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: test-replace-4
  namespace: bookinfo
spec:
  workloadSelector:
    labels:
      app: reviews4
  priority: 20
  configPatches:
  - applyTo: HTTP_FILTER
    match:
      context: SIDECAR_OUTBOUND
    patch:
      operation: REPLACE
      value: #Lua filter specification
       name: envoy.lua
       typed_config:
          "@type": "type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua"
          inlineCode: |
            function envoy_on_request(request_handle)
              -- Make an HTTP call to an upstream host with the following headers, body, and timeout.
              local headers, body = request_handle:httpCall(
               "lua_cluster",
               {
                [":method"] = "POST",
                [":path"] = "/acl",
                [":authority"] = "internal.org.net"
               },
              "authorize call",
              5000)
            end

修复方式

请确保具有指定 credentialName 的 Secret 存在于与 Gateway 工作负载相同的命名空间中， 并且该 Secret 包含有效的 TLS 证书。 您可能需要创建或更新 Secret 才能解决此问题。

如果 Secret 丢失，请使用正确的 TLS 证书和私钥创建一个新的 Secret。 例如，通过使用 kubectl：

kubectl create secret tls my-tls-secret --cert=path/to/cert.pem --key=path/to/key.pem -n <namespace>

确保将 <namespace> 替换为运行 Gateway 工作负载的实际命名空间， 并更新文件路径以指向正确的证书和密钥文件。

如果 Secret 存在但其中的 TLS 证书无效， 请使用正确的 TLS 证书和私钥来更新 Secret。

异常示例

1. 当集群的 ValidatingWebhookConfiguration 和 MutatingWebhookConfiguration缺少 Webhook URL 时：

   apiVersion: admissionregistration.k8s.io/v1
   kind: ValidatingWebhookConfiguration
   metadata:
     name: istio-validator-external-istiod
   webhooks:
   - admissionReviewVersions:
     - v1beta1
     - v1
     clientConfig:
       url:
     name: rev.validation.istio.io
   
   ---
   apiVersion: admissionregistration.k8s.io/v1
   kind: ValidatingWebhookConfiguration
   metadata:
     name: istiod-default-validator
   webhooks:
   - admissionReviewVersions:
     - v1beta1
     - v1
     clientConfig:
       url: https://test.com:15017/validate
     failurePolicy: Ignore
     name: validation.istio.io
   
   ---
   apiVersion: admissionregistration.k8s.io/v1
   kind: MutatingWebhookConfiguration
   metadata:
     name: istio-sidecar-injector-external-istiod
   webhooks:
   - admissionReviewVersions:
     - v1beta1
     - v1
     clientConfig:
       url:
     failurePolicy: Fail
     name: rev.namespace.sidecar-injector.istio.io
   - admissionReviewVersions:
     - v1beta1
     - v1
     clientConfig:
       url: https://test.com/inject/cluster/your-cluster-name/net/network1
     failurePolicy: Fail
     name: rev.object.sidecar-injector.istio.io
   - admissionReviewVersions:
     - v1beta1
     - v1
     clientConfig:
       url: https://test.com/inject/cluster/your-cluster-name/net/network1
     failurePolicy: Fail
     name: namespace.sidecar-injector.istio.io
   - admissionReviewVersions:
     - v1beta1
     - v1
     clientConfig:
       url: https://test.com/inject/cluster/your-cluster-name/net/network1
     failurePolicy: Fail
     name: object.sidecar-injector.istio.io

   您将收到此消息：

   Warning [IST0163] (MutatingWebhookConfiguration istio-sidecar-injector-external-istiod testing.yml:28) The hostname () that was provided for the webhook (rev.namespace.sidecar-injector.istio.io) to reach the ingress gateway on the external control plane cluster is blank. Traffic may not flow properly.
   Warning [IST0163] (ValidatingWebhookConfiguration istio-validator-external-istiod testing.yml:1) The hostname () that was provided for the webhook (rev.validation.istio.io) to reach the ingress gateway on the external control plane cluster is blank. Traffic may not flow properly.

2. 当集群的 ValidatingWebhookConfiguration 和 MutatingWebhookConfiguration所使用的主机名在 DNS 查询期间无法被解析时：

   apiVersion: admissionregistration.k8s.io/v1
   kind: ValidatingWebhookConfiguration
   metadata:
     name: istio-validator-external-istiod
   webhooks:
   - admissionReviewVersions:
     - v1beta1
     - v1
     clientConfig:
       url: https://thisisnotarealdomainname.com:15017/validate
     name: rev.validation.istio.io
   
   ---
   apiVersion: admissionregistration.k8s.io/v1
   kind: ValidatingWebhookConfiguration
   metadata:
     name: istiod-default-validator
   webhooks:
   - admissionReviewVersions:
     - v1beta1
     - v1
     clientConfig:
       url: https://test.com:15017/validate
     failurePolicy: Ignore
     name: validation.istio.io
   
