istioctl command: options and 10 examples

What it does

A service mesh adds a proxy (Envoy) next to every pod, or a node proxy in ambient mode. The mesh then gives mTLS between services, retries, timeouts and traffic splitting — without changing the apps. istioctl installs Istio, checks the config (analyze) and shows what each proxy really does (proxy-config).

The traffic rules themselves are Kubernetes objects: VirtualService, DestinationRule, Gateway, PeerAuthentication.

How to write it

istioctl COMMAND [OPTIONS]

Main parts

Commands

install --set profile=NAME: Install Istio (default, demo, minimal, ambient).
verify-install: Check the install.
analyze [-A]: Find problems in the mesh config.
proxy-status: Is every proxy in sync with the control plane?
proxy-config routes|clusters|listeners POD: The Envoy config of one pod.
x describe pod POD: Which rules apply to a pod.
dashboard kiali|grafana|jaeger: Open a dashboard.
upgrade / uninstall --purge: Upgrade / remove Istio.
version: Client and control plane versions.

Options 6

Most used

Options

-n, --namespace NS: Namespace.
-A, --all-namespaces: All namespaces (analyze).
--set KEY=VALUE: Install setting.
-f FILE: IstioOperator file.
-y, --skip-confirmation: No question.
-o json|yaml: Output format.

Examples 10

$ run as a normal user# run as root (or with sudo)

1Install and add the sidecar to a namespace

$istioctl install --set profile=default -y
$kubectl label namespace shop istio-injection=enabled
$kubectl rollout restart deploy -n shop

2Ambient mode (no sidecars)

$istioctl install --set profile=ambient -y
$kubectl label namespace shop istio.io/dataplane-mode=ambient

3Check the config
```
$istioctl analyze -A
```
4Are all proxies in sync?
```
$istioctl proxy-status
```

5Force mTLS in a namespace

$cat peer-auth.yaml
apiVersion: security.istio.io/v1
kind: PeerAuthentication
metadata: { name: default, namespace: shop }
spec: { mtls: { mode: STRICT } }
$kubectl apply -f peer-auth.yaml

6Canary: 90 % to v1, 10 % to v2

$cat vs.yaml
apiVersion: networking.istio.io/v1
kind: VirtualService
metadata: { name: shop, namespace: shop }
spec:
  hosts: [shop]
  http:
    - route:
        - { destination: { host: shop, subset: v1 }, weight: 90 }
        - { destination: { host: shop, subset: v2 }, weight: 10 }
$kubectl apply -f vs.yaml

7Which rules apply to this pod?

$istioctl x describe pod shop-7d9c-abcde -n shop

8The routes Envoy really uses

$istioctl proxy-config routes deploy/shop -n shop

9Open Kiali (needs the add-on)
```
$istioctl dashboard kiali
```
10Versions
```
$istioctl version
```

Watch out

Sidecars add CPU, memory and latency to every pod; size the nodes for it.
STRICT mTLS breaks callers outside the mesh; start with PERMISSIVE and check.

Tips to remember

Linkerd is a lighter mesh with the same basic ideas.

Exit codes

`0`	OK.
`1`	Error.
`79`	`analyze` found problems.

`istioctl`

What it does

How to write it

Main parts

Commands

Options 6

Options

Examples 10

1Install and add the sidecar to a namespace

2Ambient mode (no sidecars)

3Check the config

4Are all proxies in sync?

5Force mTLS in a namespace

6Canary: 90 % to v1, 10 % to v2

7Which rules apply to this pod?

8The routes Envoy really uses

9Open Kiali (needs the add-on)

10Versions

Watch out

Tips to remember

Exit codes

Full manual

istioctl

What it does

How to write it

Main parts

Commands

Options 6

Options

Examples 10

1Install and add the sidecar to a namespace

2Ambient mode (no sidecars)

3Check the config

4Are all proxies in sync?

5Force mTLS in a namespace

6Canary: 90 % to v1, 10 % to v2

7Which rules apply to this pod?

8The routes Envoy really uses

9Open Kiali (needs the add-on)

10Versions

Watch out

Tips to remember

Exit codes

Related commands

Used in these lessons

Full manual

`istioctl`