istioctl

Verified against the istioctl command reference. Current release is Istio 1.31.1.

Commands

Check configuration before anything is wrong:

istioctl analyze -n NS
istioctl analyze manifest.yaml

Which proxies are out of sync with the control plane:

istioctl proxy-status

What one sidecar actually received, which is where routing bugs are settled:

istioctl proxy-config route POD -n NS
istioctl proxy-config cluster POD -n NS
istioctl proxy-config listener POD -n NS
istioctl proxy-config endpoint POD -n NS

Certificates a workload is using:

istioctl proxy-config secret POD -n NS

Turn up proxy logging on one pod, without restarting it:

istioctl proxy-config log POD -n NS --level http:debug

Explain what the mesh is applying to a pod:

istioctl experimental describe pod POD -n NS

Open the built in dashboards:

istioctl dashboard kiali
istioctl dashboard envoy POD -n NS

Notes

proxy-status compares what the control plane sent against what each proxy acknowledged. STALE means the proxy never applied the update, which is a different problem from a rule that is wrong.

describe still lives under experimental. The short alias istioctl x works in its place.

proxy-config reads from the live Envoy admin interface on the pod. It shows what the proxy has, not what you declared, which is the whole point of using it.

Links

• istioctl reference
• Debugging Envoy and istiod