   ---
   apiVersion: admissionregistration.k8s.io/v1
   kind: MutatingWebhookConfiguration
   metadata:
     name: istio-sidecar-injector-external-istiod
   webhooks:
   - admissionReviewVersions:
     - v1beta1
     - v1
     clientConfig:
       url: https://test.com/inject/cluster/your-cluster-name/net/network1
     failurePolicy: Fail
     name: rev.namespace.sidecar-injector.istio.io
   - admissionReviewVersions:
     - v1beta1
     - v1
     clientConfig:
       url: https://test.com/inject/cluster/your-cluster-name/net/network1
     failurePolicy: Fail
     name: rev.object.sidecar-injector.istio.io
   - admissionReviewVersions:
     - v1beta1
     - v1
     clientConfig:
       url: https://test.com/inject/cluster/your-cluster-name/net/network1
     failurePolicy: Fail
     name: namespace.sidecar-injector.istio.io
   - admissionReviewVersions:
     - v1beta1
     - v1
     clientConfig:
       url: https://test.com/inject/cluster/your-cluster-name/net/network1
     failurePolicy: Fail
     name: object.sidecar-injector.istio.io

   您将收到消息：

   Warning [IST0163] (ValidatingWebhookConfiguration istio-validator-external-istiod testing.yml:1) The hostname (https://thisisnotarealdomainname.com:15017/validate) that was provided for the webhook (rev.validation.istio.io) to reach the ingress gateway on the external control plane cluster cannot be resolved via a DNS lookup. Traffic may not flow properly.

修复方式

有多种方法可以解决这些无效配置，具体取决于配置无效的原因。

• 如果您的 Webhook 配置未定义 URL， 则添加使用主机名的有效 URL 将解决此警告消息。 有关如何执行此操作的说明可以在此处找到。

• 如果您的主机名无法通过 DNS 查找解析为 IP 地址， 您可以尝试在本地计算机上运行 dig <your-hostname> 来查看是否触发 DNS 解析。如果您的本地计算机可以通过 DNS 查询来解析主机名， 那可能是您的集群不能解析此主机名。任何阻止 DNS 流量的安全规则都可能导致解析查询失败。 新的 DNS 记录可能需要长达 72 小时才能在网络上传播， 具体取决于您的 DNS 提供商和具体配置。

• 如果您的主机名解析为 0 个 IP 地址，请检查 Webhook URL 是否使用正确的主机名，以及您的 DNS 提供商是否正确地拥有至少一个可供您的主机名解析的 IP 地址。

异常示例

当您有一个这样的 Kubernetes Gateway Pod：

apiVersion: v1
kind: Pod
metadata:
  annotations:
    istio.io/rev: default
  labels:
    gateway.networking.k8s.io/gateway-name: bookinfo-gateway
  name: bookinfo-gateway-istio-6ff4cf9645-xbqmc
  namespace: default
spec:
  containers:
  - image: xxxxxxx-proxyv2:v1
    name: istio-proxy

然后创建了以下带有 selector的AuthorizationPolicy ：

apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
  namespace: default
  name: ap-ineffective
spec:
  selector:
    matchLabels:
      gateway.networking.k8s.io/gateway-name: bookinfo-gateway
  action: DENY
  rules:
  - from:
    - source:
      namespaces: ["dev"]
    to:
    - operation:
      methods: ["POST"]

您将收到消息：

Warning [IST0166] (AuthorizationPolicy default/ap-ineffective testdata/k8sgateway-selector.yaml:47) Ineffective selector on Kubernetes Gateway bookinfo-gateway. Use the TargetRef field instead.

修复方式

确保为 Sidecar 或 Istio Gateway Pod 使用 selector 字段， 并为 Kubernetes Gateway Pod 使用 targetRef 字段。 否则，此策略将不会生效。例如：

apiVersion: telemetry.istio.io/v1
kind: Telemetry
metadata:
  name: telemetry-example
  namespace: default
spec:
  tracing:
  - randomSamplingPercentage: 10.00
  targetRef:
    group: gateway.networking.k8s.io
    kind: Gateway
    name: bookinfo-gateway

异常示例

若您收到以下消息：

Warning [IST0167] (Sidecar ns-ambient/namespace-scoped testdata/sidecar-default-selector.yaml:84) The policy has no
impact: namespace is in ambient mode, the policy has no impact.
Warning [IST0167] (Sidecar ns-ambient/pod-scoped testdata/sidecar-default-selector.yaml:90) The policy has no impact:
selected workload is in ambient mode, the policy has no impact.

这些消息表明 Sidecar 资源的目标是处于 Ambient 模式的工作负载或命名空间， 这意味着 Sidecar 资源中指定的策略没有任何效果。

修复方式

请确保此策略被正确定义或确定此策略是否必要。 如果命名空间或 Pod 是最近被添加 Ambient 网格中的，您可能忘记了移除不再需要的策略， 或者您可能需要更新策略的目标为正确的工作负载或命名空间。